registry / @linjz/opencode-qqbot / 0.3.14
@linjz/opencode-qqbot@0.3.14
QQ Bot for OpenCode AI - chat with AI coding assistant via QQ
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe reviewed credential flow sends configured QQ bot credentials to QQ's official token endpoint, while OpenCode discovery authenticates only to loopback services. The setup command obtains credentials after an explicit QR scan, and the package's process execution supports runtime selection and local service discovery.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The plugin or openqq command is run; credential setup requires the user to run openqq-setup and scan a QR code.
Impact
The reviewed behavior supports the package's stated purpose; no unrelated credential transfer or harmful automatic action was found.
Mechanism
The bot exchanges configured QQ credentials with QQ's official API and probes local OpenCode services using a locally configured password.
AI rationale
The reviewed credential flow sends configured QQ bot credentials to QQ's official token endpoint, while OpenCode discovery authenticates only to loopback services. The setup command obtains credentials after an explicit QR scan, and the package's process execution supports runtime selection and local service discovery.
Evidence
~/.openqq/.env
Network endpoints4
bots.qq.com/app/getAppAccessTokenapi.sgroup.qq.comsandbox.api.sgroup.qq.com127.0.0.1:<port>/api/info
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a QQ bot for chatting with the OpenCode coding assistant and exports a plugin entry point.
- The bot sends its configured QQ app ID and secret to QQ's official access-token endpoint.
- OpenCode discovery probes only 127.0.0.1 and uses the configured OpenCode password for local authentication.
- The setup command obtains QQ credentials after a user scans a QR code and saves them in the user's ~/.openqq/.env file.
Evidence against
- The launcher and discovery code use child processes, but they probe for Bun or enumerate local listening ports to support the bot's operation.
- The package has a prepublishOnly build script; it is not an install-time lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedbin/openqq.jsView file
6// 注意：本文件必须保持纯 JS（无类型标注）——node 用户直接执行它。
L7: import { spawnSync } from "node:child_process"
L8: import { existsSync } from "node:fs"
High
6Cross-file remote execution chain: bin/openqq.js spawns dist/openqq-bot.js; helper contains network access plus dynamic code execution.
L6: // 注意：本文件必须保持纯 JS（无类型标注）——node 用户直接执行它。
L7: import { spawnSync } from "node:child_process"
L8: import { existsSync } from "node:fs"
...
L17: const candidates = ["bun", "bun.exe", "bun.cmd", "bun.bat"]
L18: if (process.platform === "win32") {
L19: const appdata = process.env.APPDATA || join(process.env.USERPROFILE || "", "AppData", "Roaming")
L20: candidates.push(join(appdata, "npm", "node_modules", "bun", "bin", "bun.exe"))
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/openqq.jsView on unpkg · L6dist/openqq-bot.jsView file
Findings
2 Critical9 High2 Medium5 Low
CriticalCredential Exfiltrationdist/openqq-bot.js
CriticalPrevious Version Dangerous Deltadist/opencode-qqbot-plugin.js
HighChild Processbin/openqq.js
HighShelldist/openqq-bot.js
HighCross File Remote Execution Contextbin/openqq.js
HighKnown Malware Source Similaritydist/opencode-qqbot-plugin.js
HighKnown Malware Source Similaritydist/openqq-bot.js
HighKnown Malware Source Similaritysrc/core/bot-launcher.ts
HighKnown Malware Source Similaritysrc/core/discovery.ts
HighKnown Malware Source Similaritybin/openqq-setup.mjs
HighKnown Malware Source Similaritysrc/core/send-media.ts
Affected versions and remediation
This report applies to @linjz/opencode-qqbot@0.3.14.
See all versions of @linjz/opencode-qqbot for other recorded verdicts.
- Review the evidence and your use of @linjz/opencode-qqbot@0.3.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.