registry / @larksuite/channel / 0.4.0

@larksuite/channel@0.4.0

Channel SDK — let agents and external services integrate with the Feishu/Lark messaging system: reliable inbound events, message normalization, streaming replies, media upload, card interactions.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 291 KB of source

Source & flagged code

1 flagged

dist/index.cjsView file

Lines 7-47javascript

7var __getProtoOf = Object.getPrototypeOf;

8var __hasOwnProp = Object.prototype.hasOwnProperty;

9var __copyProps = (to, from, except, desc) => {

10 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

11 key = keys[i];

12 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

13 get: ((k) => from[k]).bind(null, key),

14 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

15 });

16 }

17 return to;

18};

19var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {

20 value: mod,

21 enumerable: true

22}) : target, mod));

23//#endregion

24let node_fs = require("node:fs");

25let node_fs_promises = require("node:fs/promises");

26let node_stream_promises = require("node:stream/promises");

27let _larksuiteoapi_node_sdk = require("@larksuiteoapi/node-sdk");

28let https_proxy_agent = require("https-proxy-agent");

29let fs = require("fs");

30fs = __toESM(fs, 1);

31let http = require("http");

32http = __toESM(http, 1);

33let https = require("https");

34https = __toESM(https, 1);

35let path = require("path");

36path = __toESM(path, 1);

37let dns = require("dns");

38let net = require("net");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.cjsView on unpkg · L27

39//#region src/chat-member-cache.ts

40/**

41* Per-chat roster cache backing these consumers: `getChatMembers` (source

42* 'api', authoritative users), `getChatBots` (source 'api', authoritative

43* bots), inbound mention collection (source 'mention', can carry bots),

44* `senderName` resolution and "@name → open_id" normalization.

45*

46* Two safety invariants:

47* - A display name that maps to more than one openId is AMBIGUOUS and

Source & flagged code

1 flagged · loading source

dist/index.cjsView file

27let _larksuiteoapi_node_sdk = require("@larksuiteoapi/node-sdk"); L28: let https_proxy_agent = require("https-proxy-agent"); L29: let fs = require("fs"); ... L36: path = __toESM(path, 1); L37: let dns = require("dns"); L38: let net = require("net"); ... L303: url, L304: data: { content: { elements: [{ L305: type: "text_run", ... L574: try { L575: return JSON.parse(raw); L576: } catch {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.cjsView on unpkg · L27

Findings

1 High3 Medium3 Low

HighCloud Metadata Accessdist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/index.cjsView file

Lines 7-47javascript

7var __getProtoOf = Object.getPrototypeOf;

8var __hasOwnProp = Object.prototype.hasOwnProperty;

9var __copyProps = (to, from, except, desc) => {

10 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

11 key = keys[i];

12 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

13 get: ((k) => from[k]).bind(null, key),

14 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

15 });

16 }

17 return to;

18};

19var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {

20 value: mod,

21 enumerable: true

22}) : target, mod));

23//#endregion

24let node_fs = require("node:fs");

25let node_fs_promises = require("node:fs/promises");

26let node_stream_promises = require("node:stream/promises");

27let _larksuiteoapi_node_sdk = require("@larksuiteoapi/node-sdk");

28let https_proxy_agent = require("https-proxy-agent");

29let fs = require("fs");

30fs = __toESM(fs, 1);

31let http = require("http");

32http = __toESM(http, 1);

33let https = require("https");

34https = __toESM(https, 1);

35let path = require("path");

36path = __toESM(path, 1);

37let dns = require("dns");

38let net = require("net");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.cjsView on unpkg · L27

39//#region src/chat-member-cache.ts

40/**

41* Per-chat roster cache backing these consumers: `getChatMembers` (source

42* 'api', authoritative users), `getChatBots` (source 'api', authoritative

43* bots), inbound mention collection (source 'mention', can carry bots),

44* `senderName` resolution and "@name → open_id" normalization.

45*

46* Two safety invariants:

47* - A display name that maps to more than one openId is AMBIGUOUS and