registry / dsh-volcengine-provider / 0.2.9
dsh-volcengine-provider@0.2.9
⚠ Under review火山方舟 Agent Plan 与 Coding Plan：OAuth 登录、账号、模型与额度管理。
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe JavaScript flow limits the bridge to user-started OAuth login and documents a loopback-only handoff for the official login URL. However, the bundled Windows executable is invoked in that flow and static analysis could not inspect it, so manual review is needed to establish its behavior.
Static reason
No blocking static signals were detected.
Trigger
A user starts the provider's OAuth login flow.
Impact
Whether the binary handles OAuth callback parameters safely cannot be established from the available source.
Mechanism
The login subprocess resolves the bundled rundll32.exe from its PATH. Package documentation says it forwards an official login URL to a loopback endpoint, but the binary could not be analyzed.
AI rationale
The JavaScript flow limits the bridge to user-started OAuth login and documents a loopback-only handoff for the official login URL. However, the bundled Windows executable is invoked in that flow and static analysis could not inspect it, so manual review is needed to establish its behavior.
Evidence
lib/browser-bridge/win32/rundll32.exelib/browser-bridge.mjslib/oauth.mjs
Network endpoints2
ark.volcengine.com127.0.0.1
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The bundled Windows bridge is 5,632 bytes, and its static artifact analysis failed, leaving its behavior unreadable.
- The bridge is placed on the login subprocess PATH for the official broker login flow.
- Package documentation describes the bridge as forwarding the official login URL to a loopback endpoint, but that description does not verify the binary's behavior.
Evidence against
- The bridge runs only as part of a user-started login flow.
- The visible bridge code validates the login URL and restricts IPC to 127.0.0.1.
- No install lifecycle scripts or automatic login trigger are declared.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedlib/browser-bridge/win32/rundll32.exeView file
•path = lib/browser-bridge/win32/rundll32.exe
kind = native_binary
sizeBytes = 5632
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
lib/browser-bridge/win32/rundll32.exeView on unpkgcordis.patch.ymlView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
cordis.patch.ymlView on unpkg.lpm-inspection-8wzOfY/0-cb1531a5c90e.txtView file
Findings
1 High4 Medium7 Low
HighSemantic Analysis Limitedcordis.patch.yml
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarylib/browser-bridge/win32/rundll32.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidence.lpm-inspection-8wzOfY/0-cb1531a5c90e.txt
LowAi Review Evidencelib/oauth.mjs
LowAi Review Evidencedocs/arkcli-contract.md
Affected versions and remediation
This report applies to dsh-volcengine-provider@0.2.9.
See all versions of dsh-volcengine-provider for other recorded verdicts.
- Review the evidence and your use of dsh-volcengine-provider@0.2.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.