
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Quasarr connects JDownloader with Radarr, Sonarr and LazyLibrarian. It also decrypts links protected by CAPTCHAs.
Quasarr connects JDownloader with Radarr, Sonarr and LazyLibrarian. It also decrypts links protected by CAPTCHAs.
Quasarr pretends to be both Newznab Indexer
and SABnzbd client
. Therefore, do not try to use it with real usenet
indexers or download clients. It simply does not know what NZB or torrent files are.
Quasarr includes a solution to quickly and easily decrypt protected links. Active Sponsors get access to SponsorsHelper to do so automatically. Alternatively, follow the link from the console output (or discord notification) to solve CAPTCHAs manually. Quasarr will confidently handle the rest.
Tell Quasarr which sites to search for releases. It requires at least one valid source to start up.
- By default, Quasarr does not know which sites to scrape for download links.
- The setup will guide you through the process of providing valid hostnames for Quasarr to scrape.
- Do not ask for help here if you do not know which hostnames to use. Picking them is solely your responsibility.
- You may check sites like Pastebin for user‑submitted suggestions.
- Consider setting up a fresh JDownloader before you begin.
- JDownloader must be running and available to Quasarr.
- Quasarr will modify JDownloader’s settings so downloads can be handled by Radarr/Sonarr/LazyLibrarian.
- If using Docker, ensure that JDownloader’s download path is available to Radarr/Sonarr/LazyLibrarian with exactly the same internal and external path mapping (matching only the external path is not enough).
Set up Quasarr as a Newznab Indexer and SABnzbd Download Client:
URL
from the API Information section of the console output (or copy it from the Quasarr web UI).API Key
from the API Information section of the console output (or copy it from the Quasarr web UI).Important notice for Sonarr
- Ensure all shows (including anime) are set to the Standard series type.
- Quasarr will never find releases for shows set to Anime / Absolute.
Important notice
- This feature is experimental and may not work as expected.
- Quasarr cannot help you with metadata issues, missing covers, or other LazyLibrarian problems.
- Please report issues when one of your hostnames yields results through their website, but not in LazyLibrarian.
Set up Quasarr as a SABnzbd+ Downloader
URL
found in the API Information section of the console output (or copy it from the Quasarr web UI).API Key
from the API Information section of the console output (or copy it from the Quasarr web UI).docs
to ensure LazyLibrarian does not interfere with Radarr/Sonarr.Test SABnzbd
to verify the connection, then Save changes
.Set up Quasarr as a Newznab Provider:
URL
from the API Information section of the console output (or copy it from the Quasarr web UI).API Key
from the API Information section of the console output (or copy it from the Quasarr web UI).Test
to verify the connection, then Save changes
.Fix the Importing
settings:
Enable OpenLibrary api for book/author information
OpenLibrary
below Primary Information Source
Import languages
add , Unknown
(and for German users: , de, ger, de-DE
).Fix the Processing
settings:
Folders
add the full Quasarr download path, typically /downloads/Quasarr/
To restrict results to a specific mirror, add the mirror name to the Newznab/indexer URL.
Example: Appending
/api/dropbox/
will only return releases wheredropbox
is explicitly mentioned in a link.
Caution: If a mirror is not available at a hostname, the release will be ignored or the download will fail. Use this option carefully.
To see download status information in Radarr/Sonarr
Activity
→ Queue
→ Options
Release Title
It is highly recommended to run the latest docker image with all optional variables set.
docker run -d \
--name="Quasarr" \
-p port:8080 \
-v /path/to/config/:/config:rw \
-e 'INTERNAL_ADDRESS'='http://192.168.0.1:8080' \
-e 'EXTERNAL_ADDRESS'='https://foo.bar/' \
-e 'DISCORD'='https://discord.com/api/webhooks/1234567890/ABCDEFGHIJKLMN' \
-e 'HOSTNAMES'='https://pastebin.com/raw/eX4Mpl3'
-e 'SILENT'='True' \
-e 'DEBUG'='' \
ghcr.io/rix1337/quasarr:latest
INTERNAL_ADDRESS
is required so Radarr/Sonarr/LazyLibrarian can reach Quasarr. Must include port!EXTERNAL_ADDRESS
is optional and helpful if using a reverse proxy. Always protect external access with basic auth!DISCORD
is optional and must be a valid Discord webhook URL.HOSTNAMES
is optional and allows skipping the manual hostname step during setup.
HTTP
or HTTPs
link.ini
/ text file (not HTML or JSON)ab = xyz
SILENT
is optional and silences all discord notifications except for error messages from SponsorsHelper if True
.DEBUG
is optional and enables debug logging if True
.Use this only in case you can't run the docker image.
pip install quasarr
--port=8080
--discord=https://discord.com/api/webhooks/1234567890/ABCDEFGHIJKLMN
--external_address=https://foo.bar/
--hostnames=https://pastebin.com/raw/eX4Mpl3
--discord
see DISCORD
docker variable--external_address
see EXTERNAL_ADDRESS
docker variable--hostnames
see HOSTNAMES
docker variableComplexity is the killer of small projects like this one. It must be fought at all cost!
We will not waste precious time on features that will slow future development cycles down. Most feature requests can be satisfied by:
The SponsorsHelper is a Docker image that automatically solves CAPTCHAs and decrypts links for Quasarr.
The process strictly requires an account token with credit at DeathByCaptcha.
The image is only available to active sponsors (hence the name).
Access is automatically granted via GitHub:
New personal access token (classic)
.SponsorsHelper
.GITHUB_TOKEN
below:docker login https://ghcr.io -u USERNAME -p GITHUB_TOKEN
USERNAME
is your GitHub username.
GITHUB_TOKEN
is the token you created above.
Without logging in, it is not possible to download the image!
docker run -d \
--name='SponsorsHelper' \
-e 'QUASARR_URL'='http://192.168.0.1:8080' \
-e 'DEATHBYCAPTCHA_TOKEN'='2FMum5zuDBxMmbXDIsADnllEFl73bomydIpzo7...' \
'ghcr.io/rix1337-sponsors/docker/helper:latest'
-e 'QUASARR_URL'
The local URL of Quasarr - e.g., http://192.168.0.1:8080
(should match the INTERNAL_ADDRESS
parameter from above)-e 'DEATHBYCAPTCHA_TOKEN'
The account token
from DeathByCaptcha - e.g.,
2FMum5zuDBxMmbXDIsADnllEFl73bomydIpzo7...aBc
To test your changes before submitting a pull request:
Run Quasarr with the --internal_address
parameter:
python Quasarr.py --internal_address=http://<host-ip>:<port>
Replace <host-ip>
and <port>
with the scheme, IP, and port of your host machine.
The --internal_address
parameter is mandatory.
Start the required services using the dev-services-compose.yml
file:
CONFIG_VOLUMES=/path/to/config docker-compose -f docker/dev-services-compose.yml up
Replace /path/to/config
with your desired configuration location.
The CONFIG_VOLUMES
environment variable is mandatory.
FAQs
Quasarr connects JDownloader with Radarr, Sonarr and LazyLibrarian. It also decrypts links protected by CAPTCHAs.
We found that quasarr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.