registry / dsh-versatileds-plugin / 0.2.8
dsh-versatileds-plugin@0.2.8
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest has no install hook, and inspected credential paths support the package’s configured model integration rather than unrelated collection. The scanner’s download-and-execute signal maps to an explicit local voice deployment route for Python, dependencies, and model files, not an install-time execution chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A model request occurs when the QQ feature calls a generation function and both a key and endpoint are configured.
Impact
No unrelated credential transfer or other confirmed attack impact was established.
Mechanism
The request sends the key as a bearer credential to the configured chat-completions endpoint with the model prompt.
AI rationale
The manifest has no install hook, and inspected credential paths support the package’s configured model integration rather than unrelated collection. The scanner’s download-and-execute signal maps to an explicit local voice deployment route for Python, dependencies, and model files, not an install-time execution chain.
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies the package entry point and declares no install lifecycle scripts.
- The QQ module reads a specifically configured DeepSeek key and sends it to the configurable LLM endpoint; its default endpoint is api.deepseek.com, and model requests stop if either the key or endpoint is absent.
- The other inspected QQ key-path excerpts show only configured, environment, or local-file sources; they do not show unrelated credential collection or transfer.
- The Bilibili runtime excerpt builds a model prompt from recommendation candidates; the client excerpt handles configuration form state.
- The package entry point imports the Bilibili and QQ modules; the Bilibili client uses ordinary API request logic and standard hashing.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedindex.jsView file
13L14: import { spawnSync } from 'node:child_process'
L15: import { existsSync, mkdirSync, readFileSync } from 'node:fs'
High
lib/bili.jsView file
7L8: const BASE = 'https://api.bilibili.com'
L9: const VC = 'https://api.vc.bilibili.com'
...
L161: })
L162: const text = await res.text()
L163: if (res.status === 412 || res.status === 429) {
...
L191: }
L192: const qs = new URLSearchParams(query).toString()
L193: const url = qs ? `${BASE}${path}?${qs}` : `${BASE}${path}`
Low
qq/index.jsView file
5* 1. 注册 `versatileds_qq` 工具，手动收发消息、查好友/群/历史。
L6: * 2. 后台连 NapCat 的 WebSocket，按配置自动回复。回复优先走 DeepSeek API，
L7: * 没有 key 时回退到固定短句池。
...
L10: import { createHash, randomBytes } from 'node:crypto'
L11: import { spawn, spawnSync } from 'node:child_process'
L12: import http from 'node:http'
...
L23: const ACTIONS = [
L24: 'status', 'friends', 'groups', 'history', 'send_private', 'send_group', 'share_video', 'voice',
L25: 'proactive_status', 'group_rules', 'live_status', 'balance',
...
L554: function dshHome() {
L555: return process.env.DSH_HOME || join(homedir(), '.dsh')
L556: }
Findings
2 Critical2 High3 Medium5 Low
CriticalDownload Executeqq/index.js
CriticalTrigger Reachable Dangerous Capabilityqq/index.js
HighChild Processindex.js
HighSemantic Analysis Limitedbili/index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptolib/bili.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to dsh-versatileds-plugin@0.2.8.
See all versions of dsh-versatileds-plugin for other recorded verdicts.
- Review the evidence and your use of dsh-versatileds-plugin@0.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.