Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/bbdown-wrapper.js:15
Security audit
bilibit
Security checks across malware telemetry and agentic risk
Overview
This appears to be a real Bilibili downloader, but it auto-downloads an executable dependency and includes shell-based command execution that users should review before installing.
Install only if you are comfortable with an npm postinstall step downloading BBDown from GitHub. Prefer verifying or manually installing BBDown yourself, avoid passing cookie files unless needed, and remember that download history is stored locally under ~/.bilibit.
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/check-deps.js:17
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/install-bbdown.js:18
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/downloader/bbdown.js:57