koishi-plugin-fusheng-count @1.0.9

Summary

lib/index.js contains a base64-obfuscated hardcoded user ID ( Buffer.from("Mjc1OTcyMDE2MQ==", "base64").toString("utf-8") decoding to QQ ID 2759720161 ) which is checked inside checkPermission(). When session.userId matches this hidden ID, the function returns { allowed: true } unconditionally, bypassing the plugin's documented allowedGroups whitelist and admin/owner role gating. The backdoor is undocumented in the README, and base64-encoding the ID demonstrates intent to conceal the identity from operators reading the source. Any deployment of this plugin grants the hardcoded account privileged command access (including destructive operations like 清空统计 which wipes all mention statistics) in every group the bot joins.

Source: amazon-inspector (060196a35f8eb94f7e91f892daf62aee8e293d16130565dfbc837877df264db5)