registry / mm_ai / 1.0.0

mm_ai@1.0.0

AI聊天模块

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 214 file(s), 1.54 MB of source, external domains: 127.0.0.1, api.deepseek.com, api.minimaxi.chat, api.openai.com, api.openweathermap.org, api.stepfun.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, devapi.qweather.com, example.com, geoapi.qweather.com, github.com, open.bigmodel.cn, www.baidu.com, www.cn.bing.com, www.so.com, www.w3.org

Source & flagged code

11 flagged

index.jsView file

Lines 38-104javascript

38 diy_sql: true,

39 diy_cache: true,

40 diy_filer: false,

41 sql: {

42 // mysql、sqlite

43 way: 'mysql'

44 },

45 sqlite: {

46 dir: './db/'.fullname(),

47 user: 'root',

48 password: '',

49 database: 'mm',

50 charset: 'utf8mb4',

51 connect_timeout: 5000,

52 connection_limit: 500

53 },

54 mysql: {

55 host: '127.0.0.1',

56 port: 3306,

57 user: 'root',

58 password: 'Asd159357',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L58

59 database: 'mm',

60 charset: 'utf8mb4',

61 timezone: '+08:00',

62 connect_timeout: 5000,

63 connection_limit: 500

64 },

65 cache: {

66 // 缓存方式memory、redis、mongodb

67 way: 'redis'

68 },

69 // 缓存基础配置

70 cachebase: {

71 dir: './cache/'.fullname(),

72 expire: 0,

73 max: 0,

74 persist: false, // 是否启用持久化

75 save_interval: 60000 // 保存间隔（毫秒）

76 },

77 // 缓存配置

78 redis: {

79 // 服务器地址

80 host: 'localhost',

81 // 端口号

82 port: 6379,

83 // 密码

84 password: 'asd159357',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L84

85 // 数据库

86 database: 0,

87 // 前缀

88 prefix: 'mm_',

89 // 连接超时时间(ms)

90 connect_timeout: 5000,

91 // 重试次数

92 retry_count: 3,

93 // 重试间隔(ms)

94 retry_delay: 1000

95 },

96 llm_key: {

97 "deepseek": "sk-8e58b0e550714c929b0562d6cb9c1c04",

98 "openai": "sk-xxxx",

99 "glm": "sk-xxxx",

100 "minimax": "sk-xxxx",

101 "qwen": "sk-xxxx",

102 "doubao": "sk-xxxx",

103 "step": "sk-xxxx"

104 },

common/tool/develop/get_diagnostics/index.jsView file

Lines 1-48javascript

1const fs = require('fs');

2const path = require('path');

3const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

common/tool/system/auto_operation/desktop.jsView file

Lines 1-26javascript

1/**

2 * auto_operation - 桌面自动化模块

3 * 提供鼠标、键盘、屏幕操作能力

4 *

5 * 双引擎架构：

6 * 1. robotJS - 跨平台原生方案（需编译，Windows/macOS/Linux）

7 * 2. PowerShell + .NET - Windows 原生方案（无需编译，仅 Windows）

8 *

High

Shell

Package source references shell execution.

common/tool/system/auto_operation/desktop.jsView on unpkg · L6

9 * 自动选择最优可用引擎：

10 * - 有 robotJS 原生模块 → 优先使用 robotJS（性能更好）

common/tool/develop/frontend_debug/vconsole.min.jsView file

Lines 1-10javascript

1/*!

2 * vConsole v3.3.4 (https://github.com/Tencent/vConsole)

3 *

4 * Tencent is pleased to support the open source community by making vConsole available.

