registry / koishi-plugin-gl-bot / 0.0.21

koishi-plugin-gl-bot@0.0.21

⚠ Under review

GleamSlime Koishi Rebot Plugins

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 523 KB of source, external domains: 192.168.3.1, blog.iin0.cn, cn.club.vmall.com

Source & flagged code

3 flagged

lib/utils/cat_enc.jsView file

Lines 7897-7937javascript

7897 // internal this.pass shall be CryptoJS DWord Object for CryptoJS bug

7898 // work around. CrytoJS HMac password can be passed by

7899 // raw string as described in the manual however it doesn't

7900 // work properly in some case. If password was passed

7901 // by CryptoJS DWord which is not described in the manual

7902 // it seems to work. (fixed since crypto 1.1.7)

7903 if (typeof pass == 'string') {

7904 var hPass = pass;

7905 if (pass.length % 2 == 1 || !pass.match(/^[0-9A-Fa-f]+$/)) {

7906 // raw str

7907 hPass = rstrtohex(pass);

7908 }

7909 this.pass = exports.CryptoJS.enc.Hex.parse(hPass);

7910 return;

7911 }

7912 if (typeof pass != 'object')

7913 throw 'KJUR.crypto.Mac unsupported password type: ' + pass;

7914 var hPass = null;

7915 if (pass.hex !== undefined) {

7916 if (pass.hex.length % 2 != 0 || !pass.hex.match(/^[0-9A-Fa-f]+$/))

7917 throw 'Mac: wrong hex password: ' + pass.hex;

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/utils/cat_enc.jsView on unpkg · L7917

7918 hPass = pass.hex;

7919 }

7920 if (pass.utf8 !== undefined)

7921 hPass = utf8tohex(pass.utf8);

7922 if (pass.rstr !== undefined)

7923 hPass = rstrtohex(pass.rstr);

7924 if (pass.b64 !== undefined)

7925 hPass = b64tohex(pass.b64);

7926 if (pass.b64u !== undefined)

7927 hPass = b64utohex(pass.b64u);

7928 if (hPass == null)

7929 throw 'KJUR.crypto.Mac unsupported password type: ' + pass;

7930 this.pass = exports.CryptoJS.enc.Hex.parse(hPass);

7931 };

7932 if (params !== undefined) {

7933 if (params.pass !== undefined) {

7934 this.setPassword(params.pass);

7935 }

7936 if (params.alg !== undefined) {

7937 this.algName = params.alg;

lib/mcsManager/json/createInstanceUpload.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/mcsManager/json/createInstanceUpload.jsonView on unpkg

lib/mcsManager/api.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = koishi-plugin-gl-bot@0.0.23 matchedIdentity = npm:a29pc2hpLXBsdWdpbi1nbC1ib3Q:0.0.23 similarity = 0.870 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/mcsManager/api.jsView on unpkg

Source & flagged code

3 flagged · loading source

lib/utils/cat_enc.jsView file

7917patternName = generic_password severity = medium line = 7917

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/utils/cat_enc.jsView on unpkg · L7917

lib/mcsManager/json/createInstanceUpload.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/mcsManager/json/createInstanceUpload.jsonView on unpkg

lib/mcsManager/api.jsView file

Findings

2 High3 Medium4 Low

HighSemantic Analysis Limitedlib/mcsManager/json/createInstanceUpload.json

HighPrevious Version Dangerous Deltalib/mcsManager/api.js

MediumSecret Patternlib/utils/cat_enc.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to koishi-plugin-gl-bot@0.0.21.

See all versions of koishi-plugin-gl-bot for other recorded verdicts.

Review the evidence and your use of koishi-plugin-gl-bot@0.0.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 13:26:11.843Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.