@luoyi-dsh/instagram-plugin@1.0.9
DeepSeek Harness (DSH) Instagram 插件：背景標籤巡查推薦、被@提問上下文推理應答與私訊雙向互動
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe default automatic LLM path can transmit OPENAI_API_KEY to api.deepseek.com as a Bearer credential. The destination is a different provider from the credential's service, and the scheduled reply duties can trigger the request without a separate user action.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An OpenAI API key is available and an automatic Instagram duty generates a reply.
Impact
The OpenAI credential is disclosed to a different provider without the user's explicit selection of that destination.
Mechanism
Automatic mode resolves OPENAI_API_KEY, then sends it as a Bearer token to the default DeepSeek API base.
Attack narrative
When an automatic reply needs an LLM, the plugin can select OPENAI_API_KEY from the environment. Its default mode is automatic and its default custom API base is DeepSeek, where the key is sent as a Bearer token. This exposes an OpenAI credential to a different provider without the user explicitly choosing DeepSeek for that key.
AI rationale
The default automatic LLM path can transmit OPENAI_API_KEY to api.deepseek.com as a Bearer credential. The destination is a different provider from the credential's service, and the scheduled reply duties can trigger the request without a separate user action.
Evidence
dist/lib/llm.jsdist/config.jsdist/index.jsdist/duty/dmReply.js
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The API key resolver explicitly accepts OPENAI_API_KEY, including as an environment variable.
- The default configuration uses automatic LLM mode and https://api.deepseek.com; custom requests send the resolved key as a Bearer token.
- In automatic mode, finding a key selects the custom API path, which is reached by the Instagram reply duties.
- DM replies are scheduled automatically after the Instagram MCP client is ready and call the LLM when a reply is generated.
Evidence against
- The package is an Instagram assistant that is designed to generate replies using external LLM services.
- The custom API base can be configured by the user, and the source also supports sending DeepSeek credentials to DeepSeek.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedclient.jsView file
17factory: (require) => {
L18: const React = require('react')
L19: const h = React.createElement
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client.jsView on unpkg · L17dist/lib/llm.jsView file
101try {
L102: const home = process.env.DSH_HOME || join(process.env.USERPROFILE || process.env.HOME || '', '.dsh');
L103: const authPath = join(home, 'plugins', 'subscriptions', 'auth.json');
L104: if (existsSync(authPath)) {
L105: const data = JSON.parse(readFileSync(authPath, 'utf-8'));
L106: const list = [];
...
L213: const timer = setTimeout(() => controller.abort(), 6000);
L214: const resp = await fetch(url, {
L215: headers: { 'User-Agent': 'Mozilla/5.0' },
...
L226: return {
L227: inlineData: {
L228: mimeType,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/lib/llm.jsView on unpkg · L101101Trigger-reachable chain: manifest.main -> dist/index.js -> dist/lib/llm.js
L101: try {
L102: const home = process.env.DSH_HOME || join(process.env.USERPROFILE || process.env.HOME || '', '.dsh');
L103: const authPath = join(home, 'plugins', 'subscriptions', 'auth.json');
L104: if (existsSync(authPath)) {
L105: const data = JSON.parse(readFileSync(authPath, 'utf-8'));
L106: const list = [];
...
L213: const timer = setTimeout(() => controller.abort(), 6000);
L214: const resp = await fetch(url, {
L215: headers: { 'User-Agent': 'Mozilla/5.0' },
...
L226: return {
L227: inlineData: {
L228: mimeType,
Findings
2 Critical1 High4 Medium5 Low
CriticalCredential Exfiltrationdist/lib/llm.js
CriticalTrigger Reachable Dangerous Capabilitydist/lib/llm.js
HighTrigger Reachable Credential Exfiltrationdist/lib/llm.js
MediumDynamic Requireclient.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @luoyi-dsh/instagram-plugin@1.0.9.
See all versions of @luoyi-dsh/instagram-plugin for other recorded verdicts.
- Avoid installing @luoyi-dsh/instagram-plugin@1.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.