registry / Credential exfiltration / @luoyi-dsh/discord-plugin
@luoyi-dsh/discord-plugin
DeepSeek Harness (DSH) Discord 用戶帳號 (Selfbot) 助理與 MCP 插件：支援自然穿插閒聊、被提及與私訊智慧代回、傳送文字、圖片、文件與貼圖
This report shows the evidence for @luoyi-dsh/discord-plugin@1.0.2. 1 of 2 known versions is blocked or flagged. The newest version, 1.0.4, is allowed. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe default provider configuration can send OPENAI_API_KEY to api.deepseek.com during ordinary message handling. This is automatic cross-service credential disclosure, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The Discord assistant processes a message while OPENAI_API_KEY is set and no higher-priority key or custom key is configured.
Impact
The OpenAI credential is disclosed to a different provider, where it may be exposed or misused.
Mechanism
The resolver selects OPENAI_API_KEY, while the default API base is api.deepseek.com; the request sends that key in a Bearer authorization header.
Attack narrative
When the default auto mode handles a Discord message, the resolver may pick up OPENAI_API_KEY from the environment. The default custom API base is api.deepseek.com, and the request sends the resolved key as a Bearer token there. This transmits an OpenAI credential to a service other than the one it belongs to.
AI rationale
The default provider configuration can send OPENAI_API_KEY to api.deepseek.com during ordinary message handling. This is automatic cross-service credential disclosure, so the package should be blocked.
Evidence
dist/config.jsdist/lib/llm.jsdist/index.jsdist/duty/mentionReply.js
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Default configuration uses llmMode "auto", leaves the custom API key empty, and sets the API base to https://api.deepseek.com.
- The key resolver can select OPENAI_API_KEY from the environment.
- The custom API request sends the resolved key as a Bearer token to the configured API base.
- Incoming message handling calls the LLM, so this path can run automatically when the Discord assistant processes a message.
Evidence against
- The package describes itself as a Discord assistant with support for external LLM APIs.
- The manifest's prepare script only runs the TypeScript build; the identified key transmission is runtime behavior.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedclient.jsView file
18factory: (require) => {
L19: const React = require('react')
L20: const h = React.createElement
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client.jsView on unpkg · L18dist/lib/llm.jsView file
17try {
L18: const home = process.env.DSH_HOME || join(process.env.USERPROFILE || process.env.HOME || '', '.dsh');
L19: const authPath = join(home, 'plugins', 'subscriptions', 'auth.json');
L20: if (existsSync(authPath)) {
L21: const data = JSON.parse(readFileSync(authPath, 'utf-8'));
L22: const list = [];
...
L126: try {
L127: const tokenResp = await fetch('https://oauth2.googleapis.com/token', {
L128: method: 'POST',
L129: headers: { 'content-type': 'application/x-www-form-urlencoded' },
L130: body: new URLSearchParams({
L131: client_id: oauthClientId,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/lib/llm.jsView on unpkg · L1717
Findings
2 Critical1 High4 Medium5 Low
CriticalCredential Exfiltrationdist/lib/llm.js
CriticalTrigger Reachable Dangerous Capabilitydist/lib/llm.js
HighTrigger Reachable Credential Exfiltrationdist/lib/llm.js
MediumDynamic Requireclient.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @luoyi-dsh/discord-plugin@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @luoyi-dsh/discord-plugin@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.