youtube-digest

This is a YouTube transcript retrieval and export utility, with no clear evidence of intentional malware. It sends the configured API key and requested video URL to redfox[.]hk, and may send transcript text to Google's translation service. Unvalidated API-provided subtitle URLs pose potential SSRF risk, and an unsanitized video_id may enable path traversal in output filenames; exported Excel content may also be interpreted as formulas. Overall severity is moderate and depends on whether API responses are trusted.