github.com / songquanpeng

songquanpeng/one-api

JavaScript·564 files·commit 8df4a26·scanned 4d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 37,243+ stars — findings likely false positives

verdict accurate?

37,243 stars

Partial architecture graph

CLI tool detected

threat-state: lowlive

FINDINGS ░▒▓

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.common/helper/helper.go

	case "linux":
		err = exec.Command("xdg-open", url).Start()
	case "windows":
		err = exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.web/default/src/pages/TopUp/index.js

                                const text =
                                  await navigator.clipboard.readText();
                                setRedemptionCode(text.trim());
                   ...

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.web/air/src/pages/User/EditUser.js+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

489 files scanned @ 8df4a26 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration0

file system access4

obfuscation3

supply chain0

owasp / injection0

telemetry

files 489/564rules hit 4engine v7commit 8df4a26

github

songquanpeng/one-api

LLM API 管理 & 分发系统，支持 OpenAI、Azure、Anthropic Claude、Google Gemini、DeepSeek、字节豆包、ChatGLM、文心一言、讯飞星火、通义千问、360 智脑、腾讯混元等主流模型，统一 API 适配，可用于 key 管理与二次分发。单可执行文件，提供 Docker 镜像，一键部署，开箱即用。LLM API management & key redistribution system, unifying multiple providers under a single API. Single binary, Docker-ready, with an English UI.

JavaScript

37243

6890

1286d

564 files

489 scanned(87%)

8df4a26

architecture░▒▓

entry (1) flagged (3) pkg (267)

667 nodes · 1886 edgesscroll to zoom · click node to jump to finding