hdtilt.com/hdtilt · Packages

PACKAGES / Profullstack

hdtilt

Open source TiviMate-style IPTV player for M3U, Xtream Codes and XMLTV: web/PWA, desktop app (AppImage, deb, dmg, exe), CLI, TUI, MCP and a JSON API.

ThreatCrush · Malware flagged

INSTALLw3bs install hdtilt.com/hdtilt

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

w3bs install hdtilt.com/hdtiltInstall hdtilt and track it for updates
hdtilt add <name> <m3u-url>Add an M3U playlist from a provider you already have
hdtilt nowShow what is on right now
hdtilt tuiBrowse and play channels in the terminal (needs mpv or VLC)
hdtilt serveRun the web app on http://127.0.0.1:8930
hdtilt mcpServe the MCP tools over stdio for an agent (also POST /mcp on any server)

Every option: hdtilt --help · docs ↗

Malware scan

ThreatCrush found code shaped like malware: a hidden payload executed at runtime or secrets sent off the machine. Read the findings before installing. W3BS reviews flagged packages and delists confirmed ones.

Scanned: 2026-11-02 22:58 UTC · threatcrush 0.13.30
Files: 59 (installer + github.com/profullstack/hdtilt.com@da6c5a936101)
Findings: 21 medium · 24 low · 4 malware indicators

Malware indicator
code sink reached indirectlysource/src/server/vault.js:32js-indirect-code-sink · CWE-506
Malware indicator
code sink reached indirectlysource/src/server/vault.js:33js-indirect-code-sink · CWE-506
Malware indicator
code sink reached indirectlysource/src/server/vault.js:36js-indirect-code-sink · CWE-506
Malware indicator
code sink reached indirectlysource/src/server/vault.js:37js-indirect-code-sink · CWE-506

41 other findings (not malware)

medium
SQL built from a template literal or f-stringsource/src/server/accounts.js:120sql-template-interpolation · CWE-89
medium
unescaped HTML renderingsource/web/src/app.js:22js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:547js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:592js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:615js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:666js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:669js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:672js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:676js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:678js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:1139js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:1273js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:1443js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:1533js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:1840js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:1928js-unescaped-html-sink · CWE-79
medium
unescaped HTML renderingsource/web/src/app.js:1944js-unescaped-html-sink · CWE-79
low
Hardcoded Credentialsource/test/accounts.test.js:38secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:49secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:60secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:69secret-generic-credential · CWE-798
low
JSON Web Tokensource/test/accounts.test.js:102secret-jwt · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:102secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:111secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:122secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:132secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:135secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:141secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:142secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:235secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:237secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:269secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:319secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:363secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:379secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/accounts.test.js:405secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/cli-sync.test.js:61secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/coinpay.test.js:91secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/coinpay.test.js:136secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/coinpay.test.js:142secret-generic-credential · CWE-798
low
Hardcoded Credentialsource/test/coinpay.test.js:176secret-generic-credential · CWE-798

Badge for your README

[![ThreatCrush scan](https://w3bs.org/api/packages/hdtilt.com/hdtilt/badge.svg)](https://w3bs.org/packages/hdtilt.com/hdtilt)