registry  /  api-switch-cc  /  0.9.2

api-switch-cc@0.9.2

Claude Code 多模型代理 — 一���切换 DeepSeek、Qwen、GLM、商汤商量、NVIDIA 等国产大模型，协议自动转换，零配置即用。安全增强版：API Key 加密存储、Bearer 认证、SHA256 验证、速率限制、TLS 支持。LLM API proxy for Claude Code with security hardening.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 18.1 KB of source, external domains: gitee.com, github.com, go.dev, goproxy.cn

Source & flagged code

2 flagged · loading source
api-switch.jsView file
19const { join } = require("path"); L20: const { execSync, spawnSync } = require("child_process"); L21: L22: const PKG = require("./package.json"); L23: const VERSION = "v" + PKG.version; L24: const BIN_DIR = join(__dirname, ".bin"); L25: const IS_WIN = process.platform === "win32"; L26: const IS_MAC = process.platform === "darwin"; ... L29: L30: const GITEE_REPO = "https://gitee.com/776311606/API-Switch.git"; L31: // Gitee raw URL with version subdirectory: release/vX.Y.Z/api-switch-{plat} ... L211: } catch (e) {
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

api-switch.jsView on unpkg · L19
•matchType = previous_version_dangerous_delta matchedPackage = api-switch-cc@0.9.0 matchedIdentity = npm:YXBpLXN3aXRjaC1jYw:0.9.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

api-switch.jsView on unpkg

Findings

2 High1 Medium3 Low
HighSandbox Evasion Gated Capabilityapi-switch.js
HighPrevious Version Dangerous Deltaapi-switch.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings