high
Electron 27.3.11 no longer receives security fixes
16 major versions behind the oldest supported line (as of 2026-10-22, Electron 43–45 are supported). Its bundled Chromium misses every fix since.
Gallery · App X-Ray
WebTorrent Desktop 0.24.0
- 3 high
- 0 medium
- 1 low
- 1 info
Findings
high
nodeIntegration: true
3 windows set nodeIntegration to true, so web content can call Node.js APIs directly.
src/main/windows/webtorrent.js:14 · src/main/windows/about.js:14 · src/main/windows/main.js:31
high
contextIsolation: false
3 windows set contextIsolation to false, so page scripts share a JavaScript world with the preload script.
src/main/windows/webtorrent.js:14 · src/main/windows/about.js:14 · src/main/windows/main.js:31
low
IPC handlers do not check the sender
29 main-process handlers, and no check of event.senderFrame or event.sender was found. Any page that can send IPC, including an injected one, is trusted.
info
IPC channel names chosen at runtime
4 IPC calls take the channel name from a variable. When a preload script forwards a channel chosen by the page, the page can reach every handler; worth reviewing.
Network addresses
No literal network addresses found.
Modules
| Module | Used by |
|---|---|
| ./about | src/main/windows/index.js |
| ./build/main | index.js |
| ./main | src/main/windows/index.js |
| ./webtorrent | src/main/windows/index.js |
| @electron/remote | src/config.js, src/renderer/components/path-selector.js, src/renderer/controllers/subtitles-controller.js, src/renderer/controllers/torrent-list-controller.js, src/renderer/lib/telemetry.js |
| @electron/remote/main | src/main/index.js, src/main/windows/about.js, src/main/windows/main.js, src/main/windows/webtorrent.js |
| airplayer | src/renderer/lib/cast.js |
| application-config | src/config.js, src/renderer/lib/state.js |
| arch | src/config.js |
| auto-launch | src/main/startup.js |
| bitfield | src/renderer/pages/player-page.js |
| capture-frame | src/renderer/lib/torrent-poster.js |
| child_process | src/main/external-player.js, src/main/squirrel-win32.js, src/main/tray.js |
| chokidar | src/main/folder-watcher.js |
| chromecasts | src/renderer/lib/cast.js |
| create-torrent | src/renderer/lib/state.js, src/renderer/pages/create-torrent-page.js |
| crypto | src/renderer/lib/telemetry.js, src/renderer/webtorrent.js |
| debounce | src/main/windows/main.js, src/renderer/lib/state.js, src/renderer/main.js |
| dlnacasts | src/renderer/lib/cast.js |
| drag-drop | src/renderer/main.js |
| electron | src/config.js, src/crash-reporter.js, src/main/announcement.js, src/main/dialog.js, src/main/dock.js, src/main/handlers.js, src/main/index.js, src/main/ipc.js, src/main/log.js, src/main/menu.js, src/main/power-save-blocker.js, src/main/shell.js, src/main/shortcuts.js, src/main/squirrel-win32.js, src/main/tray.js, src/main/updater.js, src/main/user-tasks.js, src/main/windows/about.js, src/main/windows/main.js, src/main/windows/webtorrent.js, src/renderer/components/open-torrent-address-modal.js, src/renderer/components/unsupported-media-modal.js, src/renderer/components/update-available-modal.js, src/renderer/controllers/folder-watcher-controller.js, src/renderer/controllers/media-controller.js, src/renderer/controllers/playback-controller.js, src/renderer/controllers/prefs-controller.js, src/renderer/controllers/torrent-controller.js, src/renderer/controllers/torrent-list-controller.js, src/renderer/lib/migrations.js, src/renderer/main.js, src/renderer/webtorrent.js |
| es6-error | src/renderer/lib/errors.js |
| events | src/renderer/lib/state.js |
| fn-getter | src/renderer/main.js, src/renderer/pages/app.js |
| fs | src/config.js, src/renderer/controllers/subtitles-controller.js, src/renderer/controllers/torrent-list-controller.js, src/renderer/lib/migrations.js, src/renderer/lib/state.js, src/renderer/main.js, src/renderer/webtorrent.js |
| http | src/renderer/lib/cast.js |
| iso-639-1 | src/renderer/controllers/subtitles-controller.js |
| languagedetect | src/renderer/controllers/subtitles-controller.js |
| location-history | src/renderer/lib/state.js |
| material-ui/Checkbox | src/renderer/pages/create-torrent-page.js, src/renderer/pages/preferences-page.js, src/renderer/pages/torrent-list-page.js |
| material-ui/FlatButton | src/renderer/components/modal-ok-cancel.js, src/renderer/pages/create-torrent-page.js |
| material-ui/LinearProgress | src/renderer/pages/torrent-list-page.js |
| material-ui/RaisedButton | src/renderer/components/modal-ok-cancel.js, src/renderer/components/path-selector.js, src/renderer/components/show-more.js, src/renderer/pages/create-torrent-page.js, src/renderer/pages/preferences-page.js |
| material-ui/styles/baseThemes/darkBaseTheme | src/renderer/pages/app.js |
| material-ui/styles/baseThemes/lightBaseTheme | src/renderer/pages/app.js |
| material-ui/styles/colors | src/renderer/components/heading.js, src/renderer/components/path-selector.js, src/renderer/pages/app.js, src/renderer/pages/preferences-page.js |
