registry / iobroker.anker-solix / 0.10.78

iobroker.anker-solix@0.10.78

ioBroker adapter for Anker Solix (based on ha-anker-solix)

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 203 KB of source, external domains: bootstrap.pypa.io

Source & flagged code

6 flagged

python/solixapi/session.pyView file

Lines 900-940python

900 else:

901 masked_filename = filename

902 try:

903 await aiofiles.os.remove(masked_filename)

904 self._logger.debug("Remove modified JSON file %s:", masked_filename)

905 except OSError as err:

906 self._logger.error(

907 "ERROR: Failed to remove modified JSON file %s\n%s",

908 masked_filename,

909 err,

910 )

911 return False

912 return True

913

914 async def get_mqtt_info(self) -> dict:

915 r"""Get the Anker MQTT server info with account certificates from session.

916

917 Example data:

918 {"user_id": "1541fc0a3db5a23e3c4ee27c6ed0616444e1ab8c","app_name": "anker_power","thing_name": "1541fc0a3db5a23e3c4ee27c6ed0616444e1ab8c-anker_power",

919 "certificate_id": "36167916173028037311485710012973829433","certificate_pem": "-----BEGIN CERTIFICATE-----\n<base64Cert>\n-----END CERTIFICATE-----\n",

920 "private_key": "-----BEGIN RSA PRIVATE KEY-----\n<base64Key>\n-----END RSA PRIVATE KEY-----\n","public_key": "",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

python/solixapi/session.pyView on unpkg · L920

Critical

Secret Pattern

RSA private key in python/solixapi/session.py

python/solixapi/session.pyView on unpkg · L920

921 "endpoint_addr": "aiot-mqtt-eu.anker.com","aws_root_ca1_pem": "-----BEGIN CERTIFICATE-----\n<base64Cert>\n-----END CERTIFICATE-----",

922 "origin": "","pkcs12": "<base64pkcs12Data>"}

923 """

924 return (await self.request("post", API_ENDPOINTS["get_mqtt_info"])).get(

925 "data"

926 ) or {}

927

928 def get_login_info(self, key: str) -> Any | None:

929 """Get a certain key from authenticated client login info."""

930 return self._login_response.get(key)

931

932

933class AnkerEncryptionHandler:

934 """Anker Solix encryption handler class.

935

936 ATTENTION: This class is experimental and does not work yet since various x header field value generation is unknown.

937 """

938

939 def __init__(

940 self,

tools/pythonInstallEnv.jsView file

Lines 1-24javascript

1/**

2 * Detect host environment for Python dependency installation (tools/install-python.js).

3 */

5const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/pythonInstallEnv.jsView on unpkg · L4

7/** @returns {"windows" | "macos" | "linux-server" | "ha-iobroker" | "container"} */

tools/install-python.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * Installs Python deps into python/.venv (preferred) or python/site-packages (fallback).

4 * Profiles: Windows, Linux server, macOS, HA ioBroker add-on, generic container.

5 * npm postinstall: best-effort, never fails npm (exit 0) — use: node tools/install-python.js --soft

6 */

8const { spawnSync } = require("node:child_process");

9const fs

python/battery_power_pick.pyView file

•path = python/battery_power_pick.py kind = build_helper sizeBytes = 10332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/battery_power_pick.pyView on unpkg

build/lib/pythonBridge.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = iobroker.anker-solix@0.10.77 matchedIdentity = npm:aW9icm9rZXIuYW5rZXItc29saXg:0.10.77 similarity = 0.862 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/lib/pythonBridge.jsView on unpkg

Source & flagged code

6 flagged · loading source

python/solixapi/session.pyView file

920patternName = private_key_rsa severity = critical line = 920 matchedText = "private... "",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

python/solixapi/session.pyView on unpkg · L920

920patternName = private_key_rsa severity = critical line = 920 matchedText = "private... "",

