registry / dsh-tg-bridge / 1.19.5
dsh-tg-bridge@1.19.5
Telegram bridge for DeepSeek Harness: text, voice, photos and project-per-topic sessions without opening the desktop app
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection found no npm lifecycle hook or unrelated credential recipient. The probe sends a minimal request to the provider selected by the active profile or explicit environment configuration, while bridge controls are subject to the configured user and chat allowlist.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The bridge runs and encounters a configured-provider recovery condition, or an allowed user invokes a management command.
Impact
The inspected behavior supports the configured bridge and its user-requested controls; no unauthorized credential transfer or unconsented control-surface mutation was established.
Mechanism
The bridge sends provider credentials with a minimal test request to the configured provider and sends bot requests to Telegram. Chat management commands update the configured DSH installation.
AI rationale
Source inspection found no npm lifecycle hook or unrelated credential recipient. The probe sends a minimal request to the provider selected by the active profile or explicit environment configuration, while bridge controls are subject to the configured user and chat allowlist.
Evidence
model-probe.mjscontrol.mjs
Network endpoints1
api.telegram.org
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no npm lifecycle hook; setup and repository hook installation are explicit commands.
- On a recovery path, the bridge probes a provider URL from the active DSH profile or its environment override, using that provider’s configured key and a one-token test request.
- Telegram requests go to api.telegram.org, and incoming messages are ignored unless the sender or chat is configured as allowed.
- The persona file is changed by the chat command that supplies its new text; the bridge applies the configured user and chat allowlist before processing messages.
- The inspected control operations modify DSH settings or manage its plugins and process; they do not establish an unrelated credential transfer.
- The plugin starts the bridge only when its configuration exists, unless auto-start is disabled.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
9 flaggedinstall-hooks.mjsView file
13// Usage: node install-hooks.mjs [--uninstall]
L14: import { execFileSync } from 'node:child_process';
L15: import { existsSync, mkdirSync, chmodSync, writeFileSync } from 'node:fs';
High
control.mjsView file
2165try {
L2166: const drives = execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', '(Get-PSDrive C).Free'], {
L2167: encoding: 'utf8',
High
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
ed') }));
}
function sessiontitle(id) {
const record = readjson(join(dsh_home, 'storages', 'session_projcache', 'sessions', `session-${bareid(id)}.json`));
const rows = record?.record?.rows ?? record?.rows ?? {};
const title = rows.title?.val;
if (typeof title === 'string' && title.trim()) return title.trim();
const first = rows.titleinput?.val?.first?.text;
if (typeof first === 'string' && first.trim()) return first.tr
Findings
1 Critical7 High4 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationbridge.mjs
HighChild Processinstall-hooks.mjs
HighShellcontrol.mjs
HighCommand Output Exfiltrationsetup.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationcontrol.mjs
HighSemantic Analysis Limitedpanel.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritybridge-restart-idle.mjs
HighKnown Malware Source Similarityrestart-after-send.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to dsh-tg-bridge@1.19.5.
See all versions of dsh-tg-bridge for other recorded verdicts.
- Review the evidence and your use of dsh-tg-bridge@1.19.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.