dsh-watch-ears@0.1.0
Hearing for DSH: capture system audio and the microphone, transcribe both with a resident listener so a text-only model can listen continuously.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically reuses a key from another provider's configuration and can send it to BigModel when the provider base URL is missing. This is credential exfiltration even though audio transcription itself matches the package's purpose.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes hearing or transcription while local ASR is unavailable and the default cloud configuration is used.
Impact
A credential intended for another AI service may be disclosed to BigModel, enabling unauthorized use of that account.
Mechanism
First-run configuration copies the selected Modlens provider's API key; if its baseUrl is absent, the package assigns the BigModel endpoint and sends the key as a Bearer token with an audio transcription request.
Attack narrative
On first use, the package can copy an API key from the active provider in ~/.modlens/config.json. If that provider lacks a baseUrl, it assigns the key to the BigModel endpoint. When cloud ASR is selected, a hearing request uploads recorded audio and sends that key as a Bearer credential, potentially exposing a credential belonging to another service.
AI rationale
The package automatically reuses a key from another provider's configuration and can send it to BigModel when the provider base URL is missing. This is credential exfiltration even though audio transcription itself matches the package's purpose.
Evidence
lib/shared.mjslib/asr.mjslib/daemon.mjs~/.modlens/config.json~/.dsh-watch-ears/config.json~/.dsh-watch-ears/data/audio/*.wav
Network endpoints2
open.bigmodel.cn/api/paas/v4/audio/transcriptionsConfigured asr.baseUrl + /audio/transcriptions
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package reads an API key from the active provider in ~/.modlens/config.json, defaulting to the openai provider.
- When that provider has no baseUrl, the key is paired with https://open.bigmodel.cn/api/paas/v4.
- The default ASR backend is auto and selects cloud when local transcription is unavailable.
- Cloud transcription sends the configured API key as a Bearer credential to the configured baseUrl.
- The cloud transcription request also uploads the recorded WAV audio.
- A hear request records audio and passes it to the transcription function.
Evidence against
- The package is described and implemented as an audio transcription tool, so sending audio to an ASR service is part of its purpose.
- Listening is initiated through an explicit hear or listen command/tool call; no install lifecycle scripts are declared.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
7 flaggedbin/companion.mjsView file
4// watcher sees is already live.
L5: import { execFile } from 'node:child_process'
L6: import { fileURLToPath } from 'node:url'
High
4// watcher sees is already live.
L5: import { execFile } from 'node:child_process'
L6: import { fileURLToPath } from 'node:url'
...
L12:
L13: const B = 'http://127.0.0.1:37713'
L14: const E = 'http://127.0.0.1:37712'
...
L17: const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
L18: const line = (k, v) => process.stdout.write(String(k).padEnd(13) + v + '\n')
L19:
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/companion.mjsView on unpkg · L44Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/companion.mjs
L4: // watcher sees is already live.
L5: import { execFile } from 'node:child_process'
L6: import { fileURLToPath } from 'node:url'
...
L12:
L13: const B = 'http://127.0.0.1:37713'
L14: const E = 'http://127.0.0.1:37712'
...
L17: const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
L18: const line = (k, v) => process.stdout.write(String(k).padEnd(13) + v + '\n')
L19:
Findings
5 High5 Medium3 Low
HighChild Processbin/companion.mjs
HighCommand Output Exfiltrationbin/companion.mjs
HighCross File Remote Execution Contextlib/client.mjs
HighTrigger Reachable Command Output Exfiltrationbin/companion.mjs
HighSemantic Analysis Limitedlib/push.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarylib/net/NAudio.Core.dll
MediumShips Build Helperlib/worker.ps1
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-watch-ears@0.1.0.
See all versions of dsh-watch-ears for other recorded verdicts.
- Avoid installing dsh-watch-ears@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.