dsh-versatileds-plugin@0.2.9
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe endpoint is configurable independently from the saved provider key, and chat requests transmit that key to it. The default endpoint is aligned with the key, so the source supports a conditional exposure warning rather than a confirmed malicious attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A chat message triggers model reply generation while a key and model endpoint are configured.
Impact
If the endpoint is redirected, that host could receive the provider key and chat context.
Mechanism
The plugin loads the key from configuration, the environment, or a local file and sends it as a bearer token to the configured endpoint without binding the key to the default host.
AI rationale
The endpoint is configurable independently from the saved provider key, and chat requests transmit that key to it. The default endpoint is aligned with the key, so the source supports a conditional exposure warning rather than a confirmed malicious attack.
Evidence
qq/index.js
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The model URL accepts any OpenAI-compatible endpoint, while the configured default is DeepSeek.
- The API key can come from configuration, an environment variable, or a local file.
- Chat requests send the key as a bearer token alongside chat history to the configured URL.
- Incoming chat messages can activate model reply generation.
- The Bilibili runtime hint passes video candidates to the DSH language model for selection.
Evidence against
- The default model endpoint is the intended DeepSeek service.
- The reviewed source does not establish a fixed, unrelated recipient or a hidden install-time transfer.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedindex.jsView file
13L14: import { spawnSync } from 'node:child_process'
L15: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
High
lib/bili.jsView file
7L8: const BASE = 'https://api.bilibili.com'
L9: const VC = 'https://api.vc.bilibili.com'
...
L161: })
L162: const text = await res.text()
L163: if (res.status === 412 || res.status === 429) {
...
L191: }
L192: const qs = new URLSearchParams(query).toString()
L193: const url = qs ? `${BASE}${path}?${qs}` : `${BASE}${path}`
Low
qq/index.jsView file
5
Findings
2 Critical2 High3 Medium5 Low
CriticalDownload Executeqq/index.js
CriticalTrigger Reachable Dangerous Capabilityqq/index.js
HighChild Processindex.js
HighSemantic Analysis Limitedbili/index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptolib/bili.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to dsh-versatileds-plugin@0.2.9.
See all versions of dsh-versatileds-plugin for other recorded verdicts.
- Review the evidence and your use of dsh-versatileds-plugin@0.2.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.