{"id":"hdtilt.com/hdtilt","name":"hdtilt","commands":["hdtilt"],"examples":[{"run":"hdtilt add <name> <m3u-url>","does":"Add an M3U playlist from a provider you already have"},{"run":"hdtilt now","does":"Show what is on right now"},{"run":"hdtilt tui","does":"Browse and play channels in the terminal (needs mpv or VLC)"},{"run":"hdtilt serve","does":"Run the web app on http://127.0.0.1:8930"},{"run":"hdtilt mcp","does":"Serve the MCP tools over stdio for an agent (also POST /mcp on any server)"}],"description":"Open source TiviMate-style IPTV player for M3U, Xtream Codes and XMLTV: web/PWA, desktop app (AppImage, deb, dmg, exe), CLI, TUI, MCP and a JSON API.","homepage":"https://hdtilt.com","repository":"https://github.com/profullstack/hdtilt.com","license":"MIT","agentic":false,"latest_version":"0.4.2","vendor":"Profullstack","install":"curl -fsSL https://hdtilt.com/install.sh | sh","publisher":"profullstack","w3bs":"w3bs install hdtilt.com/hdtilt","scan":{"status":"flagged","scanner":"threatcrush 0.13.30","filesScanned":59,"summary":{"critical":0,"high":0,"medium":21,"low":24,"info":0},"malware":4,"truncated":false,"version":"0.4.2","sources":{"installer":"https://hdtilt.com/install.sh","installerSha256":"a76dbff95e4ffdc922a2a76f180d121dd86b98e8e0b9d660121339cd43f72706","repository":"github.com/profullstack/hdtilt.com","commit":"da6c5a936101107f35e2d83c8a3fdbbdc8d8ea1e"},"notes":[],"scannedAt":"2026-11-02T22:58:46.937Z","findings":[{"ruleId":"js-indirect-code-sink","title":"code sink reached indirectly","severity":"medium","category":"code","cwe":"CWE-506","file":"source/src/server/vault.js","line":32,"malware":true},{"ruleId":"js-indirect-code-sink","title":"code sink reached indirectly","severity":"medium","category":"code","cwe":"CWE-506","file":"source/src/server/vault.js","line":33,"malware":true},{"ruleId":"js-indirect-code-sink","title":"code sink reached indirectly","severity":"medium","category":"code","cwe":"CWE-506","file":"source/src/server/vault.js","line":36,"malware":true},{"ruleId":"js-indirect-code-sink","title":"code sink reached indirectly","severity":"medium","category":"code","cwe":"CWE-506","file":"source/src/server/vault.js","line":37,"malware":true},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/src/server/accounts.js","line":120,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":22,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":547,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":592,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":615,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":666,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":669,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":672,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":676,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":678,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":1139,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":1273,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":1443,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":1533,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":1840,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":1928,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/web/src/app.js","line":1944,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":38,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":49,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":60,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":69,"malware":false},{"ruleId":"secret-jwt","title":"JSON Web Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":102,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":102,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":111,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":122,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":132,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":135,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":141,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":142,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":235,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":237,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":269,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":319,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":363,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":379,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/accounts.test.js","line":405,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/cli-sync.test.js","line":61,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/coinpay.test.js","line":91,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/coinpay.test.js","line":136,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/coinpay.test.js","line":142,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/coinpay.test.js","line":176,"malware":false}]}}