iobroker.plenticore-g3@1.0.2
Adapter to communicate with a KOSTAL Plenticore Plus via local network (non-modbus)
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged bidi-control finding was not confirmed; the observed zero-width characters are ordinary UI placeholders. The admin bundle does contain runtime Sentry reporting with a system UUID and settings-based opt-outs, which is an undocumented telemetry risk, so downgrade to warn.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Opening or using the adapter’s admin interface while reporting is enabled.
Impact
Runtime error telemetry may link reports to an ioBroker installation; the package documentation does not explain this reporting behavior.
Mechanism
The admin component initializes Sentry with a configured DSN and may associate the report with the system UUID; checks allow reporting to be disabled through ioBroker settings.
AI rationale
The flagged bidi-control finding was not confirmed; the observed zero-width characters are ordinary UI placeholders. The admin bundle does contain runtime Sentry reporting with a system UUID and settings-based opt-outs, which is an undocumented telemetry risk, so downgrade to warn.
Evidence
admin/assets/index-B_jzxXoS.jsadmin/assets/vendor-gui-components-Dxj_jrY3.js
Network endpoints2
yyy@sentry.iobroker.net/xxuser-configured inverter host and port at /api/v1/{endpoint}
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The admin bundle configures Sentry reporting to sentry.iobroker.net.
- The shared admin component can initialize Sentry and attach the ioBroker system UUID when reporting is enabled.
- The adapter sends inverter API requests to the host and port configured by the user.
- The manifest has no install or lifecycle scripts.
Evidence against
- The package is an ioBroker adapter for reading and writing a user-configured KOSTAL inverter.
- The adapter’s API calls target the configured inverter host; no unrelated credential destination was identified.
- The Sentry reporting code has opt-out checks for plugin settings, system diagnostics, and data reporting.
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedadmin/assets/vendor-gui-components-Dxj_jrY3.jsView file
201contains invisible/control Unicode U+200B (zero width space)
`,SC=e=>{let{classes:t,variant:n,color:r}=e;return W({root:[`root`,`color${Y(r)}`,n],dashed:[`dashed`],bar1:[`bar`,`bar1`],bar2:[`bar`,`bar2`,n===`buffer`&&`color${Y(r)}`]},pC,t)},CC=(e,t)=>e.vars?e.vars.palette.LinearProgress[`${t}Bg
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
admin/assets/vendor-gui-components-Dxj_jrY3.jsView on unpkg · L201609disableDataReporting&&window.location.host!==`localhost:3000`;!this.sentryStarted&&this.sentryDSN&&r&&(this.sentryStarted=!0,G_({dsn:this.sentryDSN,release:`iobroker.${n.common.name}@${n.common.version}`,integrations:[fh()]}),console.log(`Sentry initialized`)),!this.sentryInited&&r&&(this.sentryInited=!0,t=this.socket.getObject(`system.meta.uuid`).then(e=>{e&&e.native&&e.native.uuid&&ld().setUser({id:e.native.uuid})})),t=t ins
Medium
Ai Review Evidence
The shared admin component can initialize Sentry and attach the ioBroker system UUID when reporting is enabled.
admin/assets/vendor-gui-components-Dxj_jrY3.jsView on unpkg · L609Findings
1 Critical6 Medium4 Low
CriticalTrojan Source Unicodeadmin/assets/vendor-gui-components-Dxj_jrY3.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceadmin/assets/index-B_jzxXoS.js
MediumAi Review Evidenceadmin/assets/vendor-gui-components-Dxj_jrY3.js
MediumAi Review Evidencemain.js
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to iobroker.plenticore-g3@1.0.2.
See all versions of iobroker.plenticore-g3 for other recorded verdicts.
- Review the evidence and your use of iobroker.plenticore-g3@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.