Cmdautolink
লিংক দিলেই অটো ভিডিও ডাউনলোড (YouTube, Facebook, TikTok, Instagram ও আরও অনেক)
Spawns operating-system processes through child_process. A command running shell code can read or change anything the bot's account can.
const { execFile } = require("child_process");Calls fs.rm / unlink / rmdir. Check what path it deletes and whether a user can influence it.
fs.remove(filepath).catch(() => {});if (silent) fs.remove(silent.filepath).catch(() => {});if (!silent) silent = f; else fs.remove(f.filepath).catch(() => {});fs.remove(filepath).catch(() => {});if (!silent) silent = r; else fs.remove(r.filepath).catch(() => {});Runs npm/yarn/pip install while the bot is running. Whatever gets installed is not reviewed here.
lines.push(getYtdl() ? "✅ ytdl-core (YouTube)" : "⚠️ ytdl-core নেই (YouTube এর জন্য: npm i @distube/ytdl-core)");require() is called with a value computed at runtime, so the loaded module cannot be known from reading the file.
try { return (_ytdl = require(name)); } catch (_) {}Reads or writes files on the machine running the bot.
const fs = require("fs-extra");Talks to a raw IP address instead of a named host — harder to audit and easy to redirect.
"Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36",Reads process.env. Fine on its own; worth a look if the values are sent anywhere.
const YTDLP = process.env.YTDLP_PATH || "yt-dlp";Makes HTTP/WebSocket requests. Check where the data goes.
const axios = require("axios");@ffmpeg-installer/ffmpeg, axios, ffmpeg-static, fs-extra
Loading source…