registry / matterbridge-roborock-vacuum-plugin / 1.1.7

matterbridge-roborock-vacuum-plugin@1.1.7

Matterbridge Roborock Vacuum Plugin

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 476 file(s), 2.04 MB of source, external domains: another-api.roborock.com, api-eu.roborock.com, api-us.roborock.com, api.example, api.example.com, api.roborock.com, base.url, cached.url, cniot.example.com, cniot.roborock.com, custom-api.roborock.com, default.com, euiot.example.com, euiot.roborock.com, files.roborock.com, github.com, ruiot.example.com, ruiot.roborock.com, test.com, test.roborock.com, test.url, usiot.example.com, usiot.roborock.com, wood-eu.roborock.com, wood-us.roborock.com

Source & flagged code

15 flagged

dist/services/authenticationService.jsView file

Lines 41-73javascript

41 this.logger.error('Failed to authenticate with cached token:', { username, error });

42 const errorMessage = error instanceof Error ? error.message : String(error);

43 if (errorMessage.includes('expired') || errorMessage.includes('token')) {

44 throw new TokenExpiredError();

45 }

46 throw new AuthenticationError('Session expired or invalid. Please login again.', {

47 username,

48 originalError: errorMessage,

49 });

50 }

51 }

52 /** Login with password. */

53 async loginWithPassword(username, password) {

54 try {

55 this.logger.debug('Authenticating with password for user:', username);

56 const newUserData = await this.authGateway.authenticatePassword(username, password);

57 this.logger.notice('Successfully authenticated with password');

58 return newUserData;

59 }

60 catch (error) {

61 this.logger.error('Failed to login with password:', { username, error });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/authenticationService.jsView on unpkg · L61

62 const errorMessage = error instanceof Error ? error.message : String(error);

63 if (errorMessage.includes('invalid') || errorMessage.includes('incorrect') || errorMessage.includes('wrong')) {

64 throw new InvalidCredentialsError(username);

65 }

66 throw new AuthenticationError('Authentication failed. Please use verification code login.', {

67 username,

68 originalError: errorMessage,

69 });

70 }

71 }

72}

73//# sourceMappingURL=authenticationService.js.map

scripts/run-lint-fix-summary.mjsView file

Lines 1-27javascript

1/* eslint-disable no-console, n/no-process-exit */

2import { spawnSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

scripts/run-lint-fix-summary.mjsView on unpkg · L1

4const MAX_LINES = 25;

dist/types/roborockVacuumCleaner.jsView file

Lines 26-66javascript

26 constructor(device, homeInFo, configManager, roborockService, log, resolvedAreas = [], resolvedMaps = []) {

27 const deviceConfig = RoborockVacuumCleaner.initializeDeviceConfiguration(device, homeInFo, configManager, roborockService, log, resolvedAreas, resolvedMaps);

28 super(deviceConfig.deviceName, device.sn ?? device.duid, deviceConfig.bridgeMode, deviceConfig.runModeConfigs[

dist/roborockCommunication/map/b01/b01MapParser.jsView file

Lines 1-39javascript

1import crypto from 'node:crypto';

2import zlib from 'node:zlib';

3import protobuf from 'protobufjs';

4import { parseQ10MapPacket } from './b01Q10MapParser.js'

scripts/run-format-summary.mjsView file

Lines 1-26javascript

1/* eslint-disable no-console, n/no-process-exit */

2import { spawnSync } from 'node:child_process';

4const GLOB = '**/*.{js,jsx,ts,tsx,json,css,md}';

5const MAX_FILES = 30

.cursor/statusline.shView file

•path = .cursor/statusline.sh kind = payload_in_excluded_dir sizeBytes = 1907 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cursor/statusline.shView on unpkg

•path = .cursor/statusline.sh kind = build_helper sizeBytes = 1907 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cursor/statusline.shView on unpkg

dist/constants/sensitiveDataRegexReplacements.jsView file

Lines 1-27javascript

1export const sensitiveDataRegexReplacements = {

2 // Email addresses

3 '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}': '[EMAIL_REDACTED]',

4 // IP addresses

5 '

dist/tests/services/roborockService/roborockService.coverage.test.jsView file

Lines 68-108javascript

68 });

