registry / koishi-plugin-smmcat-yeyechat / 0.1.46
koishi-plugin-smmcat-yeyechat@0.1.46
名为【夜夜酱】的聊天系统
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source matches a Koishi chatbot plugin: it sends chat data to configured AI services and provides optional media features. No install-time behavior or unauthorized account action was identified.
Static reason
No blocking static signals were detected.
Trigger
Koishi plugin setup registers handlers; API requests occur when enabled groups trigger chat or when optional image and speech features are used.
Impact
Expected plugin behavior; no attack impact identified.
Mechanism
Requests use configured provider URLs and credentials. The source shows no install hook or publisher-selected account target.
AI rationale
The source matches a Koishi chatbot plugin: it sends chat data to configured AI services and provides optional media features. No install-time behavior or unauthorized account action was identified.
Evidence
package.jsonlib/index.js
Network endpoints4
wxls.cc.cdapi.deepseek.comcp.compshare.cn182.92.130.139:3060
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Koishi chat plugin and has no lifecycle scripts.
- Chat requests send messages and an Authorization header to the configured API base URL.
- Vision credentials default to empty; image recognition requires a configured token and model.
- New groups are disabled by default, and pending replies stop unless the group is enabled.
- Mute actions check the current speaker’s identity and admin permissions.
Evidence against
- The package makes network requests for chat, image recognition, and optional speech features.
- The model can invoke group moderation tools, but the code applies identity and permission checks.
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
1{
"name": "koishi-plugin-smmcat-yeyechat",
"description": "名为【夜夜酱】的聊天系统",
"version": "0.1.46",
"main": "lib/index.js",
"typings": "lib/index.d.ts",
"files": [
"lib",
"dist"
],
"license": "MIT",
"keywords": [
"chatbot",
"koishi",
"plugin"
],
"peerDependencies": {
"koishi": "^4.18.7"
}
}
Low
Suspicious Lifecycle Evidence
The manifest describes a Koishi chat plugin and has no lifecycle scripts.
package.jsonView on unpkg · L1lib/index.jsView file
2859const post = /* @__PURE__ */ __name((messages, extra = {}) => ctx.http.post(`${resolveApiBase(config.baseUrl)}/chat/completions`, {
model: config.model,
messages,
max_tokens: 2048,
stream: false,
...extra
}, { headers: { Authorization: authHeader(co
Medium
Stripped Provenance Metadata
Chat requests send messages and an Authorization header to the configured API base URL.
lib/index.jsView on unpkg · L28592828
Findings
2 Medium7 Low
MediumNetwork
MediumStripped Provenance Metadatalib/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
Affected versions and remediation
This report applies to koishi-plugin-smmcat-yeyechat@0.1.46.
See all versions of koishi-plugin-smmcat-yeyechat for other recorded verdicts.
- Review the evidence and your use of koishi-plugin-smmcat-yeyechat@0.1.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.