6 * Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

7 * http://opensource.org/licenses/MIT

8 * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

9 */

core/contact/index.jsView file

Lines 1-21javascript

1const { Drive } = require('mm_machine');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/contact/index.jsView on unpkg · L1

3/**

4 * 联系人类

5 */

6class Contact extends Drive {

common/tool/develop/exec_code/index.jsView file

Lines 1-21javascript

1const { spawn } = require('child_process');

2const vm = require('vm');

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

common/tool/develop/exec_code/index.jsView on unpkg · L1

3const fs = require('fs'

common/agent/内置智能体.xlsxView file

•path = common/agent/内置智能体.xlsx kind = high_entropy_blob sizeBytes = 11144 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

common/agent/内置智能体.xlsxView on unpkg

•path = common/agent/内置智能体.xlsx kind = compressed_blob sizeBytes = 11144 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

common/agent/内置智能体.xlsxView on unpkg

•path = common/agent/内置智能体.xlsx kind = nested_archive_needs_inspection sizeBytes = 11144 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

common/agent/内置智能体.xlsxView on unpkg

Source & flagged code

11 flagged · loading source

index.jsView file

58patternName = generic_password severity = medium line = 58 matchedText = password...57',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L58

84patternName = generic_password severity = medium line = 84 matchedText = password...57',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L84

common/tool/develop/get_diagnostics/index.jsView file

2const path = require('path'); L3: const { execSync } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

common/tool/develop/get_diagnostics/index.jsView on unpkg · L2

28try { L29: const output = execSync(`npx eslint --format json "${filePath}"`, { L30: timeout: 15000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

common/tool/develop/get_diagnostics/index.jsView on unpkg · L28

common/tool/system/auto_operation/desktop.jsView file

6* 1. robotJS - 跨平台原生方案（需编译，Windows/macOS/Linux） L7: * 2. PowerShell + .NET - Windows 原生方案（无需编译，仅 Windows） L8: *

High

Shell

Package source references shell execution.

common/tool/system/auto_operation/desktop.jsView on unpkg · L6

common/tool/develop/frontend_debug/vconsole.min.jsView file

9*/ L10: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define("VConsole",[],t):"object"==typeof exports?exports.V...

Low

Eval

Package source references a known benign dynamic code generation pattern.

common/tool/develop/frontend_debug/vconsole.min.jsView on unpkg · L9

core/contact/index.jsView file

1const { Drive } = require('mm_machine'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/contact/index.jsView on unpkg · L1

common/tool/develop/exec_code/index.jsView file

1const { spawn } = require('child_process'); L2: const vm = require('vm'); ... L24: // 使用调用者所在目录作为基准路径，允许加载内置模块和 node_modules L25: const callerDir = process.cwd(); L26: const safeRequire = Module.createRequire(path.join(callerDir, 'noop.js')); ... L205: L206: let stdout = ''; L207: let stderr = '';

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

common/tool/develop/exec_code/index.jsView on unpkg · L1

common/agent/内置智能体.xlsxView file

•path = common/agent/内置智能体.xlsx kind = high_entropy_blob sizeBytes = 11144 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

common/agent/内置智能体.xlsxView on unpkg

•path = common/agent/内置智能体.xlsx kind = compressed_blob sizeBytes = 11144 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

common/agent/内置智能体.xlsxView on unpkg

•path = common/agent/内置智能体.xlsx kind = nested_archive_needs_inspection sizeBytes = 11144 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

common/agent/内置智能体.xlsxView on unpkg

Findings

4 High9 Medium7 Low

HighChild Processcommon/tool/develop/get_diagnostics/index.js

HighShellcommon/tool/system/auto_operation/desktop.js

HighRuntime Package Installcommon/tool/develop/get_diagnostics/index.js

HighShips High Entropy Blobcommon/agent/内置智能体.xlsx

MediumSecret Patternindex.js

MediumDynamic Requirecore/contact/index.js

MediumUnsafe Vm Contextcommon/tool/develop/exec_code/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Compressed Blobcommon/agent/内置智能体.xlsx

MediumStructural Risk Force Deep Review

MediumSecret Patternindex.js

LowScripts Present

LowEvalcommon/tool/develop/frontend_debug/vconsole.min.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectioncommon/agent/内置智能体.xlsx

Source & flagged code

11 flagged

index.jsView file

Lines 38-104javascript

38 diy_sql: true,

39 diy_cache: true,

40 diy_filer: false,

41 sql: {

42 // mysql、sqlite

43 way: 'mysql'

44 },

45 sqlite: {

46 dir: './db/'.fullname(),

47 user: 'root',

48 password: '',

49 database: 'mm',

50 charset: 'utf8mb4',

51 connect_timeout: 5000,

52 connection_limit: 500

53 },

54 mysql: {

55 host: '127.0.0.1',

56 port: 3306,

57 user: 'root',

58 password: 'Asd159357',

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L58

59 database: 'mm',

60 charset: 'utf8mb4',

61 timezone: '+08:00',

62 connect_timeout: 5000,

63 connection_limit: 500

64 },

65 cache: {

66 // 缓存方式memory、redis、mongodb

67 way: 'redis'

68 },

69 // 缓存基础配置

70 cachebase: {

71 dir: './cache/'.fullname(),

72 expire: 0,

73 max: 0,

74 persist: false, // 是否启用持久化

75 save_interval: 60000 // 保存间隔（毫秒）

76 },

77 // 缓存配置

78 redis: {

79 // 服务器地址

80 host: 'localhost',

81 // 端口号

82 port: 6379,

83 // 密码

84 password: 'asd159357',

Medium

Secret Pattern

Hardcoded password in index.js

index.jsView on unpkg · L84

85 // 数据库

86 database: 0,

87 // 前缀

88 prefix: 'mm_',

89 // 连接超时时间(ms)

90 connect_timeout: 5000,

91 // 重试次数

92 retry_count: 3,

93 // 重试间隔(ms)

94 retry_delay: 1000

95 },

96 llm_key: {

97 "deepseek": "sk-8e58b0e550714c929b0562d6cb9c1c04",

98 "openai": "sk-xxxx",

99 "glm": "sk-xxxx",

100 "minimax": "sk-xxxx",

101 "qwen": "sk-xxxx",

102 "doubao": "sk-xxxx",

103 "step": "sk-xxxx"

104 },

common/tool/develop/get_diagnostics/index.jsView file

Lines 1-48javascript

1const fs = require('fs');

2const path = require('path');

3const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

common/tool/system/auto_operation/desktop.jsView file

Lines 1-26javascript

1/**

2 * auto_operation - 桌面自动化模块

3 * 提供鼠标、键盘、屏幕操作能力

4 *

5 * 双引擎架构：

6 * 1. robotJS - 跨平台原生方案（需编译，Windows/macOS/Linux）

7 * 2. PowerShell + .NET - Windows 原生方案（无需编译，仅 Windows）

8 *

High

Shell

Package source references shell execution.

common/tool/system/auto_operation/desktop.jsView on unpkg · L6

9 * 自动选择最优可用引擎：

10 * - 有 robotJS 原生模块 → 优先使用 robotJS（性能更好）

common/tool/develop/frontend_debug/vconsole.min.jsView file

Lines 1-10javascript

1/*!

2 * vConsole v3.3.4 (https://github.com/Tencent/vConsole)

3 *

4 * Tencent is pleased to support the open source community by making vConsole available.

6 * Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

7 * http://opensource.org/licenses/MIT

9 */

core/contact/index.jsView file

Lines 1-21javascript

1const { Drive } = require('mm_machine');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/contact/index.jsView on unpkg · L1

3/**

4 * 联系人类

5 */

6class Contact extends Drive {

common/tool/develop/exec_code/index.jsView file

Lines 1-21javascript

1const { spawn } = require('child_process');

2const vm = require('vm');

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

common/tool/develop/exec_code/index.jsView on unpkg · L1

3const fs = require('fs'

common/agent/内置智能体.xlsxView file

•path = common/agent/内置智能体.xlsx kind = high_entropy_blob sizeBytes = 11144 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

common/agent/内置智能体.xlsxView on unpkg

•path = common/agent/内置智能体.xlsx kind = compressed_blob sizeBytes = 11144 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

common/agent/内置智能体.xlsxView on unpkg

•path = common/agent/内置智能体.xlsx kind = nested_archive_needs_inspection sizeBytes = 11144 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

common/agent/内置智能体.xlsxView on unpkg