69 mockContainer = asPartial({

70 getAuthenticationCoordinator: vi.fn().mockReturnValue(mockAuthCoordinator),

71 getDeviceManagementService: vi.fn().mockReturnValue(mockDeviceService),

72 getAreaManagementService: vi.fn

dist/tests/services/roborockService/roborockService.authentication.test.jsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService/roborockService.authentication.test.js

dist/tests/services/roborockService/roborockService.authentication.test.jsView on unpkg · L32

dist/tests/services/roborockService.test.jsView file

94patternName = generic_password severity = medium line = 94 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L94

172patternName = generic_password severity = medium line = 172 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L172

179patternName = generic_password severity = medium line = 179 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L179

200patternName = generic_password severity = medium line = 200 matchedText = password...ss',

Source & flagged code

15 flagged · loading source

dist/services/authenticationService.jsView file

61patternName = generic_password severity = medium line = 61 matchedText = this.log... });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/authenticationService.jsView on unpkg · L61

scripts/run-lint-fix-summary.mjsView file

1/* eslint-disable no-console, n/no-process-exit */ L2: import { spawnSync } from 'node:child_process'; L3:

High

Child Process

Package source references child process execution.

scripts/run-lint-fix-summary.mjsView on unpkg · L1

7return spawnSync(command, { L8: shell: true, L9: encoding: 'utf8',

High

Shell

Package source references shell execution.

scripts/run-lint-fix-summary.mjsView on unpkg · L7

dist/types/roborockVacuumCleaner.jsView file

46[redacted](supportedAreas, selectedAreas, currentArea, supportedMaps) { L47: this.behaviors.require(RoborockServiceAreaServer.with(ServiceArea.Feature.Maps, ServiceArea.Feature.ProgressReporting), { L48: supportedAreas: supportedAreas ?? [

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types/roborockVacuumCleaner.jsView on unpkg · L46

dist/roborockCommunication/map/b01/b01MapParser.jsView file

19} L20: const decoded = this.decodeBase64IfNeeded(rawBuffer); L21: const decrypted = this.decryptIfNeeded(decoded, modelShortCode, serial); ... L95: const matrixBytes = roomMatrixRaw?.matrix; L96: const roomMatrix = Buffer.isBuffer(matrixBytes) && matrixBytes.length > 0 ? { data: matrixBytes } : undefined; L97: if (!roomDataInfo || roomDataInfo.length === 0) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/roborockCommunication/map/b01/b01MapParser.jsView on unpkg · L19

scripts/run-format-summary.mjsView file

6L7: const { status, stdout, stderr } = spawnSync(`npx prettier --write "${GLOB}"`, { L8: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/run-format-summary.mjsView on unpkg · L6

.cursor/statusline.shView file

•path = .cursor/statusline.sh kind = payload_in_excluded_dir sizeBytes = 1907 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cursor/statusline.shView on unpkg

•path = .cursor/statusline.sh kind = build_helper sizeBytes = 1907 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cursor/statusline.shView on unpkg

dist/constants/sensitiveDataRegexReplacements.jsView file

17patternName = generic_password severity = medium line = 17 matchedText = // passw...ord'

Medium

Secret Pattern

Hardcoded password in dist/constants/sensitiveDataRegexReplacements.js

dist/constants/sensitiveDataRegexReplacements.jsView on unpkg · L17

dist/tests/services/roborockService/roborockService.coverage.test.jsView file

88patternName = generic_password severity = medium line = 88 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService/roborockService.coverage.test.js

dist/tests/services/roborockService/roborockService.coverage.test.jsView on unpkg · L88

dist/tests/services/roborockService/roborockService.authentication.test.jsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService/roborockService.authentication.test.js

dist/tests/services/roborockService/roborockService.authentication.test.jsView on unpkg · L32

dist/tests/services/roborockService.test.jsView file

94patternName = generic_password severity = medium line = 94 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L94

172patternName = generic_password severity = medium line = 172 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L172

179patternName = generic_password severity = medium line = 179 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L179

200patternName = generic_password severity = medium line = 200 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L200

Findings

4 High12 Medium5 Low

HighChild Processscripts/run-lint-fix-summary.mjs

HighShellscripts/run-lint-fix-summary.mjs

HighRuntime Package Installscripts/run-format-summary.mjs

HighPayload In Excluded Dir.cursor/statusline.sh

MediumSecret Patterndist/services/authenticationService.js

MediumDynamic Requiredist/types/roborockVacuumCleaner.js

MediumNetwork

MediumShips Build Helper.cursor/statusline.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/constants/sensitiveDataRegexReplacements.js

MediumSecret Patterndist/tests/services/roborockService/roborockService.coverage.test.js

