registry / matterbridge-roborock-vacuum-plugin / 1.1.7

matterbridge-roborock-vacuum-plugin@1.1.7

Matterbridge Roborock Vacuum Plugin

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 476 file(s), 2.04 MB of source, external domains: another-api.roborock.com, api-eu.roborock.com, api-us.roborock.com, api.example, api.example.com, api.roborock.com, base.url, cached.url, cniot.example.com, cniot.roborock.com, custom-api.roborock.com, default.com, euiot.example.com, euiot.roborock.com, files.roborock.com, github.com, ruiot.example.com, ruiot.roborock.com, test.com, test.roborock.com, test.url, usiot.example.com, usiot.roborock.com, wood-eu.roborock.com, wood-us.roborock.com

Source & flagged code

15 flagged

dist/services/authenticationService.jsView file

Lines 41-73javascript

41 this.logger.error('Failed to authenticate with cached token:', { username, error });

42 const errorMessage = error instanceof Error ? error.message :

Source & flagged code

15 flagged · loading source

dist/services/authenticationService.jsView file

61patternName = generic_password severity = medium line = 61 matchedText = this.log... });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/services/authenticationService.jsView on unpkg · L61

scripts/run-lint-fix-summary.mjsView file

1/* eslint-disable no-console, n/no-process-exit */ L2: import { spawnSync } from 'node:child_process'; L3:

High

Child Process

Package source references child process execution.

scripts/run-lint-fix-summary.mjsView on unpkg · L1

7return spawnSync(command, { L8: shell: true, L9: encoding: 'utf8',

High

Shell

Package source references shell execution.

scripts/run-lint-fix-summary.mjsView on unpkg · L7

dist/types/roborockVacuumCleaner.jsView file

46[redacted](supportedAreas, selectedAreas, currentArea, supportedMaps) { L47: this.behaviors.require(RoborockServiceAreaServer.with(ServiceArea.Feature.Maps, ServiceArea.Feature.ProgressReporting), { L48: supportedAreas: supportedAreas ?? [

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types/roborockVacuumCleaner.jsView on unpkg · L46

dist/roborockCommunication/map/b01/b01MapParser.jsView file

19} L20: const decoded = this.decodeBase64IfNeeded(rawBuffer); L21: const decrypted = this.decryptIfNeeded(decoded, modelShortCode, serial); ... L95: const matrixBytes = roomMatrixRaw?.matrix; L96: const roomMatrix = Buffer.isBuffer(matrixBytes) && matrixBytes.length > 0 ? { data: matrixBytes } : undefined; L97: if (!roomDataInfo || roomDataInfo.length === 0) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/roborockCommunication/map/b01/b01MapParser.jsView on unpkg · L19

scripts/run-format-summary.mjsView file

6L7: const { status, stdout, stderr } = spawnSync(`npx prettier --write "${GLOB}"`, { L8: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/run-format-summary.mjsView on unpkg · L6

.cursor/statusline.shView file

•path = .cursor/statusline.sh kind = payload_in_excluded_dir sizeBytes = 1907 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.cursor/statusline.shView on unpkg

•path = .cursor/statusline.sh kind = build_helper sizeBytes = 1907 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.cursor/statusline.shView on unpkg

dist/constants/sensitiveDataRegexReplacements.jsView file

17patternName = generic_password severity = medium line = 17 matchedText = // passw...ord'

Medium

Secret Pattern

Hardcoded password in dist/constants/sensitiveDataRegexReplacements.js

dist/constants/sensitiveDataRegexReplacements.jsView on unpkg · L17

dist/tests/services/roborockService/roborockService.coverage.test.jsView file

88patternName = generic_password severity = medium line = 88 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService/roborockService.coverage.test.js

dist/tests/services/roborockService/roborockService.coverage.test.jsView on unpkg · L88

dist/tests/services/roborockService/roborockService.authentication.test.jsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService/roborockService.authentication.test.js

dist/tests/services/roborockService/roborockService.authentication.test.jsView on unpkg · L32

dist/tests/services/roborockService.test.jsView file

94patternName = generic_password severity = medium line = 94 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L94

172patternName = generic_password severity = medium line = 172 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L172

179patternName = generic_password severity = medium line = 179 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L179

200patternName = generic_password severity = medium line = 200 matchedText = password...ss',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService.test.js

dist/tests/services/roborockService.test.jsView on unpkg · L200

Findings

4 High12 Medium5 Low

HighChild Processscripts/run-lint-fix-summary.mjs

HighShellscripts/run-lint-fix-summary.mjs

HighRuntime Package Installscripts/run-format-summary.mjs

HighPayload In Excluded Dir.cursor/statusline.sh

MediumSecret Patterndist/services/authenticationService.js

MediumDynamic Requiredist/types/roborockVacuumCleaner.js

MediumNetwork

MediumShips Build Helper.cursor/statusline.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/constants/sensitiveDataRegexReplacements.js

MediumSecret Patterndist/tests/services/roborockService/roborockService.coverage.test.js

MediumSecret Patterndist/tests/services/roborockService/roborockService.authentication.test.js

