@luoyi-dsh/instagram-plugin@1.0.11
DeepSeek Harness (DSH) Instagram 插件：背景標籤巡查推薦、被@提問上下文推理應答與私訊雙向互動
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source accepts OPENAI_API_KEY, but by default routes custom LLM requests to api.deepseek.com and sends the key in the Authorization header. Default-enabled background duties can trigger runtime LLM calls, so this is concrete credential exfiltration to a different provider.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A runtime LLM call while OPENAI_API_KEY is set and no explicit custom key or API base overrides the defaults; default background duties can make such calls automatically.
Impact
The unrelated API provider receives the OpenAI credential, which could enable unauthorized use or charges on the associated account.
Mechanism
The resolver selects OPENAI_API_KEY, auto mode routes the request to the custom API path, and the request uses the default DeepSeek base with the selected key in its Authorization header.
Attack narrative
When an LLM duty runs with OPENAI_API_KEY set, the resolver can select that key. The default configuration uses auto mode and the DeepSeek API base; auto mode sends a resolved key through the custom API path, where the key is placed in the Bearer authorization header. This exposes an OpenAI credential to api.deepseek.com without an explicit endpoint choice.
AI rationale
The source accepts OPENAI_API_KEY, but by default routes custom LLM requests to api.deepseek.com and sends the key in the Authorization header. Default-enabled background duties can trigger runtime LLM calls, so this is concrete credential exfiltration to a different provider.
Evidence
dist/lib/llm.jsdist/config.jsdist/index.js
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The API key resolver accepts OPENAI_API_KEY as a credential source.
- The default configuration uses auto mode and sets the custom API base to https://api.deepseek.com.
- The custom LLM request uses the resolved key and falls back to the DeepSeek API base.
- The request sends that key as a Bearer token to the selected API base.
- In auto mode, a resolved key skips subscription-first routing and reaches the custom API path.
- The plugin enables background mention replies by default and schedules them when the Instagram client is ready.
Evidence against
- The manifest's prepare script only runs the TypeScript build.
- The DeepSeek endpoint is part of the package's stated LLM functionality, but the source does not prevent sending an OpenAI key there.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedclient.jsView file
17factory: (require) => {
L18: const React = require('react')
L19: const h = React.createElement
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client.jsView on unpkg · L17dist/lib/llm.jsView file
101try {
L102: const home = process.env.DSH_HOME || join(process.env.USERPROFILE || process.env.HOME || '', '.dsh');
L103: const authPath = join(home, 'plugins', 'subscriptions', 'auth.json');
...
L107: try {
L108: const mData = JSON.parse(readFileSync(modelsPath, 'utf-8'));
L109: for (const p of ['antigravity', 'codex', 'grok', 'copilot']) {
...
L191: subscriptionModel: merged.subscriptionModel || diskCfg.subscriptionModel || 'gemini-3-flash',
L192: customLlmApiBase: merged.customLlmApiBase || diskCfg.customLlmApiBase || 'https://api.deepseek.com',
L193: customLlmModel: merged.customLlmModel || diskCfg.customLlmModel || 'deepseek-chat',
...
L257: /**
L258: * 將圖片 URL、data:image/...;base64 或本地圖片檔案路徑轉為多模態 inlineData
L259: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/lib/llm.jsView on unpkg · L101Findings
2 Critical1 High4 Medium5 Low
CriticalCredential Exfiltrationdist/lib/llm.js
CriticalTrigger Reachable Dangerous Capabilitydist/lib/llm.js
HighTrigger Reachable Credential Exfiltrationdist/lib/llm.js
MediumDynamic Requireclient.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @luoyi-dsh/instagram-plugin@1.0.11.
See all versions of @luoyi-dsh/instagram-plugin for other recorded verdicts.
- Avoid installing @luoyi-dsh/instagram-plugin@1.0.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.