registry / koishi-plugin-gl-bot / 0.0.23

koishi-plugin-gl-bot@0.0.23

GleamSlime Koishi Rebot Plugins

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 528 KB of source, external domains: 192.168.3.1, blog.iin0.cn, cn.club.vmall.com

Source & flagged code

2 flagged

lib/utils/cat_enc.jsView file

Lines 7897-7937javascript

7897 // internal this.pass shall be CryptoJS DWord Object for CryptoJS bug

7898 // work around. CrytoJS HMac password can be passed by

7899 // raw string as described in the manual however it doesn't

7900 // work properly in some case. If password was passed

7901 // by CryptoJS DWord which is not described in the manual

7902 // it seems to work. (fixed since crypto 1.1.7)

7903 if (typeof pass == 'string') {

7904 var hPass = pass;

7905 if (pass.length % 2 == 1 || !pass.match(/^[0-9A-Fa-f]+$/)) {

7906 // raw str

7907 hPass = rstrtohex(pass);

7908 }

7909 this.pass = exports.CryptoJS.enc.Hex.parse(hPass);

7910 return;

7911 }

7912 if (typeof pass != 'object')

7913 throw 'KJUR.crypto.Mac unsupported password type: ' + pass;

7914 var hPass = null;

7915 if (pass.hex !== undefined) {

7916 if (pass.hex.length % 2 != 0 || !pass.hex.match(/^[0-9A-Fa-f]+$/))

7917 throw 'Mac: wrong hex password: ' + pass.hex;

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/utils/cat_enc.jsView on unpkg · L7917

7918 hPass = pass.hex;

7919 }

7920 if (pass.utf8 !== undefined)

7921 hPass = utf8tohex(pass.utf8);

7922 if (pass.rstr !== undefined)

7923 hPass = rstrtohex(pass.rstr);

7924 if (pass.b64 !== undefined)

7925 hPass = b64tohex(pass.b64);

7926 if (pass.b64u !== undefined)

7927 hPass = b64utohex(pass.b64u);

7928 if (hPass == null)

7929 throw 'KJUR.crypto.Mac unsupported password type: ' + pass;

7930 this.pass = exports.CryptoJS.enc.Hex.parse(hPass);

7931 };

7932 if (params !== undefined) {

7933 if (params.pass !== undefined) {

7934 this.setPassword(params.pass);

7935 }

7936 if (params.alg !== undefined) {

7937 this.algName = params.alg;

lib/mcsManager/json/createInstanceUpload.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/mcsManager/json/createInstanceUpload.jsonView on unpkg

Source & flagged code

2 flagged · loading source

lib/utils/cat_enc.jsView file

7917patternName = generic_password severity = medium line = 7917

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/utils/cat_enc.jsView on unpkg · L7917

lib/mcsManager/json/createInstanceUpload.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/mcsManager/json/createInstanceUpload.jsonView on unpkg

Findings

1 High3 Medium4 Low

HighSemantic Analysis Limitedlib/mcsManager/json/createInstanceUpload.json

MediumSecret Patternlib/utils/cat_enc.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to koishi-plugin-gl-bot@0.0.23.

See all versions of koishi-plugin-gl-bot for other recorded verdicts.

Review the evidence and your use of koishi-plugin-gl-bot@0.0.23 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 03:24:45.276Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.