MediumSecret Patterndist/tests/services/roborockService.test.js

LowScripts Present

LowWeak Cryptodist/roborockCommunication/map/b01/b01MapParser.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/types/roborockVacuumCleaner.jsView file

Lines 26-66javascript

26 constructor(device, homeInFo, configManager, roborockService, log, resolvedAreas = [], resolvedMaps = []) {

27 const deviceConfig = RoborockVacuumCleaner.initializeDeviceConfiguration(device, homeInFo, configManager, roborockService, log, resolvedAreas, resolvedMaps);

28 super(deviceConfig.deviceName, device.sn ?? device.duid, deviceConfig.bridgeMode, deviceConfig.runModeConfigs[0].mode, deviceConfig.runModeConfigs, deviceConfig.cleanModes[0].mode, deviceConfig.cleanModes, undefined, undefined, RvcOperationalState.OperationalState.Docked, deviceConfig.operationalState, deviceConfig.supportedAreaAndRoutines, undefined, null, deviceConfig.supportedMaps);

29 this.device = device;

30 this.homeInFo = homeInFo;

31 this.roborockService = roborockService;

32 log.debug(`Creating RoborockVacuumCleaner for device: ${deviceConfig.deviceName},

33 model: ${device.specs.model},

34 forceRunAtDefault: ${configManager.forceRunAtDefault}

35 bridgeMode: ${deviceConfig.bridgeMode},

36 Supported Clean Modes: ${debugStringify(deviceConfig.cleanModes)},

37 Supported Areas: ${debugStringify(deviceConfig.supportedAreas)},

38 Supported Maps: ${debugStringify(deviceConfig.supportedMaps)}

39 Supported Areas and Routines: ${debugStringify(deviceConfig.supportedAreaAndRoutines)},

40 Supported Operational States: ${debugStringify(deviceConfig.operationalState)}`);

41 }

42 /**

43 * Override to enable ServiceArea.Feature.ProgressReporting for per-room cleaning status.

44 * Adds progress attribute to track area cleaning completion (Pending/Operating/Completed/Skipped).

45 */

46 createDefaultServiceAreaClusterServer(supportedAreas, selectedAreas, currentArea, supportedMaps) {

47 this.behaviors.require(RoborockServiceAreaServer.with(ServiceArea.Feature.Maps, ServiceArea.Feature.ProgressReporting), {

48 supportedAreas: supportedAreas ?? [

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types/roborockVacuumCleaner.jsView on unpkg · L46

49 {

50 areaId: 1,

51 mapId: null,

52 areaInfo: {

53 locationInfo: { locationName: 'Living', floorNumber: 0, areaType: CommonAreaNamespaceTag.LivingRoom.tag },

54 landmarkInfo: null,

55 },

56 },

57 {

58 areaId: 2,

59 mapId: null,

60 areaInfo: {

61 locationInfo: { locationName: 'Kitchen', floorNumber: 0, areaType: CommonAreaNamespaceTag.Kitchen.tag },

62 landmarkInfo: null,

63 },

64 },

65 {

66 areaId: 3,

dist/roborockCommunication/map/b01/b01MapParser.jsView file

Lines 1-39javascript

1import crypto from 'node:crypto';

2import zlib from 'node:zlib';

3import protobuf from 'protobufjs';

4import { parseQ10MapPacket } from './b01Q10MapParser.js';

5import { parseQ10TracePacket } from './b01Q10TraceParser.js';

6import { ROBOROCK_PROTO_STR } from './roborockProto.js';

7export class B01MapParser {

8 robotMapType;

9 constructor() {

10 const root = protobuf.parse(ROBOROCK_PROTO_STR).root;

11 this.robotMapType = root.lookupType('SCMap.RobotMap');

12 }

13 parseRoomsFromEncryptedBinary(rawBuffer, modelShortCode, serial) {

14 if (this.isQ10ShapedPayload(rawBuffer)) {

15 return this.parseQ10Binary(rawBuffer);

16 }

17 if (this.isTracePacket(rawBuffer)) {

18 return this.parseTraceBinary(rawBuffer);

19 }

20 const decoded = this.decodeBase64IfNeeded(rawBuffer);

21 const decrypted = this.decryptIfNeeded(decoded, modelShortCode, serial);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/roborockCommunication/map/b01/b01MapParser.jsView on unpkg · L19

22 const hexed = this.asciiHexToBinaryIfNeeded(decrypted);

23 const decompressed = zlib.inflateSync(hexed);

24 return this.parseRooms(decompressed);

25 }

26 isQ10ShapedPayload(rawBuffer) {

27 return rawBuffer.length >= 2 && rawBuffer[0] === 0x01 && rawBuffer[1] === 0x01;

28 }

29 isTracePacket(rawBuffer) {

30 return rawBuffer.length >= 2 && rawBuffer[0] === 0x02 && rawBuffer[1] === 0x01;

31 }

32 parseQ10Binary(rawBuffer) {

33 try {

34 return parseQ10MapPacket(rawBuffer);

