dsh-versatileds-plugin@0.3.1
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source supports a conditional credential-exposure warning because a separately sourced DeepSeek key can be sent to an unrestricted configured endpoint. The default is service-aligned and no package-controlled recipient or malicious intent was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A QQ model-generation path runs while an API key and endpoint are configured.
Impact
An unrelated endpoint operator could receive the API key and conversation content. The source does not show a package-selected unrelated recipient.
Mechanism
The client posts to the configured base URL and places the loaded key in an Authorization bearer header; it also sends model conversation content.
AI rationale
The source supports a conditional credential-exposure warning because a separately sourced DeepSeek key can be sent to an unrestricted configured endpoint. The default is service-aligned and no package-controlled recipient or malicious intent was established.
Evidence
qq/index.js
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The QQ model key is loaded from configuration, the environment, or a local key file.
- The QQ model endpoint can be configured without a host restriction; its default is DeepSeek.
- Model requests send the loaded key as a bearer credential along with conversation content.
- Model calls occur through QQ proactive and poke reply paths when a key and endpoint are available.
- Bili model requests use the DSH llm stream with a configurable provider and model, sending the prompt as user-role text.
Evidence against
- The configured default endpoint is DeepSeek, consistent with the named DeepSeek API key.
- The source does not establish a fixed package-controlled recipient; exposure depends on the configured endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedindex.jsView file
13L14: import { spawnSync } from 'node:child_process'
L15: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
High
lib/bili.jsView file
7L8: const BASE = 'https://api.bilibili.com'
L9: const VC = 'https://api.vc.bilibili.com'
...
L161: })
L162: const text = await res.text()
L163: if (res.status === 412 || res.status === 429) {
...
L191: }
L192: const qs = new URLSearchParams(query).toString()
L193: const url = qs ? `${BASE}${path}?${qs}` : `${BASE}${path}`
Low
qq/index.jsView file
5
Findings
2 Critical2 High3 Medium5 Low
CriticalDownload Executeqq/index.js
CriticalTrigger Reachable Dangerous Capabilityqq/index.js
HighChild Processindex.js
HighSemantic Analysis Limitedbili/index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptolib/bili.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to dsh-versatileds-plugin@0.3.1.
See all versions of dsh-versatileds-plugin for other recorded verdicts.
- Review the evidence and your use of dsh-versatileds-plugin@0.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.