dsh-tg-bridge@1.18.0
Telegram bridge for DeepSeek Harness: text, voice, photos and project-per-topic sessions without opening the desktop app
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe probe has a normal provider-health purpose and defaults to the configured provider service, but it forwards a saved key to an unrestricted environment-selected destination. That residual exposure warrants a warning, not a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A model failure causes the bridge to run its availability probe.
Impact
If the base URL is set to an unintended recipient, the provider key could be disclosed; source does not show that this happens by default.
Mechanism
The probe loads UNOROUTER_API_KEY from the environment or DSH credentials and places it in an Authorization header for a request to UNOROUTER_BASE_URL.
AI rationale
The probe has a normal provider-health purpose and defaults to the configured provider service, but it forwards a saved key to an unrestricted environment-selected destination. That residual exposure warrants a warning, not a block.
Evidence
model-probe.mjs
Network endpoints1
api.unorouter.com/v1
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- model-probe.mjs reads UNOROUTER_API_KEY from the environment or the local credentials file and sends it as a Bearer token to a base URL configurable through UNOROUTER_BASE_URL.
- bridge.mjs invokes the probe after model failures; the default recipient is the package-aligned Unorouter API, but the source does not restrict the configurable recipient.
- The control command that saves the DSH persona calls setSoul only in response to its explicit command path; this is not an automatic install-time configuration change.
- settings-card.mjs resolves a callback to a matching predefined button and returns its command only when that button has one.
- panel.mjs escapes reasoning and step text before embedding it in the progress panel’s HTML.
Evidence against
- package.json declares no lifecycle scripts, and the inspected runtime caller runs the probe for provider availability checks.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
10 flaggedinstall-hooks.mjsView file
13// Usage: node install-hooks.mjs [--uninstall]
L14: import { execFileSync } from 'node:child_process';
L15: import { existsSync, mkdirSync, chmodSync, writeFileSync } from 'node:fs';
High
control.mjsView file
1931try {
L1932: const drives = execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', '(Get-PSDrive C).Free'], {
L1933: encoding: 'utf8',
High
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
ed') }));
}
function sessiontitle(id) {
const record = readjson(join(dsh_home, 'storages', 'session_projcache', 'sessions', `session-${bareid(id)}.json`));
const rows = record?.record?.rows ?? record?.rows ?? {};
const title = rows.title?.val;
if (typeof title === 'string' && title.trim()) return title.trim();
const first = rows.titleinput?.val?.first?.text;
if (typeof first === 'string' && first.trim()) return first.tr
Findings
2 Critical7 High4 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationbridge.mjs
CriticalPrevious Version Dangerous Deltabridge.mjs
HighChild Processinstall-hooks.mjs
HighShellcontrol.mjs
HighCommand Output Exfiltrationsetup.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationcontrol.mjs
HighSemantic Analysis Limitedmodel-probe.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritybridge-restart-idle.mjs
HighKnown Malware Source Similarityrestart-after-send.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
Affected versions and remediation
This report applies to dsh-tg-bridge@1.18.0.
See all versions of dsh-tg-bridge for other recorded verdicts.
- Review the evidence and your use of dsh-tg-bridge@1.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.