registry / koishi-plugin-mai-bridge / 0.1.15

koishi-plugin-mai-bridge@0.1.15

将 maibot 作为 docker 托管的消息回复后端运行，使用 mai.ko 桥接消息收发。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 51 file(s), 289 KB of source, external domains: github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 11-51json

11 "type": "git",

12 "url": "git+https://github.com/Jelly10086/mai-bridge.git"

13 },

14 "bugs": {

15 "url": "https://github.com/Jelly10086/mai-bridge/issues"

16 },

17 "type": "commonjs",

18 "main": "out/index.js",

19 "typings": "out/index.d.ts",

20 "files": [

21 "out",

22 "dist",

23 "client",

24 "src",

25 "patches",

26 "deploy",

27 "scripts"

28 ],

29 "scripts": {

30 "build": "tsc -p tsconfig.json && koishi-console build",

31 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "mocha -r ts-node/register tests/**/*.spec.ts"

33 },

34 "keywords": [

35 "koishi",

36 "plugin",

37 "category:ai",

38 "maimai",

39 "mai.ko",

40 "chatbot",

41 "ai",

42 "llm"

43 ],

44 "license": "GPL-3.0-or-later",

45 "koishi": {

46 "category": "ai",

47 "description": {

48 "zh": "将 maibot 作为 docker 托管的消息回复后端运行，使用 mai.ko 桥接消息收发。",

49 "en": "Run maibot as a Docker-hosted reply backend and bridge messages through mai.ko."

50 },

51 "service": {

src/bridge/agreements.tsView file

Lines 3-43typescript

3import { join } from 'path'

5export interface AgreementOptions {

6 accept: boolean

7 env?: NodeJS.ProcessEnv

10export

out/bridge/convert.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = koishi-plugin-mai-bridge@0.1.11 matchedIdentity = npm:[redacted]:0.1.11 similarity = 0.843 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/bridge/convert.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/bridge/agreements.tsView file

23const privacyHash = md5(privacy) L24: const currentEnv = options.env || process.env L25: const eulaConfirmed = isAgreementConfirmed(root, 'eula.confirmed', 'EULA_AGREE', eulaHash, currentEnv)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/bridge/agreements.tsView on unpkg · L23

out/bridge/convert.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/bridge/convert.jsView on unpkg

Findings

2 High3 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltaout/bridge/convert.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/bridge/agreements.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

4 flagged

package.jsonView file

Lines 11-51json

11 "type": "git",

12 "url": "git+https://github.com/Jelly10086/mai-bridge.git"

13 },

14 "bugs": {

15 "url": "https://github.com/Jelly10086/mai-bridge/issues"

16 },

17 "type": "commonjs",

18 "main": "out/index.js",

19 "typings": "out/index.d.ts",

20 "files": [

21 "out",

22 "dist",

23 "client",

24 "src",

25 "patches",

26 "deploy",

27 "scripts"

28 ],

29 "scripts": {

30 "build": "tsc -p tsconfig.json && koishi-console build",

31 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "mocha -r ts-node/register tests/**/*.spec.ts"

33 },

34 "keywords": [

35 "koishi",

36 "plugin",

37 "category:ai",

38 "maimai",

39 "mai.ko",

40 "chatbot",

41 "ai",

42 "llm"

43 ],

44 "license": "GPL-3.0-or-later",

45 "koishi": {

46 "category": "ai",

47 "description": {

48 "zh": "将 maibot 作为 docker 托管的消息回复后端运行，使用 mai.ko 桥接消息收发。",

49 "en": "Run maibot as a Docker-hosted reply backend and bridge messages through mai.ko."

50 },

51 "service": {

src/bridge/agreements.tsView file

Lines 3-43typescript

3import { join } from 'path'

5export interface AgreementOptions {

6 accept: boolean

7 env?: NodeJS.ProcessEnv

10export

out/bridge/convert.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/bridge/convert.jsView on unpkg