registry / dsh-tg-bridge / 1.13.2
dsh-tg-bridge@1.13.2
Telegram bridge for DeepSeek Harness: text, voice, photos and project-per-topic sessions without opening the desktop app
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack behavior. The flagged agent configuration write is an explicit /soul command behind the allowed-user check, and the bot token is used for Telegram API operations.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The bridge starts through an explicit command or host plugin startup; configuration changes require an allowed user's command.
Impact
No confirmed harmful effect or unrelated credential transfer was established.
Mechanism
It sends bot requests to Telegram, supports user-requested plugin and persona changes, and retrieves public model pricing.
AI rationale
Source inspection found no install lifecycle hook or concrete attack behavior. The flagged agent configuration write is an explicit /soul command behind the allowed-user check, and the bot token is used for Telegram API operations.
Evidence
control.mjsbridge.mjs
Network endpoints2
api.telegram.orgmodels.dev
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes explicit start and setup commands; it declares no install lifecycle hook.
- Telegram commands are limited to configured allowed users, and /soul writes the global persona only when explicitly invoked with text.
- Bridge bot requests go to Telegram's API, and its token is used to operate that bot.
- The plugin handler processes explicit plugin actions; profile edits are described as user-set configuration.
- The price catalog uses models.dev; setup and restart helpers describe explicit setup and reply-safe restart behavior.
- Panel code formats turn output; the reviewed runtime operation locations do not establish an attack.
- When invoked, install-hooks.mjs writes pre-commit and pre-push hook files under .githooks.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedinstall-hooks.mjsView file
13// Usage: node install-hooks.mjs [--uninstall]
L14: import { execFileSync } from 'node:child_process';
L15: import { existsSync, mkdirSync, chmodSync, writeFileSync } from 'node:fs';
High
control.mjsView file
1754try {
L1755: const drives = execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', '(Get-PSDrive C).Free'], {
L1756: encoding: 'utf8',
High
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
ed') }));
}
function sessiontitle(id) {
const record = readjson(join(dsh_home, 'storages', 'session_projcache', 'sessions', `session-${bareid(id)}.json`));
const rows = record?.record?.rows ?? record?.rows ?? {};
const title = rows.title?.val;
if (typeof title === 'string' && title.trim()) return title.trim();
const first = rows.titleinput?.val?.first?.text;
if (typeof first === 'string' && first.trim()) return first.tr
Findings
1 Critical7 High4 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationbridge.mjs
HighChild Processinstall-hooks.mjs
HighShellcontrol.mjs
HighCommand Output Exfiltrationsetup.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationcontrol.mjs
HighSemantic Analysis Limitedpanel.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritybridge-restart-idle.mjs
HighKnown Malware Source Similarityrestart-after-send.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to dsh-tg-bridge@1.13.2.
See all versions of dsh-tg-bridge for other recorded verdicts.
- Review the evidence and your use of dsh-tg-bridge@1.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.