huawei-cloud-dew-key-management

SUSPICIOUS. The main DEW/KMS/CSMS capabilities are proportionate and use same-vendor Huawei infrastructure, but the bundled quality-reporting SDK introduces extra credential-derived outbound telemetry and an option to disable TLS verification. This is not fundamentally incompatible with the stated purpose, yet it expands data flows beyond core secret management enough to warrant medium risk rather than benign.

The code is an explicit cloud telemetry SDK rather than an apparent covert backdoor. Its main security concern is intentional collection and network transmission of function inputs, outputs, errors, and stack traces, combined with use of cloud credentials and a configurable destination. Secret masking is incomplete, and the optional insecure TLS mode can expose credentials and reports to interception. The configurable endpoint also creates a potential exfiltration path if deployment environment variables are attacker-controlled. No clear destructive or covert malware behavior is evident. As supplied, the fragment also has a syntax error due to the unterminated self_check call.