registry  /  @u1in/reasonix-feishu-deploy  /  0.5.2

@u1in/reasonix-feishu-deploy@0.5.2

🤖 一键部署 Reasonix AI Bot 接入飞书

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 4 file(s), 44.6 KB of source, external domains: open.feishu.cn, platform.deepseek.com

Source & flagged code

5 flagged · loading source
config/config.tomlView file
64patternName = generic_password severity = medium line = 64 matchedText = # passwo...RD}"
Medium
Secret Pattern

Package contains a possible secret pattern.

config/config.tomlView on unpkg · L64
scripts/undeploy.mjsView file
16console.log('正在安装 prompts 依赖...'); L17: const { execSync } = await import('child_process'); L18: // 优先安装到包本地（npx 缓存可能只读，失败则装到全局）
High
Child Process

Package source references child process execution.

scripts/undeploy.mjsView on unpkg · L16
5* L6: * 推荐用法: npx @u1in/reasonix-feishu-deploy --undeploy L7: * 也可直接: node undeploy.mjs ... L16: console.log('正在安装 prompts 依赖...'); L17: const { execSync } = await import('child_process'); L18: // 优先安装到包本地（npx 缓存可能只读，失败则装到全局）
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/undeploy.mjsView on unpkg · L5
16console.log('正在安装 prompts 依赖...'); L17: const { execSync } = await import('child_process'); L18: // 优先安装到包本地（npx 缓存可能只读，失败则装到全局） ... L33: L34: const HOME = homedir(); L35: const CONFIG_DIR = `${HOME}/.config/reasonix-bot`; ... L55: function detectShellConfig() { L56: const shell = (process.env.SHELL || '').toLowerCase(); L57: const zdotdir = process.env.ZDOTDIR || HOME; L58: if (shell.includes('zsh')) return `${zdotdir}/.zshrc`; L59: if (shell.includes('bash')) {
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/undeploy.mjsView on unpkg · L16
scripts/cli.shView file
•path = scripts/cli.sh kind = build_helper sizeBytes = 3228 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cli.shView on unpkg

Findings

3 High5 Medium4 Low
HighChild Processscripts/undeploy.mjs
HighShell
HighRuntime Package Installscripts/undeploy.mjs
MediumSecret Patternconfig/config.toml
MediumEnvironment Vars
MediumInstall Persistencescripts/undeploy.mjs
MediumShips Build Helperscripts/cli.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings