dsh-versatileds@0.3.6
多功能DS插件：B站 小号代理与 QQ 代理合体，左侧栏一个入口，B站 / QQ 两个模块分页配置；QQ 侧支持本地 GPT-SoVITS 语音（可一键部署），各项组件仅供学习和个人使用、禁止商用
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source supports a warning because a saved model credential is sent to an unrestricted configurable endpoint. Its default is the intended DeepSeek service, and no source fact establishes a publisher-selected unrelated recipient or a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Proactive generation or a poke response runs with a key and endpoint configured.
Impact
A configured third-party endpoint could receive the API key and prompt content. The source does not establish that an unrelated endpoint is selected by default.
Mechanism
The request uses the configured endpoint and places the loaded key in a Bearer authorization header; the source does not restrict the endpoint to the default host.
AI rationale
The source supports a warning because a saved model credential is sent to an unrestricted configurable endpoint. Its default is the intended DeepSeek service, and no source fact establishes a publisher-selected unrelated recipient or a concrete attack.
Evidence
qq/index.js
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The model endpoint defaults to api.deepseek.com but can be configured to another OpenAI-compatible address.
- The key loader reads a configured key, DEEPSEEK_API_KEY, or a file; proactive and poke generation send it as a Bearer credential to the configured endpoint when both key and endpoint are present.
- The unresolved Bilibili model call passes recommendation candidates to the configured model stream; the inspected code does not establish an unrelated account action.
Evidence against
- The default endpoint matches the package’s stated DeepSeek API-key purpose, and the inspected source does not show a hidden default recipient for that key.
- package.json declares no lifecycle scripts; the model request is part of runtime generation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedindex.jsView file
13L14: import { spawnSync } from 'node:child_process'
L15: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
High
lib/bili.jsView file
7L8: const BASE = 'https://api.bilibili.com'
L9: const VC = 'https://api.vc.bilibili.com'
...
L161: })
L162: const text = await res.text()
L163: if (res.status === 412 || res.status === 429) {
...
L191: }
L192: const qs = new URLSearchParams(query).toString()
L193: const url = qs ? `${BASE}${path}?${qs}` : `${BASE}${path}`
Low
qq/index.jsView file
5* 1. 注册 `versatileds_qq` 工具，手动收发消息、查好友/群/历史。
L6: * 2. 后台连 NapCat 的 WebSocket，按配置自动回复。回复优先走 DeepSeek API，
L7: * 没有 key 时回退到固定短句池。
...
L17:
L18: import { spawn, spawnSync } from 'node:child_process'
L19: import http from 'node:http'
...
L30: const ACTIONS = [
L31: 'status', 'friends', 'groups', 'history', 'send_private', 'send_group', 'share_video', 'voice',
L32: 'proactive_status', 'group_rules', 'live_status', 'balance',
...
L561: function dshHome() {
L562: return process.env.DSH_HOME || join(homedir(), '.dsh')
L563: }
Findings
2 Critical5 High3 Medium5 Low
CriticalDownload Executeqq/index.js
CriticalTrigger Reachable Dangerous Capabilityqq/index.js
HighChild Processindex.js
HighSemantic Analysis Limitedbili/index.js#virtual:normalized:round1
HighKnown Malware Source Similarityqq/deploy-gsv.mjs
HighKnown Malware Source Similarityqq/index.js
HighKnown Malware Source Similaritylib/live.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptolib/bili.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-versatileds@0.3.6.
See all versions of dsh-versatileds for other recorded verdicts.
- Review the evidence and your use of dsh-versatileds@0.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.