registry / Credential exfiltration / koishi-plugin-smmcat-yeyechat
koishi-plugin-smmcat-yeyechat
名为【夜夜酱】的聊天系统
This report shows the evidence for koishi-plugin-smmcat-yeyechat@0.1.48. 1 of 42 known versions is blocked or flagged. The newest version, 0.1.51, is allowed. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe plugin sends a configured Gemini vision token to the unrelated default host `wxls.cc.cd` during automatic image recognition. Because the host is package-selected by default rather than explicitly set by the user for that service, this is credential exfiltration.
Static reason
No blocking static signals were detected.
Trigger
A configured vision token and model, followed by a message containing an image.
Impact
The endpoint receives the configured vision API credential and image content; that credential could be used to access its associated service.
Mechanism
The plugin uses the token as an Authorization bearer header for a request to the configured vision API base URL, which defaults to wxls.cc.cd.
Attack narrative
When a message includes images, the plugin invokes image recognition if a vision token and model are configured. It sends the token in an Authorization header to the vision base URL, which defaults to wxls.cc.cd even though the token setting is described as a Gemini vision API token. This exposes the configured credential to that third-party endpoint.
AI rationale
The plugin sends a configured Gemini vision token to the unrelated default host `wxls.cc.cd` during automatic image recognition. Because the host is package-selected by default rather than explicitly set by the user for that service, this is credential exfiltration.
Evidence
lib/index.js
Network endpoints1
wxls.cc.cd
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The image recognition request sends `config.visionToken` as an Authorization bearer credential to the configured endpoint.
- The default vision endpoint is `https://wxls.cc.cd`, while the token is described as a Gemini vision API token.
- Incoming messages containing images automatically invoke image recognition; it runs when a vision token and model are configured.
Evidence against
- The package has no lifecycle scripts; its entry point is the Koishi plugin `lib/index.js`.
- The vision token defaults to empty, so this credential flow requires configuration.
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedlib/index.jsView file
2828据目录，留空关闭保存）"),
visionBaseUrl: import_koishi4.Schema.string().default("https://wxls.cc.cd").description("Gemini 视觉接口基地址（OpenAI 协议，留空则关闭图片识别）"),
visionToken: import_koishi4.Schema.string().default("").description("Gemini 视觉接口令牌"),
visionModel: import_koishi4.Schema.string().default("gemini-2.0-flash").description("Gemini 视觉模型名
High
Ai Review Evidence
The default vision endpoint is `https://wxls.cc.cd`, while the token is described as a Gemini vision API token.
lib/index.jsView on unpkg · L2828116existing;
const task = callGemini(ctx, config, dataUri).finally(() => inFlightVision.delete(md5));
inFlightVision.set(md5, task);
return task;
}
__name(recognizeOnce, "recognizeOnce");
async function describeImages(ctx, config, urls, storage) {
if (!urls.length) return [];
if (!config.visionBaseUrl || !config.visionToken || !config.visionModel) {
return urls.map((url) => ({ description: "", md5: "", url }));
}
const logger = ctx.logger("smmcat-yeyechat");
const downloads = await Promise.all(url
High
Ai Review Evidence
Incoming messages containing images automatically invoke image recognition; it runs when a vision token and model are configured.
lib/index.jsView on unpkg · L1163780if (message.images.length) {
void saveImages(ctx, config.imageSavePath, message.images).catch((e) => logger.warn("图片保存失败：", e));
const task = (async () => {
const visions = await des
Findings
3 High3 Medium3 Low
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/index.js
MediumNetwork
MediumStripped Provenance Metadatalib/index.js
MediumStripped Provenance Metadatalib/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to koishi-plugin-smmcat-yeyechat@0.1.48.
The versions list below shows the verdict for each recorded version.
- Avoid installing koishi-plugin-smmcat-yeyechat@0.1.48. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.