registry / @jiabaida/tools / 1.1.14

@jiabaida/tools@1.1.14

```bash npm login # 按提示输入 npm 账号密码 ```

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package provides user-invoked BLE/TCP/MQTT device-management functions; networking occurs only when callers invoke connection methods.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invokes device connection, MQTT, TCP, or OTA APIs.

Impact

Can communicate with configured Jiabaida device services and connected devices as part of its stated runtime role; no unconsented host mutation or credential exfiltration chain was found.

Mechanism

Device provisioning, MQTT command relay, and BLE/TCP battery-management protocol handling.

Rationale

Static inspection shows a device-management library with explicit runtime networking and firmware handling, not install-time or stealth behavior. The embedded key and credential logging are security-quality concerns, but do not establish malicious intent or a concrete exfiltration chain.

Evidence

package.jsonsrc/index.jssrc/core/mqttServer.jssrc/core/tcpServer.jssrc/core/OtaUpgrade.jssrc/core/rsaEncrypt.jssrc/core/Transfer.js

Network endpoints3

wxs://mqtt.jiabaida.com/mqttcloud.jiabaida.com/bluetooth/server/device/networkModelcloud.jiabaida.com:10241

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with medium false-positive risk.

Evidence for block

`src/core/mqttServer.js` decrypts provisioning credentials and opens an MQTT connection only in `connectMqtt(deviceObj)`.
`src/core/mqttServer.js` accepts platform MQTT commands and forwards them to the connected device protocol.
`src/core/rsaEncrypt.js` embeds an RSA private key, explaining the scanner's possible-secret signal.

Evidence against

`package.json` has only `prepublishOnly`; no install-time lifecycle hook or executable entrypoint.
`src/index.js` only re-exports modules; import-time construction does not connect or issue requests.
MQTT and HTTP endpoints are Jiabaida device-service endpoints and are invoked through explicit runtime methods.
No source use of shell execution, eval/vm, environment harvesting, Node filesystem writes, agent configuration, or exfiltration primitives was found.
OTA file access in `src/core/OtaUpgrade.js` reads user-selected firmware for device upgrade.

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 68 file(s), 906 KB of source, external domains: cloud.jiabaida.com

Source & flagged code

3 flagged

dist/esm/core/mqttServer.jsView file

Lines 1-2javascript

1import SHA256 from"crypto-js/sha256";import mqtt from"mqtt/dist/mqtt.min.js";import{set_PlanCMD_DD}from"./BleCmdAnalysis/BleCmdDD.js";import{getFFAA80Async,resolveFFAA80,set_PlanCMD_FFAA}from"./BleCmdAnalysis/BleCmdFFAA.js";import{getCMDESInfoAsync}from"./BleCmdAnalysis/BleCmdHVES.js";import{sleep}from"./BleDataProcess.js";import{decrypt}from"./rsaEncrypt.js";import{Transfer}from"./Transfer.js";class MqttServer{constructor(options={}){const{mqttClient:mqttClient={},MQTT_HOST:MQTT_HOST="wxs://mqtt.jiabaida.com/mqtt",DELAY_TIME:DELAY_TIME=300,networkModelUrl:networkModelUrl="https://cloud.jiabai ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm/core/mqttServer.jsView on unpkg · L1

Long lines were clipped for display.

dist/cjs/core/mqttServer.jsView file

Lines 1-2javascript

1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var SHA256=require("crypto-js/sha256"),mqtt=require("mqtt/dist/mqtt.min.js"),BleCmdDD=require("./BleCmdAnalysis/BleCmdDD.js"),BleCmdFFAA=require("./BleCmdAnalysis/BleCmdFFAA.js"),BleCmdHVES=require("./BleCmdAnalysis/BleCmdHVES.js"

src/core/mqttServer.jsView file

Lines 76-116javascript

76 });

77 } catch (error) {

78 console.error('getnetworkModel-error', error);

79 throw error;

80 }

81 }

83 // 封装 MQTT 连接逻辑

84 async connectMqtt(deviceObj) {

85 try

Source & flagged code

3 flagged · loading source

dist/esm/core/mqttServer.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = import S...er};

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm/core/mqttServer.jsView on unpkg · L1

dist/cjs/core/mqttServer.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = "use str...ver;

Medium

Secret Pattern

Hardcoded password in dist/cjs/core/mqttServer.js

dist/cjs/core/mqttServer.jsView on unpkg · L1

src/core/mqttServer.jsView file

96patternName = generic_password severity = medium line = 96 matchedText = console....ord)

Medium

Secret Pattern

Hardcoded password in src/core/mqttServer.js

src/core/mqttServer.jsView on unpkg · L96

Findings

3 Medium5 Low

MediumSecret Patterndist/esm/core/mqttServer.js

MediumSecret Patterndist/cjs/core/mqttServer.js

MediumSecret Patternsrc/core/mqttServer.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/esm/core/mqttServer.jsView file

Lines 1-2javascript

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm/core/mqttServer.jsView on unpkg · L1

Long lines were clipped for display.

dist/cjs/core/mqttServer.jsView file

Lines 1-2javascript

src/core/mqttServer.jsView file

Lines 76-116javascript

76 });

77 } catch (error) {

78 console.error('getnetworkModel-error', error);

79 throw error;

80 }

81 }

83 // 封装 MQTT 连接逻辑

84 async connectMqtt(deviceObj) {

85 try