dsh-qzone@0.4.1
DeepSeek Harness 插件：静默 Chrome 扫码登录，自动给 QQ 空间发说说，支持配图、每日上限、主动发。
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically publishes publisher-chosen posts to the user’s QQ account by default, without a request for each post. That account action is distinct from the package’s interactive publishing flow, which specifies an explicit user request.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Plugin startup arms a timer; the first attempt runs after 90 seconds, followed by checks every 10 minutes. Autopost is enabled by default.
Impact
Unrequested public posts may be published to the user’s account using their QQ login.
Mechanism
The timer selects generic post text and optionally an image, then calls the publishing function with the saved QQ session.
Attack narrative
On plugin startup, a timer arms a default-enabled autoposter that can run after 90 seconds and checks every 10 minutes. During its configured hours and limits, it chooses package-written text and may attach an image, then publishes to the logged-in QQ Space using the user’s session. This produces account posts without an explicit request for each post.
AI rationale
The package automatically publishes publisher-chosen posts to the user’s QQ account by default, without a request for each post. That account action is distinct from the package’s interactive publishing flow, which specifies an explicit user request.
Evidence
index.jslib/qzone.js
Network endpoints1
user.qzone.qq.com/proxy/domain/taotao.qzone.qq.com/cgi-bin/emotion_cgi_publish_v6
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The autopost configuration defaults to enabled, public visibility, and up to two posts per day.
- The timer invokes autopostTick 90 seconds after plugin startup and every 10 minutes afterward.
- autopostTick publishes package-selected generic text, optionally with an image, without a user request.
- Publishing sends the logged-in QQ session cookie to QQ’s Qzone publishing endpoint.
Evidence against
- The package’s stated purpose includes automatically posting to QQ Space.
- Interactive publishing tools are documented as requiring an explicit user request or scheduled-task instruction.
- The session cookie is sent to QQ’s own service; no unrelated credential receiver was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedlib/uipost.jsView file
1// 网页 UI 带图发说说：在专属 Chrome 里打开空间主页，真实操作「写文字 → 传图 → 点发表」
L2: import { spawn } from 'node:child_process'
L3: import { existsSync } from 'node:fs'
High
lib/silent.jsView file
1// 静默 Chrome（跟抖音同款）：专属 profile + headless + CDP，用真实浏览器完成 QQ 扫码登录
L2: import { spawn } from 'node:child_process'
L3: import { existsSync } from 'node:fs'
...
L11: 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
L12: path.join(process.env.LOCALAPPDATA || '', 'Google', 'Chrome', 'Application', 'chrome.exe'),
L13: ]
...
L16: const PORT = Number(process.env.QZONE_CHROME_PORT || 9335)
L17: const LOGIN_URL = 'https://xui.ptlogin2.qq.com/cgi-bin/xlogin?daid=5&appid=549000912&style=20&hide_title_bar=1&low_login=1&qlogin_auto_login=1&no_verifyimg=1&link_target=blank&targ...
L18:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/silent.jsView on unpkg · L1Findings
3 Critical2 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationlib/qqlogin.js
CriticalTrigger Reachable Dangerous Capabilitylib/qqlogin.js
CriticalPrevious Version Dangerous Deltaindex.js
HighChild Processlib/uipost.js
HighSame File Env Network Executionlib/silent.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-qzone@0.4.1.
See all versions of dsh-qzone for other recorded verdicts.
- Avoid installing dsh-qzone@0.4.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.