registry / Credential exfiltration / koishi-plugin-steam-friend-status-fork

koishi-plugin-steam-friend-status-fork

查询群友steam状态。修改自 `koishi-plugin-steam-friend-status`

This report shows the evidence for koishi-plugin-steam-friend-status-fork@0.3.0. 1 of 2 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

When a direct Steam request fails, the default-enabled fallback sends its full URL, including the configured Steam API key, to a third-party proxy. Startup can initiate these requests without an explicit user command, exposing the credential to the proxy operator.

Static reason

No blocking static signals were detected.

Trigger

A Steam API request fails directly while the default-enabled Apifox fallback is active; startup headshot initialization or polling can initiate requests when Steam users are already bound.

Impact

The proxy operator can obtain the Steam API key and use it to access the associated Steam Web API account.

Mechanism

The key is embedded in the Steam request URL, which is forwarded in the `api-u` header of a POST to the Apifox proxy.

Attack narrative

Steam API calls place the configured API key in the request URL. If a direct call fails, the default-enabled fallback sends that full URL in a header to `web-proxy.apifox.cn`. Startup initializes headshots and schedules an immediate poll, so the fallback can run without a command from the user. The proxy can capture the key and use it against Steam’s API.

AI rationale

Evidence

src/steam.tssrc/fetch.tssrc/index.ts

Network endpoints2

api.steampowered.comweb-proxy.apifox.cn

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Steam API request URLs include the configured API key as a `key` query parameter.
The Apifox proxy fallback is enabled by default; its config description says the request URL is sent to the proxy.
After a direct request fails, the code uses the Apifox fallback when enabled.
The fallback POSTs to `web-proxy.apifox.cn` and places the full target URL in the `api-u` header.
When Koishi is ready, the plugin initializes headshots and schedules an immediate Steam status poll.

Evidence against

The package is a Steam status plugin, and its documented purpose requires requests to Steam’s API.

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 156 KB of source, external domains: api.steampowered.com, cdn.akamai.steamstatic.com, p.qlogo.cn, partner.steamgames.com, q.qlogo.cn, steamcommunity.com, web-proxy.apifox.cn

Source & flagged code

6 flagged

src/steam.tsView file

52const requestUrl = `${getPlayerSummariesUrl(ctx)}?key=${steamApiKey}&steamids=${steamid}`; try { const config =

High

Ai Review Evidence

Steam API request URLs include the configured API key as a `key` query parameter.

src/steam.tsView on unpkg · L52

src/index.tsView file

83useApifoxProxy: Schema.boolean() .default(true) .description( "Steam API 直连失败时使用 APIFOX 公共代理兜底（请求 URL

High

Ai Review Evidence

The Apifox proxy fallback is enabled by default; its config description says the request URL is sent to the proxy.

src/index.tsView on unpkg · L83

224ctx.on("ready", () => { void initHeadshots(ctx, () => disposed).catch((error) => { logger.error("初始化 Steam 头像失败:", error); }); // 启动后立即查询一次，避免 HMR 或重启后空等一个轮询周期 ctx.setTimeout(runPoll, 1000);

Findings

6 High1 Medium3 Low

HighAi Review Evidencesrc/steam.ts

HighAi Review Evidencesrc/index.ts

HighAi Review Evidencesrc/fetch.ts

HighAi Review Evidencesrc/index.ts

HighAi Review Evidencesrc/fetch.ts

MediumNetwork

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to koishi-plugin-steam-friend-status-fork@0.3.0.

The versions list below shows the verdict for each recorded version.

Avoid installing koishi-plugin-steam-friend-status-fork@0.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-29 22:17:47.712Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.3.0latestshownMaliciousCredential ExfiltrationBlockPublishedOct 29, 2026, 5:01 AM 0.2.9Clean—AllowPublishedOct 13, 2026, 10:10 AM

registry / Credential exfiltration / koishi-plugin-steam-friend-status-fork

koishi-plugin-steam-friend-status-fork

查询群友steam状态。修改自 `koishi-plugin-steam-friend-status`

This report shows the evidence for koishi-plugin-steam-friend-status-fork@0.3.0. 1 of 2 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A Steam API request fails directly while the default-enabled Apifox fallback is active; startup headshot initialization or polling can initiate requests when Steam users are already bound.

Impact

The proxy operator can obtain the Steam API key and use it to access the associated Steam Web API account.

Mechanism

The key is embedded in the Steam request URL, which is forwarded in the `api-u` header of a POST to the Apifox proxy.

Attack narrative

AI rationale

Evidence

src/steam.tssrc/fetch.tssrc/index.ts

Network endpoints2

api.steampowered.comweb-proxy.apifox.cn

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Steam API request URLs include the configured API key as a `key` query parameter.
The Apifox proxy fallback is enabled by default; its config description says the request URL is sent to the proxy.
After a direct request fails, the code uses the Apifox fallback when enabled.
The fallback POSTs to `web-proxy.apifox.cn` and places the full target URL in the `api-u` header.
When Koishi is ready, the plugin initializes headshots and schedules an immediate Steam status poll.

Evidence against

The package is a Steam status plugin, and its documented purpose requires requests to Steam’s API.

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 156 KB of source, external domains: api.steampowered.com, cdn.akamai.steamstatic.com, p.qlogo.cn, partner.steamgames.com, q.qlogo.cn, steamcommunity.com, web-proxy.apifox.cn

Source & flagged code

6 flagged

src/steam.tsView file

52const requestUrl = `${getPlayerSummariesUrl(ctx)}?key=${steamApiKey}&steamids=${steamid}`; try { const config =

High

Ai Review Evidence

Steam API request URLs include the configured API key as a `key` query parameter.

src/steam.tsView on unpkg · L52

src/index.tsView file

83useApifoxProxy: Schema.boolean() .default(true) .description( "Steam API 直连失败时使用 APIFOX 公共代理兜底（请求 URL

High

Ai Review Evidence

The Apifox proxy fallback is enabled by default; its config description says the request URL is sent to the proxy.

src/index.tsView on unpkg · L83

Findings

6 High1 Medium3 Low

HighAi Review Evidencesrc/steam.ts

HighAi Review Evidencesrc/index.ts

HighAi Review Evidencesrc/fetch.ts

HighAi Review Evidencesrc/index.ts

HighAi Review Evidencesrc/fetch.ts

MediumNetwork

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to koishi-plugin-steam-friend-status-fork@0.3.0.

The versions list below shows the verdict for each recorded version.

Avoid installing koishi-plugin-steam-friend-status-fork@0.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-29 22:17:47.712Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.3.0latestshownMaliciousCredential ExfiltrationBlockPublishedOct 29, 2026, 5:01 AM 0.2.9Clean—AllowPublishedOct 13, 2026, 10:10 AM

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages