registry / koishi-plugin-smmcat-yeyechat / 0.1.27
koishi-plugin-smmcat-yeyechat@0.1.27
名为【夜夜酱】的聊天系统
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest contains no lifecycle hooks, and the cited runtime behavior is consistent with a chatbot plugin that uses configured AI services. Inspection found no concrete attack surface supporting a warning or block.
Static reason
No blocking static signals were detected.
Trigger
The plugin runs in Koishi; chat requests occur through its chatbot behavior.
Impact
No concrete harmful effect or unauthorized credential transfer was established.
Mechanism
The inspected runtime formats stored memories and sends chat requests using configured endpoint and authorization settings.
AI rationale
The manifest contains no lifecycle hooks, and the cited runtime behavior is consistent with a chatbot plugin that uses configured AI services. Inspection found no concrete attack surface supporting a warning or block.
Evidence
package.jsonlib/index.js
Network endpoints3
api.deepseek.comwxls.cc.cdcp.compshare.cn
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no lifecycle scripts and points to lib/index.js as its runtime entrypoint.
- The cited runtime code formats stored relationship and memory data, adjusts bot configuration on readiness, and initializes chat behavior.
- Chat requests use the configured API base URL and configured authorization value; the inspected code shows no unrelated credential recipient or concrete attack behavior.
Evidence against
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
1{
"name": "koishi-plugin-smmcat-yeyechat",
"description": "名为【夜夜酱】的聊天系统",
"version": "0.1.27",
"main": "lib/index.js",
"typings": "lib/index.d.ts",
"files": [
"lib",
"dist"
]
Low
Suspicious Lifecycle Evidence
The manifest has no lifecycle scripts and points to lib/index.js as its runtime entrypoint.
package.jsonView on unpkg · L1lib/index.jsView file
2268function createReplyEngine(ctx, config) {
const logger = ctx.logger(name);
const post = /* @__PURE__ */ __name((messages, extra = {}) => ctx.http.post(`${resolveApiBase(config.baseUrl)}/chat/completions`, {
model: config.model,
messages,
max_tokens: 2048,
stream: false,
...extra
}, { headers: { Authorization: authHeader(config) } }), "post");
const composeReply = /* @__
Medium
Stripped Provenance Metadata
Chat requests use the configured API base URL and configured authorization value; the inspected code shows no unrelated credential recipient or concrete attack behavior.
lib/index.jsView on unpkg · L2268Findings
2 Medium8 Low
MediumNetwork
MediumStripped Provenance Metadatalib/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
Affected versions and remediation
This report applies to koishi-plugin-smmcat-yeyechat@0.1.27.
See all versions of koishi-plugin-smmcat-yeyechat for other recorded verdicts.
- Review the evidence and your use of koishi-plugin-smmcat-yeyechat@0.1.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.