MediumSecret Patterndist/tests/services/roborockService/roborockService.authentication.test.js

MediumSecret Patterndist/tests/services/roborockService.test.js

LowScripts Present

LowWeak Cryptodist/roborockCommunication/map/b01/b01MapParser.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

15 flagged

dist/services/authenticationService.jsView file

Lines 41-73javascript

41 this.logger.error('Failed to authenticate with cached token:', { username, error });

42 const errorMessage = error instanceof Error ? error.message : String(error);

43 if (errorMessage.includes('expired') || errorMessage.includes('token')) {

44 throw new TokenExpiredError();

45 }

46 throw new AuthenticationError('Session expired or invalid. Please login again.', {

47 username,

48 originalError: errorMessage,

49 });

50 }

51 }

52 /** Login with password. */

53 async loginWithPassword(username, password) {

54 try {

55 this.logger.debug('Authenticating with password for user:', username);

56 const newUserData = await this.authGateway.authenticatePassword(username, password);

57 this.logger.notice('Successfully authenticated with password');

58 return newUserData;

59 }

60 catch (error) {

61 this.logger.error('Failed to login with password:', { username, error });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/authenticationService.jsView on unpkg · L61

62 const errorMessage = error instanceof Error ? error.message : String(error);

63 if (errorMessage.includes('invalid') || errorMessage.includes('incorrect') || errorMessage.includes('wrong')) {

64 throw new InvalidCredentialsError(username);

65 }

66 throw new AuthenticationError('Authentication failed. Please use verification code login.', {

67 username,

68 originalError: errorMessage,

69 });

70 }

71 }

72}

73//# sourceMappingURL=authenticationService.js.map

scripts/run-lint-fix-summary.mjsView file

Lines 1-27javascript

1/* eslint-disable no-console, n/no-process-exit */

2import { spawnSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

scripts/run-lint-fix-summary.mjsView on unpkg · L1

4const MAX_LINES = 25;

dist/types/roborockVacuumCleaner.jsView file

Lines 26-66javascript

26 constructor(device, homeInFo, configManager, roborockService, log, resolvedAreas = [], resolvedMaps = []) {

27 const deviceConfig = RoborockVacuumCleaner.initializeDeviceConfiguration(device, homeInFo, configManager, roborockService, log, resolvedAreas, resolvedMaps);

28 super(deviceConfig.deviceName, device.sn ?? device.duid, deviceConfig.bridgeMode, deviceConfig.runModeConfigs[

dist/roborockCommunication/map/b01/b01MapParser.jsView file

Lines 1-39javascript

1import crypto from 'node:crypto';

2import zlib from 'node:zlib';

3import protobuf from 'protobufjs';

4import { parseQ10MapPacket } from './b01Q10MapParser.js'

scripts/run-format-summary.mjsView file

Lines 1-26javascript

1/* eslint-disable no-console, n/no-process-exit */

2import { spawnSync } from 'node:child_process';

4const GLOB = '**/*.{js,jsx,ts,tsx,json,css,md}';

5const MAX_FILES = 30

.cursor/statusline.shView file

•path = .cursor/statusline.sh kind = payload_in_excluded_dir sizeBytes = 1907 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cursor/statusline.shView on unpkg

•path = .cursor/statusline.sh kind = build_helper sizeBytes = 1907 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cursor/statusline.shView on unpkg

dist/constants/sensitiveDataRegexReplacements.jsView file

Lines 1-27javascript

1export const sensitiveDataRegexReplacements = {

2 // Email addresses

3 '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}': '[EMAIL_REDACTED]',

4 // IP addresses

5 '

dist/tests/services/roborockService/roborockService.coverage.test.jsView file

Lines 68-108javascript

68 });

69 mockContainer = asPartial({

70 getAuthenticationCoordinator: vi.fn().mockReturnValue(mockAuthCoordinator),

71 getDeviceManagementService: vi.fn().mockReturnValue(mockDeviceService),

72 getAreaManagementService: vi.fn

dist/tests/services/roborockService/roborockService.authentication.test.jsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService/roborockService.authentication.test.js

dist/tests/services/roborockService/roborockService.authentication.test.jsView on unpkg · L32

dist/tests/services/roborockService.test.jsView file

94patternName = generic_password severity = medium line = 94 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L94

172patternName = generic_password severity = medium line = 172 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L172

179patternName = generic_password severity = medium line = 179 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L179

200patternName = generic_password severity = medium line = 200 matchedText = password...ss',