video-streaming-expert

No clear malware or intentional supply-chain attack is present. The principal risks are unauthenticated FFmpeg resource consumption, path traversal through filename and videoId, inadequate byte-range validation, permissive CORS, and potential exposure of DRM credentials if placeholders are replaced with real tokens. Validate identifiers and ranges, enforce directory containment, authenticate and authorize endpoints, limit transcoding concurrency, and avoid embedding secrets in client code.