registry / Credential exfiltration / dsh-watch-ears
dsh-watch-ears
Hearing for DSH: capture system audio and the microphone, transcribe both with a resident listener so a text-only model can listen continuously.
This report shows the evidence for dsh-watch-ears@0.1.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package reads a provider credential from Modlens and can send it to BigModel when the provider has no explicit base URL. This is credential exfiltration to a service outside the credential’s configured provider.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A transcription request uses the default auto backend when local transcription is unavailable, or cloud mode is configured.
Impact
A credential intended for the configured provider may be disclosed to another service; recorded speech is also uploaded there.
Mechanism
The package reads the selected Modlens provider key, defaults a missing provider baseUrl to BigModel, then sends the key as a Bearer token with the audio transcription request.
Attack narrative
The package imports the selected API key from ~/.modlens/config.json, whose default provider is openai. When that provider has no baseUrl, it assigns the key to the BigModel endpoint. Cloud transcription then sends the key as a Bearer token alongside recorded audio. The default auto backend uses cloud transcription when local transcription is unavailable, so a normal transcription request can disclose a credential to a different service.
AI rationale
The package reads a provider credential from Modlens and can send it to BigModel when the provider has no explicit base URL. This is credential exfiltration to a service outside the credential’s configured provider.
Evidence
lib/shared.mjslib/asr.mjs~/.modlens/config.json~/.dsh-watch-ears/config.json
Network endpoints1
open.bigmodel.cn/api/paas/v4/audio/transcriptions
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package reads the selected provider API key from ~/.modlens/config.json, defaulting to the provider named openai.
- If that provider has no baseUrl, the package assigns the key to the BigModel API base URL.
- Cloud transcription uploads recorded audio and sends cfg.asr.apiKey as a Bearer token to the configured transcription endpoint.
- With the default auto backend, the package selects cloud transcription when local transcription is unavailable.
Evidence against
- Cloud speech transcription and audio uploads are part of the package’s stated purpose.
- When local transcription is available under the auto backend, the audio stays local.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
12 flaggedbin/companion.mjsView file
4// watcher sees is already live.
L5: import { execFile } from 'node:child_process'
L6: import { fileURLToPath } from 'node:url'
High
4// watcher sees is already live.
L5: import { execFile } from 'node:child_process'
L6: import { fileURLToPath } from 'node:url'
...
L12:
L13: const B = 'http://127.0.0.1:37713'
L14: const E = 'http://127.0.0.1:37712'
...
L17: const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
L18: const line = (k, v) => process.stdout.write(String(k).padEnd(13) + v + '\n')
L19:
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/companion.mjsView on unpkg · L44Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/companion.mjs
L4: // watcher sees is already live.
L5: import { execFile } from 'node:child_process'
L6: import { fileURLToPath } from 'node:url'
...
L12:
L13: const B = 'http://127.0.0.1:37713'
L14: const E = 'http://127.0.0.1:37712'
...
L17: const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
L18: const line = (k, v) => process.stdout.write(String(k).padEnd(13) + v + '\n')
L19:
Findings
10 High5 Medium3 Low
HighChild Processbin/companion.mjs
HighCommand Output Exfiltrationbin/companion.mjs
HighCross File Remote Execution Contextlib/client.mjs
HighTrigger Reachable Command Output Exfiltrationbin/companion.mjs
HighSemantic Analysis Limitedlib/push.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritylib/asr.mjs
HighKnown Malware Source Similaritybin/companion.mjs
HighKnown Malware Source Similaritylib/client.mjs
HighKnown Malware Source Similaritylib/ocr.mjs
HighKnown Malware Source Fingerprint Signaturelib/asr.mjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to dsh-watch-ears@0.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing dsh-watch-ears@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.