dsh-tg-bridge@1.8.0
устаревшая сборка — ставьте 1.11.0 или новее
Telegram bridge for DeepSeek Harness: text, voice, photos and project-per-topic sessions without opening the desktop app
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source exposes an explicit `/soul` command that rewrites the global DSH instructions file, with access limited to configured Telegram users. This is a guarded agent-control capability with residual account-compromise risk, so it warrants a warning; the inspected source does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
An allowlisted user sends `/soul` with text through the configured Telegram bot.
Impact
A user with access to the configured Telegram account can change instructions that affect later DSH behavior.
Mechanism
The command writes the supplied text into the persona section of `DSH_HOME/AGENTS.md`.
AI rationale
The source exposes an explicit `/soul` command that rewrites the global DSH instructions file, with access limited to configured Telegram users. This is a guarded agent-control capability with residual account-compromise risk, so it warrants a warning; the inspected source does not establish malicious behavior.
Evidence
control.mjsbridge.mjsDSH_HOME/AGENTS.md
Network endpoints1
api.telegram.org
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit `/soul` command passes supplied text to a function that rewrites the persona section in `DSH_HOME/AGENTS.md`.
- The bridge checks the configured allowed-user list before passing commands to the control handler.
- The manifest defines start, setup, check, menu, doctor, and test scripts, with no npm install lifecycle hook.
- The bridge sends bot API requests to `api.telegram.org`; the inspected price-catalog requests use `models.dev`.
Evidence against
- The instruction-file change requires an explicit command from an allowlisted Telegram user; no install-time mutation was found.
- The inspected network calls showed no unrelated credential recipient.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedsetup.mjsView file
19L20: import { spawnSync } from 'node:child_process';
L21: import { appendFileSync, existsSync, readFileSync, openSync, closeSync, unlinkSync, writeFileSync } from 'node:fs';
High
19L20: import { spawnSync } from 'node:child_process';
L21: import { appendFileSync, existsSync, readFileSync, openSync, closeSync, unlinkSync, writeFileSync } from 'node:fs';
...
L24:
L25: const DSH_HOME = process.env.DSH_HOME || join(homedir(), '.dsh');
L26: const BRIDGE_DIR = join(DSH_HOME, 'tg-bridge');
...
L48: let held = 0;
L49: try { held = Number(JSON.parse(readFileSync(LOCK, 'utf8')).pid) || 0; } catch {}
L50: let alive = false;
...
L63: /**
L64: * Every step is written to setup.log as well as stdout.
L65: *
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
setup.mjsView on unpkg · L19control.mjsView file
1618try {
L1619: const drives = execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', '(Get-PSDrive C).Free'], {
L1620: encoding: 'utf8',
Findings
2 Critical6 High4 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationbridge.mjs
CriticalPrevious Version Dangerous Deltabridge.mjs
HighChild Processsetup.mjs
HighShellcontrol.mjs
HighCommand Output Exfiltrationsetup.mjs
HighSemantic Analysis Limitedprices.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritybridge-restart-idle.mjs
HighKnown Malware Source Similarityrestart-after-send.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertranscribe.py
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to dsh-tg-bridge@1.8.0.
See all versions of dsh-tg-bridge for other recorded verdicts.
- Review the evidence and your use of dsh-tg-bridge@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.