registry / peertube-plugin-yaktube-ondemand / 1.5.4

peertube-plugin-yaktube-ondemand@1.5.4

⚠ Under review

Accessible On-Demand YouTube Import, Live Streams, Smart Recommendations, Sleep Timer, Touch Gestures, Voice Assistant & A11y Engine for PeerTube

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 2 file(s), 220 KB of source, external domains: api.qrserver.com, cdnjs.yakhub.com.tr, developer-console.yakhub.com.tr, i.ytimg.com, www.youtube-nocookie.com, www.youtube.com, yaktube.yakhub.com.tr

Source & flagged code

4 flagged

main.jsView file

Lines 1-21javascript

1const { execFile } = require('child_process');

2const path = require('path');

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1

3const http = require('http');

4const fs = require('fs');

6const searchCache = new Map();

7const CACHE_TTL = 30 * 60 * 1000; // 30 minutes

9let cachedYtDlpPath = null;

10function resolveYtDlpPath(logger) {

11 if (cachedYtDlpPath && (cachedYtDlpPath === 'yt-dlp' || fs.existsSync(cachedYtDlpPath))) {

12 return cachedYtDlpPath;

13 }

15 // 1. Environment variable override

16 if (process.env.YTDLP_PATH && fs.existsSync(process.env.YTDLP_PATH)) {

17 cachedYtDlpPath = process.env.YTDLP_PATH;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

main.jsView on unpkg · L1

18 return cachedYtDlpPath;

19 }

21 // 2. Cross-platform candidates

Lines 117-157javascript

117 return new Promise((resolve, reject) => {

118 const req = http.request(

119 {

120 hostname: '127.0.0.1',

121 port:

•matchType = normalized_sha256 matchedPackage = peertube-plugin-yaktube-ondemand@1.5.2 matchedPath = main.js matchedIdentity = npm:[redacted]:1.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

main.jsView on unpkg

Source & flagged code

4 flagged · loading source

main.jsView file

peertube-plugin-yaktube-ondemand@1.5.4

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code