@oranlens/oranleads@0.8.2
橙客 OranLeads：社媒评论区 AI 获客工作台（DSH 插件）
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically reports industry, products, regions, price, and peer brands to the vendor backend on startup and profile changes. The README discloses anonymous statistics, but no user-facing opt-out was identified, so this is suspicious runtime telemetry rather than clear malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
Host startup and profile save or generation.
Impact
The vendor receives details about the user's business profile without a user-facing reporting control identified in the package.
Mechanism
The host reduces the profile to five business fields, stores a pending report, and posts it to the configured endpoint.
AI rationale
The package automatically reports industry, products, regions, price, and peer brands to the vendor backend on startup and profile changes. The README discloses anonymous statistics, but no user-facing opt-out was identified, so this is suspicious runtime telemetry rather than clear malicious behavior.
Evidence
host/index.jsREADME.md
Network endpoints1
shop.brizcap.cn/api/v1/oranleads/business-profiles
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Host startup automatically reports the saved business profile.
- Saving a profile also queues a report.
- The report includes industry, products, regions, price, and peer brands.
- The host sends the report in a POST request to its configured endpoint.
- The README discloses anonymous statistics but no user-facing opt-out was identified.
Evidence against
- The package has no preinstall, install, or postinstall script.
- The README describes the reported fields as anonymous business statistics.
- The report omits the profile description and other profile fields.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
3 flaggedhost/index.jsView file
1"use strict";var wo=Object.create;var kn=Object.defineProperty;var ho=Object.getOwnPropertyDescriptor;var yo=Object.getOwnPropertyNames;var bo=Object.getPrototypeOf,xo=Object.proto...
L2: `;try{(0,Ee.appendFileSync)(t(),l)}catch{}};return(()=>{try{let r=Date.now()-12096e5;for(let i of(0,Ee.readdirSync)(e))i.endsWith(".log")&&Date.parse(i.slice(0,10)+"T00:00:00Z")<r&...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
host/index.jsView on unpkg · L1273b.report(c.get()),typeof e.effect=="function"&&e.effect(()=>l),o=()=>{O.suspendAll(),E.stop(),k.stop(),F.stop(),p.stop(),T.stop(),b.stop(),s.session.close()},process.on("exit",o)}c
Medium
Ai Review Evidence
Host startup automatically reports the saved business profile.
host/index.jsView on unpkg · L273native/bin/win32-arm64/oranleads-core.nodeView file
•path = native/bin/win32-arm64/oranleads-core.node
kind = native_binary
sizeBytes = 6736896
magicHex = [redacted]
Findings
6 Medium6 Low
MediumDynamic Requirehost/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarynative/bin/win32-arm64/oranleads-core.node
MediumStructural Risk Force Deep Review
MediumAi Review Evidencehost/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @oranlens/oranleads@0.8.2.
See all versions of @oranlens/oranleads for other recorded verdicts.
- Review the evidence and your use of @oranlens/oranleads@0.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.