github.com / yt-dlp

yt-dlp/yt-dlp

Python·1239 files·commit bbc809a·scanned 13d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 187,905+ stars — findings likely false positives

verdict accurate?

187,905 stars

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.devscripts/utils.py

    items = {}
    exec(compile(read_file(fname), fname, 'exec'), items)
    return items[varname]

criticalPython remote code executionFetching code from a remote URL and immediately executing it (exec(requests.get(...).text)) is a classic malware dropper pattern.devscripts/utils.py

import subprocess
import urllib.parse
import urllib.request
import zipfile

+10

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.yt_dlp/extractor/presstv.py

        # specified in http://www.presstv.ir/Scripts/playback.js
        base_url = 'http://192.99.219.222:82/presstv'
        _formats = [
            (180, '_low200.mp4'),

warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.yt_dlp/extractor/saitosan.py

            'uploader': '井下原 和弥',
            'thumbnail': 'http://111.171.196.85:8088/921f916f-7f55-4c97-b92e-5d9d0fef8f5f/thumb',
            'is_live': True,
        },

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.yt_dlp/cookies.py

            # Existing FF version<=146 installations
            '~/.mozilla/firefox',
            # Flatpak XDG: https://docs.flatpak.org/en/latest/conventions.html#xdg-base-directories
            '...

+10

warningHex-encoded string sequencesLong hex-encoded strings are commonly used to hide malicious code from code review.test/test_cookies.py

        cookies = (
            b'cook\x00\x00\x00\x01\x00\x00\x00i\x00\x00\x01\x00\x01\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00Y'
            b'\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x0...

warningHex-encoded string sequencesLong hex-encoded strings are commonly used to hide malicious code from code review.test/test_jsc/test_ejs_integration.py

            'NJAJEij0EwRgIhAI0KExTgjfPk-MPM9MAdzyyPRt=BM8-XO5tm5hzMCSVpAiEAv7eP3CURqZNSPow8BXXAoazVoXgeMP7gH9BdylHCwgw=gwzl',
        '\x00\x01\x02%\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15...

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.yt_dlp/extractor/cbsnews.py+4

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.yt_dlp/extractor/googledrive.py+4

warningHex-encoded string sequencesLong hex-encoded strings are commonly used to hide malicious code from code review.yt_dlp/extractor/hotstar.py

    _API_URL_V2 = 'https://www.hotstar.com/api/internal/bff/v2'
    _AKAMAI_ENCRYPTION_KEY = b'\x05\xfc\x1a\x01\xca\xc9\x4b\xc4\x12\xfc\x53\x12\x07\x75\xf9\xee'

    _FREE_HEADERS = {

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.yt_dlp/extractor/seznamzpravy.py+4

warningHigh-entropy string literalsFound 8 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.devscripts/make_changelog.py+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.devscripts/make_changelog.py+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.devscripts/make_readme.py+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.devscripts/prepare_manpage.py+3

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.devscripts/tomlparse.py+3

warningHigh-entropy string literalsFound 7 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.devscripts/update_requirements.py+3

warningLarge base64-encoded blobA 96-character base64 blob was found. May hide a remote payload or encoded executable code.test/test_InfoExtractor.py

000000016742C00CDB06077E5C05A808080A00000300020000030009C0C0...

warningLarge hex-encoded blobA 96-character hex blob was found. Often used to hide shellcode or C2 addresses.test/test_InfoExtractor.py

000000016742C00CDB06077E5C05A808080A00000300020000030009C0C0...

warningLarge base64-encoded blobA 128-character base64 blob was found. May hide a remote payload or encoded executable code.test/test_utils.py

726664bd9a23fd0c70f9f1b84aab5e3905ce1e45a584e9cbcf9bcc751033...

warningLarge hex-encoded blobA 128-character hex blob was found. Often used to hide shellcode or C2 addresses.test/test_utils.py

726664bd9a23fd0c70f9f1b84aab5e3905ce1e45a584e9cbcf9bcc751033...

warningLarge base64-encoded blobA 88-character base64 blob was found. May hide a remote payload or encoded executable code.yt_dlp/extractor/ard.py

Y3JpZDovL2Rhc2Vyc3RlLmRlL3RhZ2Vzc2NoYXUvZmM4ZDUxMjgtOTE0ZC00...

infoSuspicious file in repoExecutable file (yt-dlp.cmd) in repositoryyt-dlp.cmd+2

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.yt_dlp/extractor/imggaming.py

    _API_BASE = 'https://dce-frontoffice.imggaming.com/api/v2/'
    _API_KEY = '857a1e5d-e35e-4fdf-805b-a87b6f8364bf'
    _HEADERS = None
    _MANIFEST_HEADERS = {'Accept-Encoding': 'identity'}

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1125 files scanned @ bbc809a | 8/30/2026 | heuristic scan — always review manually

risk by category

code execution19

network & exfiltration10

file system access10

obfuscation15

supply chain2

owasp / injection3

telemetry

files 1125/1239rules hit 25engine v5commit bbc809a

github

yt-dlp/yt-dlp

A feature-rich command-line audio/video downloader

Python

187905

16252

2148d

1239 files

1125 scanned(91%)

bbc809a

architecture░▒▓

entry (0) flagged (497) pkg (118)

615 nodes · 1219 edgesscroll to zoom · click node to jump to finding