registry / api-switch-cc / 0.9.0

api-switch-cc@0.9.0

Claude Code 多模型代理 — 一��切换 DeepSeek、Qwen、GLM、商汤商量、NVIDIA 等国产大模型，协议自动转换，零配置即用。安全增强版：API Key 加密存储、Bearer 认证、SHA256 验证、速率限制、TLS 支持。LLM API proxy for Claude Code with security hardening.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 17.9 KB of source, external domains: gitee.com, github.com, go.dev, goproxy.cn

Source & flagged code

1 flagged

api-switch.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * API-Switch — lazy-install launcher

5 *

6 * On first run, installs the api-switch binary, then execs it.

7 * Subsequent runs use the cached binary directly.

8 *

9 * Install order:

10 * 1. GitHub release raw binary (no tar needed)

11 * 2. Gitee clone + go build (China mirror, needs Go + Git)

12 * 3. go install (needs Go)

13 * 4. Friendly error with platform-specific instructions

14 */

16"use strict";

18const { existsSync, mkdirSync, chmodSync, unlinkSync, copyFileSync, readFileSync } = require("fs");

19const { join } = require("path");

20const { execSync, spawnSync } = require("child_process");

22const PKG = require("./package.json");

23const VERSION = "v" + PKG.version;

24const BIN_DIR = join(__dirname, ".bin");

25const IS_WIN = process.platform === "win32";

26const IS_MAC = process.platform === "darwin";

27const BIN_NAME = IS_WIN ? "api-switch.exe" : "api-switch";

28const BIN_PATH = join(BIN_DIR, BIN_NAME);

30const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git";

31// Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19

32const GITEE_RAW = `https://gitee.com/776311606/API-Switch/raw/release/${VERSION}`;

33const GH_RELEASE = `https://github.com/hxz0727/API-Switch/releases/download/${VERSION}`;

35function platform() {

36 const map = {

37 "darwin-x64": "darwin-amd64", "darwin-arm64": "darwin-arm64",

38 "linux-x64": "linux-amd64", "linux-arm64": "linux-arm64",

39 "win32-x64": "windows-amd64",

Source & flagged code

1 flagged · loading source

api-switch.jsView file

19const { join } = require("path"); L20: const { execSync, spawnSync } = require("child_process"); L21: L22: const PKG = require("./package.json"); L23: const VERSION = "v" + PKG.version; L24: const BIN_DIR = join(__dirname, ".bin"); L25: const IS_WIN = process.platform === "win32"; L26: const IS_MAC = process.platform === "darwin"; ... L29: L30: const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git"; L31: // Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat} ... L208: } catch (e) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19

Findings

1 High1 Medium3 Low

HighSandbox Evasion Gated Capabilityapi-switch.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

api-switch.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * API-Switch — lazy-install launcher

5 *

6 * On first run, installs the api-switch binary, then execs it.

7 * Subsequent runs use the cached binary directly.

8 *

9 * Install order:

10 * 1. GitHub release raw binary (no tar needed)

11 * 2. Gitee clone + go build (China mirror, needs Go + Git)

12 * 3. go install (needs Go)

13 * 4. Friendly error with platform-specific instructions

14 */

16"use strict";

18const { existsSync, mkdirSync, chmodSync, unlinkSync, copyFileSync, readFileSync } = require("fs");

19const { join } = require("path");

20const { execSync, spawnSync } = require("child_process");

22const PKG = require("./package.json");

23const VERSION = "v" + PKG.version;

24const BIN_DIR = join(__dirname, ".bin");

25const IS_WIN = process.platform === "win32";

26const IS_MAC = process.platform === "darwin";

27const BIN_NAME = IS_WIN ? "api-switch.exe" : "api-switch";

28const BIN_PATH = join(BIN_DIR, BIN_NAME);

30const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git";

31// Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19

32const GITEE_RAW = `https://gitee.com/776311606/API-Switch/raw/release/${VERSION}`;

33const GH_RELEASE = `https://github.com/hxz0727/API-Switch/releases/download/${VERSION}`;

35function platform() {

36 const map = {

37 "darwin-x64": "darwin-amd64", "darwin-arm64": "darwin-arm64",

38 "linux-x64": "linux-amd64", "linux-arm64": "linux-arm64",

39 "win32-x64": "windows-amd64",