| material-ui/styles/getMuiTheme | src/renderer/pages/app.js |
| material-ui/styles/MuiThemeProvider | src/renderer/pages/app.js |
| material-ui/TextField | src/renderer/components/open-torrent-address-modal.js, src/renderer/components/path-selector.js, src/renderer/pages/create-torrent-page.js, src/renderer/pages/preferences-page.js |
| module | src/renderer/main.js |
| music-metadata | src/renderer/webtorrent.js |
| network-address | src/renderer/webtorrent.js |
| os | src/renderer/lib/telemetry.js |
| parse-torrent | src/renderer/lib/state.js |
| path | src/config.js, src/main/external-player.js, src/main/handlers.js, src/main/index.js, src/main/squirrel-win32.js, src/main/thumbar.js, src/renderer/components/path-selector.js, src/renderer/controllers/playback-controller.js, src/renderer/controllers/subtitles-controller.js, src/renderer/controllers/torrent-controller.js, src/renderer/controllers/torrent-list-controller.js, src/renderer/lib/migrations.js, src/renderer/lib/sound.js, src/renderer/lib/state.js, src/renderer/lib/torrent-player.js, src/renderer/lib/torrent-poster.js, src/renderer/lib/torrent-summary.js, src/renderer/pages/create-torrent-page.js, src/renderer/webtorrent.js |
| prettier-bytes | src/renderer/pages/create-torrent-page.js, src/renderer/pages/player-page.js, src/renderer/pages/torrent-list-page.js |
| prop-types | src/renderer/components/heading.js, src/renderer/components/path-selector.js, src/renderer/components/show-more.js, src/renderer/pages/preferences-page.js |
| react | src/renderer/components/create-torrent-error-page.js, src/renderer/components/delete-all-torrents-modal.js, src/renderer/components/header.js, src/renderer/components/heading.js, src/renderer/components/modal-ok-cancel.js, src/renderer/components/open-torrent-address-modal.js, src/renderer/components/path-selector.js, src/renderer/components/remove-torrent-modal.js, src/renderer/components/show-more.js, src/renderer/components/unsupported-media-modal.js, src/renderer/components/update-available-modal.js, src/renderer/main.js, src/renderer/pages/app.js, src/renderer/pages/create-torrent-page.js, src/renderer/pages/player-page.js, src/renderer/pages/preferences-page.js, src/renderer/pages/torrent-list-page.js |
| react-dom | src/renderer/main.js |
| rimraf | src/renderer/lib/migrations.js |
| run-parallel | src/main/index.js, src/renderer/controllers/subtitles-controller.js |
| semver | src/renderer/lib/migrations.js |
| simple-concat | src/renderer/controllers/subtitles-controller.js |
| simple-get | src/main/announcement.js, src/main/updater.js, src/renderer/lib/telemetry.js |
| srt-to-vtt | src/renderer/controllers/subtitles-controller.js |
| util | src/renderer/webtorrent.js |
| vlc-command | src/main/external-player.js |
| webtorrent | src/renderer/webtorrent.js |
| webtorrent/package.json | src/main/index.js |
| winreg | src/main/handlers.js |
Windows and IPC
| Window | webPreferences |
|---|---|
| src/main/windows/webtorrent.js:14 | backgroundThrottling=false, contextIsolation=false, enableBlinkFeatures=AudioVideoTracks, enableRemoteModule=true, nodeIntegration=true |
| src/main/windows/about.js:14 | backgroundThrottling=false, contextIsolation=false, enableBlinkFeatures=AudioVideoTracks, enableRemoteModule=true, nodeIntegration=true |
| src/main/windows/main.js:31 | backgroundThrottling=false, contextIsolation=false, enableBlinkFeatures=AudioVideoTracks, enableRemoteModule=true, nodeIntegration=true |
Remote pages, data and packaging
No remote pages are loaded into app windows.
No on-device storage calls found.
No packaged executable was found, so Electron fuses were not read.
README badge
Maintainers can show this report in their README:
[](https://Eliot5566.github.io/app-xray/apps/webtorrent-desktop/)
What this report cannot see
- Source checkout: 104 test, story, build-tool and minified/generated files were left out. Rerun with --all-files to include them.
- CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.
- Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.
- Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.
- Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.
- Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.
- JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.
- Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.
- Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.
- Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.
- static/about.html has 4 inline JavaScript bodies starting at lines 33, 34, 35, 37 that were not analyzed; endpoints, storage, imports and other facts in them are absent from the evidence.
- static/main.html has 1 inline JavaScript body starting at line 11 that was not analyzed; endpoints, storage, imports and other facts in it are absent from the evidence.
- static/webtorrent.html has 1 inline JavaScript body starting at line 18 that was not analyzed; endpoints, storage, imports and other facts in it are absent from the evidence.