← 返回扫描报告总表 · ← dshlib 图书馆

扫描报告 · @xmanrui/dsh-im

认证等级L1
DIDdid:cha2a:package:@xmanrui/dsh-im
身份锚点xmanrui/dsh-im · npm 官方声明
来源npm
插件版本—
安装dsh plugin add @xmanrui/dsh-im
扫描日期2026-08-18（2 天前）
扫描层级静态扫描（自研规则 + GuardDog 复核 + OSV 依赖）
扫描器版本dshlib-scan v0.1 · GuardDog 3.2.0 · OSV.dev

自研扫描：⚠️ 待审 · GuardDog 复核：⚠️ 待审 · OSV 依赖：未扫描

语义：扫描是提示信号，非安全审查。✅ 通过=无命中；⚠️ 待审=有命中需人工判断；❌ 失败=无法扫描。人工确认恶意→下架。本页全部内容由 dshlib 数据库派生（验证报告 可核对证据）。认证等级与依赖漏洞正交：L4 认证覆盖插件包内容/来源/生态，不覆盖依赖安全（见收录与验证标准）。结论有有效期：插件或运行时更新后，本页结论可能过期（>30 天将标注待复核）。本库能力与边界：披露页。

1. 自研扫描（dshlib-scan）

越权能力（68 处）

文件行命中
package/lib/client.js758exec(
package/lib/client.js760exec(
package/lib/client.js762exec(
package/lib/client.js764exec(
package/lib/client.js766exec(
package/lib/client.js768exec(
package/lib/client.js770exec(
package/lib/client.js772exec(
package/lib/client.js774exec(
package/lib/client.js776exec(
package/lib/client.js778exec(
package/lib/client.js780exec(
package/lib/client.js782exec(
package/lib/client.js786exec(
package/lib/client.js788exec(
package/lib/client.js790exec(
package/lib/client.js792exec(
package/lib/client.js794exec(
package/lib/client.js796exec(
package/plugin-src/client/i18n.js388exec(
package/plugin-src/client/i18n.js390exec(
package/plugin-src/client/i18n.js392exec(
package/plugin-src/client/i18n.js394exec(
package/plugin-src/client/i18n.js396exec(
package/plugin-src/client/i18n.js398exec(
package/plugin-src/client/i18n.js400exec(
package/plugin-src/client/i18n.js402exec(
package/plugin-src/client/i18n.js404exec(
package/plugin-src/client/i18n.js406exec(
package/plugin-src/client/i18n.js408exec(
package/plugin-src/client/i18n.js410exec(
package/plugin-src/client/i18n.js412exec(
package/plugin-src/client/i18n.js416exec(
package/plugin-src/client/i18n.js418exec(
package/plugin-src/client/i18n.js420exec(
package/plugin-src/client/i18n.js422exec(
package/plugin-src/client/i18n.js424exec(
package/plugin-src/client/i18n.js426exec(
package/lib/index.js7exec(
package/lib/index.js7exec(
package/lib/index.js8exec(
package/lib/index.js22exec(
package/lib/index.js22exec(
package/lib/index.js28exec(
package/lib/index.js28execSync(
package/lib/index.js28exec(
package/lib/index.js36exec(
package/lib/index.js36exec(
package/lib/index.js65exec(
package/lib/index.js65exec(
package/lib/index.js79exec(
package/lib/index.js80exec(
package/lib/index.js80exec(
package/lib/index.js80exec(
package/lib/index.js91exec(
package/lib/index.js92exec(
package/lib/index.js92exec(
package/lib/index.js93exec(
package/lib/index.js93exec(
package/lib/index.js93exec(
package/lib/index.js197exec(
package/lib/index.js198exec(
package/src/channels/shared/compact-command.mjs42exec(
package/src/channels/shared/compact-command.mjs73exec(
package/src/channels/shared/workspace-command.mjs282exec(
package/src/channels/shared/workspace-command.mjs350exec(
package/src/channels/shared/workspace-command.mjs352exec(
package/src/channels/shared/workspace-command.mjs354exec(

硬编码密钥（6 处）

文件行命中
package/lib/index.js198AKIA1JDQYCQCANIA9GDQ
package/lib/index.js180token:"The registration QR code expired."
package/lib/index.js181token:"The registration QR code expired."
package/lib/index.js194password="password"
package/src/channels/feishu/registration-manager.mjs40token: 'The registration QR code expired.'
package/plugin-src/host/channels/feishu/rpc.mjs29token: 'The registration QR code expired.'

危险命令（2 处）

文件行命中
package/lib/index.js28rm -rf src/build/ test/fixtures/output.*",test:"npm run lint && npm run test-uni
package/plugin-src/host/channels/feishu/connection-supervisor.mjs28shutdown

数据外传（19 处）

文件行命中
package/lib/index.js63process.env.DINGTALK_REGISTRATION_SOURCE||Pee,now:i=()=>Date.now(),cardMinInterv
package/lib/index.js198readFile(a)).toString("base64"),await oE.unlink(a)}catch(A){o.logger?.debug("cou
package/lib/index.js88token:r,fetchImpl:o=fetch
package/lib/index.js100token request
package/lib/index.js100token manager is ready")}request
package/lib/index.js100token:e,expire:a}=yield this.request
package/lib/index.js100token:a}=yield this.request
package/lib/index.js100token:A,expire:t}=yield this.request
package/lib/index.js100token request
package/lib/index.js107secret",request
package/lib/index.js183tokenPrefetch
package/lib/index.js185token:r,fetchImpl:o=fetch
package/lib/index.js189password="",i.hash="",i.toString()}function I0(n,{fetchImpl:r=fetch}={}){if(type
package/lib/index.js198tokens")}}return{...t,sendMessageAck:ce,sendRetryRequest:ve,rejectCall:Ye,fetchM
package/src/channels/dingtalk/dingtalk-api.mjs306tokenRequests.set(appKey, request
package/src/channels/discord/discord-api.mjs43token, fetchImpl = fetch
package/src/channels/feishu/feishu-app.mjs28tokenResponse = await fetch
package/src/channels/qq/qq-runtime.mjs125tokenPrefetch
package/src/channels/telegram/telegram-api.mjs24token, fetchImpl = fetch

2. 第三方复核（GuardDog 3.2.0）

("invalid-registration","\u9489\u9489\u626B\u7801\u521D\u59CB\u5316\u7F3A\u5C11 nonce\u3002");let x=eD...



────────────────────────────────────────
Assessment:  High risk  (9.4/10)
23 risks detected

3. 依赖漏洞（OSV.dev）

未查询。