35 }

36 catch (err) {

37 throw new Error(`Q10 map binary parse failed (best-effort Q10 layout, unconfirmed against real device capture): ${String(err instanceof Error ? err.message : err)}`, { cause: err });

38 }

39 }

dist/constants/sensitiveDataRegexReplacements.jsView file

Lines 1-27javascript

1export const sensitiveDataRegexReplacements = {

2 // Email addresses

3 '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}': '[EMAIL_REDACTED]',

4 // IP addresses

5 '\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b': '[IP_REDACTED]',

6 // MAC addresses

7 '\\b(?:[0-9a-fA-F]{2}[:-]){5}(?:[0-9a-fA-F]{2})\\b': '[MAC_REDACTED]',

8 // UUIDs

9 '\\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\b': '[UUID_REDACTED]',

10 // DUIDs (Roborock device IDs, 16 hex chars)

11 '\\b[a-fA-F0-9]{16}\\b': '[DUID_REDACTED]',

12 // token, eg "token":"abcdefghijklmnopqrstuvwxyz" or token: 'abcdefghijklmnopqrstuvwxyz'

13 '"token"\\s*:\\s*"([a-zA-Z0-9-_\\.:=]+)"': '"token":"[TOKEN_REDACTED]"',

14 'token\\s*[:=]\\s*[\'"]?([a-zA-Z0-9-_\\.:=]+)[\'"]?': 'token: [TOKEN_REDACTED]',

15 // rruid (Roborock user IDs, rr followed by hex)

16 '\\brr[a-fA-F0-9]+\\b': '[RRUID_REDACTED]',

17 // password, eg "password":"mypassword" or password: 'mypassword'

Medium

Secret Pattern

Hardcoded password in dist/constants/sensitiveDataRegexReplacements.js

dist/constants/sensitiveDataRegexReplacements.jsView on unpkg · L17

18 '"password"\\s*:\\s*"([^"]+)"': '"password":"[PASSWORD_REDACTED]"',

19 'password\\s*[:=]\\s*[\'"]?([^\'"]+)[\'"]?': 'password: [PASSWORD_REDACTED]',

20 // verification codes (6 digit numbers), eg verificationCode: '123456', 'verificationCode':'123456' or verificationCode = 123456

21 '"verificationCode"\\s*:\\s*"?(\\d{6})"?': '"verificationCode":"[VERIFICATION_CODE_REDACTED]"',

22 'verificationCode\\s*[:=]\\s*[\'"]?(\\d{6})[\'"]?': 'verificationCode: [VERIFICATION_CODE_REDACTED]',

23 // user name, eg: username: 'abc@gmail.com', 'username':'abc@gmail.com' or username = abc@gmail.com or "username":"abc@abc.com"

24 '"username"\\s*:\\s*"([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})"': '"username":"[USERNAME_REDACTED]"',

25 'username\\s*[:=]\\s*[\'"]?([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})[\'"]?': 'username: [USERNAME_REDACTED]',

26};

27//# sourceMappingURL=sensitiveDataRegexReplacements.js.map

dist/tests/services/roborockService/roborockService.coverage.test.jsView file

Lines 68-108javascript

68 });

69 mockContainer = asPartial({

70 getAuthenticationCoordinator: vi.fn().mockReturnValue(mockAuthCoordinator),

71 getDeviceManagementService: vi.fn().mockReturnValue(mockDeviceService),

72 getAreaManagementService: vi.fn().mockReturnValue(mockAreaService),

73 getMessageRoutingService: vi.fn().mockReturnValue(mockMessageService),

74 getPollingService: vi.fn().mockReturnValue(mockPollingService),

75 getConnectionService: vi.fn().mockReturnValue(mockConnectionService),

76 setUserData: vi.fn(),

77 getIotApi: vi.fn(),

78 synchronizeMessageClients: vi.fn(),

79 destroy: vi.fn(),

80 });

81 mockPersist = {

82 init: vi.fn().mockResolvedValue(undefined),

83 getItem: vi.fn().mockResolvedValue(undefined),

84 setItem: vi.fn().mockResolvedValue(undefined),

85 };

86 mockConfigManager = {

87 username: 'testuser',

88 password: 'testpass',

Medium

Secret Pattern

Hardcoded password in dist/tests/services/roborockService/roborockService.coverage.test.js

dist/tests/services/roborockService/roborockService.coverage.test.jsView on unpkg · L88

89 verificationCode: undefined,

90 authenticationMethod: 'Password',

91 };

92 service = new RoborockService({

93 refreshInterval: 10,

94 baseUrl: 'https://api.roborock.com',

95 persist: mockPersist,

96 configManager: mockConfigManager,

97 container: mockContainer,

98 toastMessage: vi.fn(),

99 }, mockLogger, mockConfigManager);

100 });

101 describe('Authentication', () => {

102 it('should log password as masked when provided', async () => {

103 vi.mocked(mockAuthCoordinator.authenticate).mockResolvedValue({

104 nickname: 'Test',

105 username: 'test',

106 });

107 await service.authenticate();

108 expect(mockLogger.debug).toHaveBeenCalledWith(expect.stringContaining('******'));