
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@sliverp/qqbot
Advanced tools
直接使用预装好的腾讯云 Lighthouse 镜像,开箱即用,无需手动安装配置。
openclaw plugins install @sliverp/qqbot@1.3.7
git clone https://github.com/sliverp/qqbot.git && cd qqbot
clawdbot plugins install .
💡 安装过程需要一些时间,尤其是小内存机器,请耐心等待
AppID 和 AppSecret(ClientSecret)AppID:AppSecret交互式配置:
clawdbot channels add
# 选择 qqbot,按提示输入 Token
命令行配置:
clawdbot channels add --channel qqbot --token "AppID:AppSecret"
编辑 ~/.clawdbot/clawdbot.json:
{
"channels": {
"qqbot": {
"enabled": true,
"appId": "你的AppID",
"clientSecret": "你的AppSecret"
}
}
}
| 配置项 | 类型 | 必填 | 说明 |
|---|---|---|---|
appId | string | ✅ | QQ 机器人 AppID |
clientSecret | string | ✅* | AppSecret,与 clientSecretFile 二选一 |
clientSecretFile | string | ✅* | AppSecret 文件路径 |
enabled | boolean | ❌ | 是否启用,默认 true |
name | string | ❌ | 账户显示名称 |
systemPrompt | string | ❌ | 自定义系统提示词 |
| 事件类型 | 说明 | Intent |
|---|---|---|
C2C_MESSAGE_CREATE | C2C 单聊消息 | 1 << 25 |
GROUP_AT_MESSAGE_CREATE | 群聊 @机器人消息 | 1 << 25 |
AT_MESSAGE_CREATE | 频道 @机器人消息 | 1 << 30 |
DIRECT_MESSAGE_CREATE | 频道私信 | 1 << 12 |
# 后台启动
clawdbot gateway restart
# 前台启动(查看日志)
clawdbot gateway --port 18789 --verbose
clawdbot onboard
# 选择 QQ Bot 进行交互式配置
npx -y @sliverp/qqbot@1.3.7 upgrade
热更新后无需重新配置 AppId 和 AppSecret
git clone https://github.com/sliverp/qqbot.git && cd qqbot
# 运行升级脚本
bash ./scripts/upgrade.sh
# 重新安装
clawdbot plugins install .
# 重新配置
clawdbot channels add --channel qqbot --token "AppID:AppSecret"
# 重启网关
clawdbot gateway restart
升级脚本会自动清理旧版本和配置。
MIT
FAQs
Unknown package
The npm package @sliverp/qqbot receives a total of 6,321 weekly downloads. As such, @sliverp/qqbot popularity was classified as popular.
We found that @sliverp/qqbot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.