happynewyear

• Analyzed: May 10, 2026, 6:44 AM
• Findings: 1
• Version: 1.0.2
• Hash: 5d199c749f432fd1781ebbe59d00f97d36ab11a88abb066c0015005ba887a7ea
• Source: palm
• External report: View on VirusTotal

Findings (1)

The script scripts/happynewyear.py contains several high-risk security practices, including hardcoded API keys for Volcengine and ByteDance services and the explicit disabling of SSL certificate verification (ssl.CERT_NONE), which creates a Man-in-the-Middle (MITM) vulnerability. It also implements an aggressive auto-dependency installer using subprocess to run 'pip install'. While these behaviors appear aligned with the stated goal of generating AI-powered New Year videos, the combination of credential exposure and weakened network security constitutes a significant set of vulnerabilities.