Is @byteplus/veplayer-plugin safe to install?

@byteplus/veplayer-plugin was flagged as CRITICAL RISK (risk score 12465) with 813 findings detected across 62 files. Review the findings before installing.

What security issues were found in @byteplus/veplayer-plugin?

Sigil detected 813 findings in @byteplus/veplayer-plugin, including patterns related to install_hooks, code_patterns, obfuscation. See the full scan report for details.

@byteplus/veplayer-plugin Security Scan — CRITICAL RISK | Sigil

CRITICAL RISK(12465)

v2.4.0

23 March 2026, 04:12 UTC

by Sigil Bot

Risk Score

12465

Findings

813

Files Scanned

62

Provenance

Registry

https://www.npmjs.com/package/@byteplus/veplayer-plugin/v/2.4.0

Scanned From

https://registry.npmjs.org/@byteplus/veplayer-plugin/-/veplayer-plugin-2.4.0.tgz

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-pip-setup-exec

CRITICAL

setup.py executes code at install time

package/esm/index.development.js:100491

                  return c2["return"]();
                B.debug("init: completed initial Stream setup");
                a.g && a.g.Yf && (B.K("init: calling onInitialStreamsSetup()..."), a.g.Yf());

Why was this flagged?

This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.

install-pip-setup-exec

CRITICAL

setup.py executes code at install time

package/esm/index.production.js:18

       Copyright 2006 The Closure Library Authors
       SPDX-License-Identifier: Apache-2.0
      */function J(e){var t;e instanceof J?(Q(this,e.Ba),this.pb=e.pb,this.Aa=e.Aa,q(this,e.Ob),this.pa=e.pa,ee(this,e.g.clone()),this.bb=e.bb):e&&(t=String(e).match(z))?(Q(this,t[1]||"",!0),this.pb=te(t[2]||""),this.Aa=te(t[3]||"",!0),q(this,t[4]),this.pa=te(t[5]||"",!0),ee(this,t[6]||"",!0),this.bb=te(t[7]||"")):this.g=new ue(null)}function Q(e,t,r){e.Ba=r?te(t,!0):t,e.Ba&&(e.Ba=e.Ba.replace(/:$/,""))}

Why was this flagged?

This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.

install-pip-setup-exec

CRITICAL

setup.py executes code at install time

package/esm/veplayer.plugin.shaka.development.js:9520

                B.debug("init: completed initial Stream setup");
                a.g && a.g.Yf && (B.K("init: calling onInitialStreamsSetup()..."), a.g.Yf());
                w(c2);

Why was this flagged?

This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.

install-pip-setup-exec

CRITICAL

setup.py executes code at install time

package/esm/veplayer.plugin.shaka.production.js:12

      Copyright 2006 The Closure Library Authors
      SPDX-License-Identifier: Apache-2.0
      */function oe(e){var t;e instanceof oe?(ae(this,e.Ba),this.pb=e.pb,this.Aa=e.Aa,se(this,e.Ob),this.pa=e.pa,le(this,e.g.clone()),this.bb=e.bb):e&&(t=String(e).match(ie))?(ae(this,t[1]||"",!0),this.pb=ce(t[2]||""),this.Aa=ce(t[3]||"",!0),se(this,t[4]),this.pa=ce(t[5]||"",!0),le(this,t[6]||"",!0),this.bb=ce(t[7]||"")):this.g=new $e(null)}function ae(e,t,r){e.Ba=r?ce(t,!0):t,e.Ba&&(e.Ba=e.Ba.replace(/:$/

Why was this flagged?

This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.

install-pip-setup-exec

CRITICAL

setup.py executes code at install time

package/umd/veplayer.plugin.shaka.development.js:9524

                  B.debug("init: completed initial Stream setup");
                  a.g && a.g.Yf && (B.K("init: calling onInitialStreamsSetup()..."), a.g.Yf());
                  w(c2);

Why was this flagged?

This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.

install-pip-setup-exec

CRITICAL

setup.py executes code at install time

package/umd/veplayer.plugin.shaka.production.js:1

!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).__VEPLAYER_PLUGIN_SHAKA__=t()}(this,(function(){"use strict";var e="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function t(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}v

Why was this flagged?

This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/npm/@byteplus/veplayer-plugin)](https://sigilsec.ai/scans/6CA7A5A2-C277-451F-BCCB-AC1D268CAE73)

HTML

<a href="https://sigilsec.ai/scans/6CA7A5A2-C277-451F-BCCB-AC1D268CAE73"><img src="https://sigilsec.ai/badge/npm/@byteplus/veplayer-plugin" alt="Sigil Scan"></a>