registry / @u1in/reasonix-feishu-deploy / 0.5.2

@u1in/reasonix-feishu-deploy@0.5.2

🤖 一键部署 Reasonix AI Bot 接入飞书

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 44.6 KB of source, external domains: open.feishu.cn, platform.deepseek.com

Source & flagged code

5 flagged

config/config.tomlView file

Lines 44-84text

44[notifications]

46enabled = false # 系统通知开关

47turn_done = true # 轮次完成通知

48approval_request = true # 工具审批通知

49ask_request = true # 提问通知

51# ── 网络 / 代理 ────────────────────────────────────────────────────────────

52# 部分企业 / 校园网络需要通过代理访问外部 API。

54[network]

Source & flagged code

5 flagged · loading source

config/config.tomlView file

64patternName = generic_password severity = medium line = 64 matchedText = # passwo...RD}"

Medium

Secret Pattern

Package contains a possible secret pattern.

config/config.tomlView on unpkg · L64

scripts/undeploy.mjsView file

16console.log('正在安装 prompts 依赖...'); L17: const { execSync } = await import('child_process'); L18: // 优先安装到包本地（npx 缓存可能只读，失败则装到全局）

High

Child Process

Package source references child process execution.

scripts/undeploy.mjsView on unpkg · L16

5* L6: * 推荐用法: npx @u1in/reasonix-feishu-deploy --undeploy L7: * 也可直接: node undeploy.mjs ... L16: console.log('正在安装 prompts 依赖...'); L17: const { execSync } = await import('child_process'); L18: // 优先安装到包本地（npx 缓存可能只读，失败则装到全局）

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/undeploy.mjsView on unpkg · L5

16console.log('正在安装 prompts 依赖...'); L17: const { execSync } = await import('child_process'); L18: // 优先安装到包本地（npx 缓存可能只读，失败则装到全局） ... L33: L34: const HOME = homedir(); L35: const CONFIG_DIR = `${HOME}/.config/reasonix-bot`; ... L55: function detectShellConfig() { L56: const shell = (process.env.SHELL || '').toLowerCase(); L57: const zdotdir = process.env.ZDOTDIR || HOME; L58: if (shell.includes('zsh')) return `${zdotdir}/.zshrc`; L59: if (shell.includes('bash')) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/undeploy.mjsView on unpkg · L16

scripts/cli.shView file

•path = scripts/cli.sh kind = build_helper sizeBytes = 3228 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cli.shView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processscripts/undeploy.mjs

HighShell

HighRuntime Package Installscripts/undeploy.mjs

MediumSecret Patternconfig/config.toml

MediumEnvironment Vars

MediumInstall Persistencescripts/undeploy.mjs

MediumShips Build Helperscripts/cli.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

scripts/undeploy.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * Reasonix 飞书 Bot — 卸载还原脚本

4 * 还原 deploy 所做的所有修改，支持选择性保留数据。

5 *

6 * 推荐用法: npx @u1in/reasonix-feishu-deploy --undeploy

7 * 也可直接: node undeploy.mjs

8 */

9import { createRequire } from 'module';

10const _require = createRequire(import.meta.url);

12let prompts;

13try {

14 prompts = _require('prompts');

15} catch {

16 console.log('正在安装 prompts 依赖...');

17 const { execSync } = await import('child_process');

18 // 优先安装到包本地（npx 缓存可能只读，失败则装到全局）

High

Child Process

Package source references child process execution.

scripts/undeploy.mjsView on unpkg · L16

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/undeploy.mjsView on unpkg · L5

19 try {

20 const { fileURLToPath } = await import('url');

21 const { resolve, dirname } = await import('path');

22 const pkgDir = resolve(dirname(fileURLToPath(import.meta.url)), '..');

23 execSync('npm install --no-save prompts 2>/dev/null', { cwd: pkgDir, stdio: 'inherit' });

24 } catch {

25 execSync('npm install -g prompts 2>/dev/null', { stdio: 'inherit' });

26 }

27 prompts = _require('prompts');

28}

30import { existsSync, readFileSync, writeFileSync, unlinkSync, rmSync, readdirSync, statSync } from 'fs';

31import { homedir } from 'os';

32import { execSync } from 'child_process';

34const HOME = homedir();

35const CONFIG_DIR = `${HOME}/.config/reasonix-bot`;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/undeploy.mjsView on unpkg · L16