dsh-versatileds@0.3.7
多功能DS插件：B站 小号代理与 QQ 代理合体，左侧栏一个入口，B站 / QQ 两个模块分页配置；QQ 侧支持本地 GPT-SoVITS 语音（可一键部署），各项组件仅供学习和个人使用、禁止商用
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package’s default runtime behavior makes publisher-selected comments on a user’s authenticated account without a per-action request. This is a concrete unrequested account action, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Applying the plugin starts the Bilibili automation; the timer begins browsing after a delay and repeats periodically.
Impact
Comments are published under the user's Bilibili account without explicit consent for each target or comment.
Mechanism
The automation selects recommendation videos matching configured topics, drafts comments, disables dry-run mode, and posts them through the authenticated reply endpoint without a per-action user request.
Attack narrative
On plugin startup, the Bilibili module starts a periodic browsing task. Browsing and auto-commenting default to enabled. The task selects videos matching configured topics, asks a model to draft comments, then explicitly bypasses dry-run protection and submits them to Bilibili using the configured account session. The code does not require a user request for each comment.
AI rationale
The package’s default runtime behavior makes publisher-selected comments on a user’s authenticated account without a per-action request. This is a concrete unrequested account action, so the package should be blocked.
Evidence
package.jsonindex.jsbili/index.jslib/bili.js
Network endpoints1
api.bilibili.com/x/v2/reply/add
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest selects index.js, which applies the Bilibili module during plugin startup.
- Bilibili automation starts on apply; automatic browsing and commenting are enabled by default, and a timer runs it periodically.
- The automatic flow selects videos matching package-configured topics and generates comments without a per-comment user request.
- For qualifying videos, the code disables dry-run mode and calls the comment function with its dry-run bypass enabled.
- The comment function posts to Bilibili’s reply endpoint using the configured session cookies and CSRF token.
Evidence against
- Comments are limited by topic matching and rate guards, and the settings can disable automatic browsing or commenting; these are opt-outs, while both features are enabled by default.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
8 flaggedindex.jsView file
13L14: import { spawnSync } from 'node:child_process'
L15: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
High
lib/bili.jsView file
7L8: const BASE = 'https://api.bilibili.com'
L9: const VC = 'https://api.vc.bilibili.com'
...
L161: })
L162: const text = await res.text()
L163: if (res.status === 412 || res.status === 429) {
...
L191: }
L192: const qs = new URLSearchParams(query).toString()
L193: const url = qs ? `${BASE}${path}?${qs}` : `${BASE}${path}`
Low
qq/index.jsView file
5* 1. 注册 `versatileds_qq` 工具，手动收发消息、查好友/群/历史。
L6: * 2. 后台连 NapCat 的 WebSocket，按配置自动回复。回复优先走 DeepSeek API，
L7: * 没有 key 时回退到固定短句池。
...
L17:
L18: import { spawn, spawnSync } from 'node:child_process'
L19: import http from 'node:http'
...
L30: const ACTIONS = [
L31: 'status', 'friends', 'groups', 'history', 'send_private', 'send_group', 'share_video', 'voice',
L32: 'proactive_status', 'group_rules', 'live_status', 'balance',
...
L561: function dshHome() {
L562: return process.env.DSH_HOME || join(homedir(), '.dsh')
L563: }
Findings
2 Critical5 High3 Medium5 Low
CriticalDownload Executeqq/index.js
CriticalTrigger Reachable Dangerous Capabilityqq/index.js
HighChild Processindex.js
HighSemantic Analysis Limitedbili/index.js#virtual:normalized:round1
HighKnown Malware Source Similarityqq/deploy-gsv.mjs
HighKnown Malware Source Similarityqq/index.js
HighKnown Malware Source Similaritylib/live.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptolib/bili.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-versatileds@0.3.7.
See all versions of dsh-versatileds for other recorded verdicts.
- Avoid installing dsh-versatileds@0.3.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.