registry / videodraft / 0.3.4

videodraft@0.3.4

Official VideoDraft CLI — create AI videos, images and audio from your terminal. Agent-friendly: --json everywhere, stable exit codes, async job polling.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 214 KB of source, external domains: 127.0.0.1, app.videodraft.ai, registry.npmjs.org, us.i.posthog.com, videodraft.ai

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res) => function __init() {

5 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

6};

7var __export = (target, all) => {

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

12// src/version.ts

13var version_exports = {};

14__export(version_exports, {

15 VERSION: () => VERSION

16});

17import fs from "fs";

18function readVersionFromDisk() {

19 try {

20 const pkg = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8"));

21 return typeof pkg.version === "string" ? pkg.version : "0.0.0";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L19

22 } catch {

23 return "0.0.0";

24 }

25}

26function resolveVersion() {

27 if ("0.3.4") {

28 return "0.3.4";

29 }

30 return readVersionFromDisk();

31}

32var VERSION;

33var init_version = __esm({

34 "src/version.ts"() {

35 "use strict";

36 VERSION = resolveVersion();

37 }

38});

Lines 434-474javascript

434 const res = await fetch("https://registry.npmjs.org/videodraft/latest", {

435 signal: AbortSignal.timeout(1500),

436 headers: { accept: "application/json" }

437 });

438 if (!res.ok) return;

439 const body =

Lines 3158-3198javascript

3158 const key = (section ?? "").toLowerCase();

3159 let rel;

3160 if (Object.hasOwn(SECTION_ALIASES, key)) rel = SECTION_ALIASES[key];

3161 else if (section && Object.hasOwn(files, section)) rel = section;

Source & flagged code

3 flagged · loading source

dist/index.jsView file

454// src/commands/auth.ts L455: import { spawn } from "child_process"; L456:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L454

3178emit(ctx.out, { path: dir }, () => { L3179: process.stdout.write(`${dir} L3180: `); ... L3185: // src/commands/misc.ts L3186: import { spawn as spawn3 } from "child_process"; L3187: var DOCS_URL = "https://videodraft.ai/cli"; L3188: function registerMiscCommands(program) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L3178

19try { L20: const pkg = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")); L21: return typeof pkg.version === "string" ? pkg.version : "0.0.0"; ... L51: var CliError = class extends Error { L52: exitCode; L53: /** One-line remediation shown under the error (human mode only). */ ... L89: isCredits ? EXIT.CREDITS : EXIT.ERROR, L90: isCredits ? "Check your balance with `videodraft credits` or top up at https://app.videodraft.ai/pricing" : void 0 L91: ); ... L109: const isTTY = Boolean(process.stdout.isTTY); L110: const noColorEnv = Boolean(process.env.NO_COLOR); L111: return {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L19

Findings

4 High3 Medium5 Low

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res) => function __init() {

5 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

6};

7var __export = (target, all) => {

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

12// src/version.ts

13var version_exports = {};

14__export(version_exports, {

15 VERSION: () => VERSION

16});

17import fs from "fs";

18function readVersionFromDisk() {

19 try {

20 const pkg = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8"));

21 return typeof pkg.version === "string" ? pkg.version : "0.0.0";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L19

22 } catch {

23 return "0.0.0";

24 }

25}

26function resolveVersion() {

27 if ("0.3.4") {

28 return "0.3.4";

29 }

30 return readVersionFromDisk();

31}

32var VERSION;

33var init_version = __esm({

34 "src/version.ts"() {

35 "use strict";

36 VERSION = resolveVersion();

37 }

38});

Lines 434-474javascript

434 const res = await fetch("https://registry.npmjs.org/videodraft/latest", {

435 signal: AbortSignal.timeout(1500),

436 headers: { accept: "application/json" }

437 });

438 if (!res.ok) return;

439 const body =

Lines 3158-3198javascript

3158 const key = (section ?? "").toLowerCase();

3159 let rel;

3160 if (Object.hasOwn(SECTION_ALIASES, key)) rel = SECTION_ALIASES[key];

3161 else if (section && Object.hasOwn(files, section)) rel = section;