dchat

• Analyzed: May 11, 2026, 7:00 AM
• Findings: 1
• Version: 0.4.0
• Hash: 4f082b141efb9bb465d07639ec3d05bc29abdba33771682fb9d9df9b9595b9e8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The dchat skill provides decentralized P2P messaging over the NKN network with a strong focus on security and privacy. It implements AES-128-GCM for end-to-end encryption of media files transferred via IPFS and protects the bot's identity at rest using AES-256-GCM with PBKDF2 (100k iterations), storing the passkey and ciphertext in separate directories with restrictive (0600) permissions. Notably, it includes DNS-based SSRF protection in `src/ipfs.ts` to validate that ad-hoc IPFS gateways are public before connection. The code is well-structured, includes comprehensive tests, and shows no signs of malicious intent or unauthorized data exfiltration.