Critical

Secret Pattern

RSA private key in python/solixapi/session.py

python/solixapi/session.pyView on unpkg · L920

tools/pythonInstallEnv.jsView file

4L5: const fs = require("node:fs"); L6:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/pythonInstallEnv.jsView on unpkg · L4

tools/install-python.jsView file

7L8: const { spawnSync } = require("node:child_process"); L9: const fs = require("node:fs"); L10: const https = require("node:https"); L11: const path = require("node:path"); ... L15: L16: const adapterRoot = path.join(__dirname, ".."); L17: const requirements = path.join(adapterRoot, "python", "requirements.txt"); ... L51: function venvPython() { L52: if (process.platform === "win32") { L53: return path.join(venvDir, "Scripts", "python.exe"); ... L74: ok: result.status === 0,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

tools/install-python.jsView on unpkg · L7

python/battery_power_pick.pyView file

•path = python/battery_power_pick.py kind = build_helper sizeBytes = 10332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/battery_power_pick.pyView on unpkg

build/lib/pythonBridge.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/lib/pythonBridge.jsView on unpkg

Findings

2 Critical2 High4 Medium4 Low

CriticalCritical Secretpython/solixapi/session.py

CriticalSecret Patternpython/solixapi/session.py

HighSandbox Evasion Gated Capabilitytools/install-python.js

HighPrevious Version Dangerous Deltabuild/lib/pythonBridge.js

MediumDynamic Requiretools/pythonInstallEnv.js

MediumNetwork

MediumShips Build Helperpython/battery_power_pick.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

python/solixapi/session.pyView file

Lines 900-940python

900 else:

901 masked_filename = filename

902 try:

903 await aiofiles.os.remove(masked_filename)

904 self._logger.debug("Remove modified JSON file %s:", masked_filename)

905 except OSError as err:

906 self._logger.error(

907 "ERROR: Failed to remove modified JSON file %s\n%s",

908 masked_filename,

909 err,

910 )

911 return False

912 return True

913

914 async def get_mqtt_info(self) -> dict:

915 r"""Get the Anker MQTT server info with account certificates from session.

916

917 Example data:

918 {"user_id": "1541fc0a3db5a23e3c4ee27c6ed0616444e1ab8c","app_name": "anker_power","thing_name": "1541fc0a3db5a23e3c4ee27c6ed0616444e1ab8c-anker_power",

919 "certificate_id": "36167916173028037311485710012973829433","certificate_pem": "-----BEGIN CERTIFICATE-----\n<base64Cert>\n-----END CERTIFICATE-----\n",

920 "private_key": "-----BEGIN RSA PRIVATE KEY-----\n<base64Key>\n-----END RSA PRIVATE KEY-----\n","public_key": "",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

python/solixapi/session.pyView on unpkg · L920

Critical

Secret Pattern

RSA private key in python/solixapi/session.py

python/solixapi/session.pyView on unpkg · L920

921 "endpoint_addr": "aiot-mqtt-eu.anker.com","aws_root_ca1_pem": "-----BEGIN CERTIFICATE-----\n<base64Cert>\n-----END CERTIFICATE-----",

922 "origin": "","pkcs12": "<base64pkcs12Data>"}

923 """

924 return (await self.request("post", API_ENDPOINTS["get_mqtt_info"])).get(

925 "data"

926 ) or {}

927

928 def get_login_info(self, key: str) -> Any | None:

929 """Get a certain key from authenticated client login info."""

930 return self._login_response.get(key)

931

932

933class AnkerEncryptionHandler:

934 """Anker Solix encryption handler class.

935

936 ATTENTION: This class is experimental and does not work yet since various x header field value generation is unknown.

937 """

938

939 def __init__(

940 self,

tools/pythonInstallEnv.jsView file

Lines 1-24javascript

1/**

2 * Detect host environment for Python dependency installation (tools/install-python.js).

3 */

5const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/pythonInstallEnv.jsView on unpkg · L4

7/** @returns {"windows" | "macos" | "linux-server" | "ha-iobroker" | "container"} */

tools/install-python.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * Installs Python deps into python/.venv (preferred) or python/site-packages (fallback).

4 * Profiles: Windows, Linux server, macOS, HA ioBroker add-on, generic container.

5 * npm postinstall: best-effort, never fails npm (exit 0) — use: node tools/install-python.js --soft

6 */

8const { spawnSync } = require("node:child_process");

9const fs

python/battery_power_pick.pyView file

•path = python/battery_power_pick.py kind = build_helper sizeBytes = 10332 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/battery_power_pick.pyView on unpkg

build/lib/pythonBridge.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/lib/pythonBridge.jsView on unpkg