registry / api-switch-cc / 0.9.2

api-switch-cc@0.9.2

Claude Code 多模型代理 — 一��切换 DeepSeek、Qwen、GLM、商汤商量、NVIDIA 等国产大模型，协议自动转换，零配置即用。安全增强版：API Key 加密存储、Bearer 认证、SHA256 验证、速率限制、TLS 支持。LLM API proxy for Claude Code with security hardening.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 18.1 KB of source, external domains: gitee.com, github.com, go.dev, goproxy.cn

Source & flagged code

2 flagged

api-switch.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * API-Switch — lazy-install launcher

5 *

6 * On first run, installs the api-switch binary, then execs it.

7 * Subsequent runs use the cached binary directly.

8 *

9 * Install order:

10 * 1. GitHub release raw binary (no tar needed)

11 * 2. Gitee clone + go build (China mirror, needs Go + Git)

12 * 3. go install (needs Go)

13 * 4. Friendly error with platform-specific instructions

14 */

16"use strict";

18const { existsSync, mkdirSync, chmodSync, unlinkSync, copyFileSync, readFileSync } = require("fs");

19const { join } = require("path");

20const { execSync, spawnSync } = require("child_process");

22const PKG = require("./package.json");

23const VERSION = "v" + PKG.version;

24const BIN_DIR = join(__dirname, ".bin");

25const IS_WIN = process.platform === "win32";

26const IS_MAC = process.platform === "darwin";

27const BIN_NAME = IS_WIN ? "api-switch.exe" : "api-switch";

28const BIN_PATH = join(BIN_DIR, BIN_NAME);

30const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git";

31// Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19

32const GITEE_RAW = `https://gitee.com/776311606/API-Switch/raw/release/${VERSION}`;

33const GH_RELEASE = `https://github.com/hxz0727/API-Switch/releases/download/${VERSION}`;

35function platform() {

36 const map = {

37 "darwin-x64": "darwin-amd64", "darwin-arm64": "darwin-arm64",

38 "linux-x64": "linux-amd64", "linux-arm64": "linux-arm64",

39 "win32-x64": "windows-amd64",

•matchType = previous_version_dangerous_delta matchedPackage = api-switch-cc@0.9.0 matchedIdentity = npm:YXBpLXN3aXRjaC1jYw:0.9.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

api-switch.jsView on unpkg

Source & flagged code

2 flagged · loading source

api-switch.jsView file

19const { join } = require("path"); L20: const { execSync, spawnSync } = require("child_process"); L21: L22: const PKG = require("./package.json"); L23: const VERSION = "v" + PKG.version; L24: const BIN_DIR = join(__dirname, ".bin"); L25: const IS_WIN = process.platform === "win32"; L26: const IS_MAC = process.platform === "darwin"; ... L29: L30: const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git"; L31: // Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat} ... L211: } catch (e) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

api-switch.jsView on unpkg

Findings

2 High1 Medium3 Low

HighSandbox Evasion Gated Capabilityapi-switch.js

HighPrevious Version Dangerous Deltaapi-switch.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

api-switch.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * API-Switch — lazy-install launcher

5 *

6 * On first run, installs the api-switch binary, then execs it.

7 * Subsequent runs use the cached binary directly.

8 *

9 * Install order:

10 * 1. GitHub release raw binary (no tar needed)

11 * 2. Gitee clone + go build (China mirror, needs Go + Git)

12 * 3. go install (needs Go)

13 * 4. Friendly error with platform-specific instructions

14 */

16"use strict";

18const { existsSync, mkdirSync, chmodSync, unlinkSync, copyFileSync, readFileSync } = require("fs");

19const { join } = require("path");

20const { execSync, spawnSync } = require("child_process");

22const PKG = require("./package.json");

23const VERSION = "v" + PKG.version;

24const BIN_DIR = join(__dirname, ".bin");

25const IS_WIN = process.platform === "win32";

26const IS_MAC = process.platform === "darwin";

27const BIN_NAME = IS_WIN ? "api-switch.exe" : "api-switch";

28const BIN_PATH = join(BIN_DIR, BIN_NAME);

30const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git";

31// Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19

32const GITEE_RAW = `https://gitee.com/776311606/API-Switch/raw/release/${VERSION}`;

33const GH_RELEASE = `https://github.com/hxz0727/API-Switch/releases/download/${VERSION}`;

35function platform() {

36 const map = {

37 "darwin-x64": "darwin-amd64", "darwin-arm64": "darwin-arm64",

38 "linux-x64": "linux-amd64", "linux-arm64": "linux-arm64",

39 "win32-x64": "windows-amd64",

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

api-switch.jsView on unpkg