multi-wordcheck@1.0.10
CAUTIONPublisher claims: "基于官方违禁词库，覆盖公众号、小红书、抖音三大平台审核标准，支持文案、文件、图片、链接多形式输入，快速输出违禁词标记与上下文替换建议。当接口返回积分不足（code=3210）时，自动唤起支付宝完成充值后继续查询。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-22 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Unicode escape sequence detected; npx invocation of non-well-known package; npx invocation of non-well-known package. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
Unicode escape sequence detectedscripts/extract_text.py:222 · Unicode escape sequence detected — may contain obfuscated payloads
AST07HIGH
npx invocation of non-well-known packagereferences/alipay-recharge.md:62 · npx invocation of non-well-known package — may execute untrusted code
AST06HIGH
npx invocation of non-well-known packagereferences/alipay-recharge.md:111 · npx invocation of non-well-known package — may execute untrusted code
AST06MEDIUM
File type combined with upload actionREADME.en.md:33 · File type combined with upload action — agent may exfiltrate local data files
AST07HIGH
Unicode escape sequence detectedscripts/extract_text.py:223 · Unicode escape sequence detected — may contain obfuscated payloads
AST07