registry / @aster110/cc2wechat / 5.2.0

@aster110/cc2wechat@5.2.0

WeChat channel for Claude Code — chat with Claude Code from WeChat via iLink Bot API

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 111 file(s), 439 KB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, ilinkai.weixin.qq.com, novac2c.cdn.weixin.qq.com

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 201-241javascript

201 });

202 console.log(`\n ✅ Login successful! "${name}" → ${result.accountId}`);

203 console.log(` Starting daemon...\n`);

204 // login 成功后直接进入 daemon 模式

205 startOne(port);

206 }

207 catch (err) {

208 console.error(`\n ❌ Login failed: ${err}\n`);

209 process.exit(1);

210 }

211}

212// ---------------------------------------------------------------------------

213// Start / Stop / Restart

214// ---------------------------------------------------------------------------

215function startOne(port) {

216 process.env.CC2WECHAT_PORT = String(port);

217 // 引擎路由 = 生产回退开关：tmux/terminal 投递或 CC2WECHAT_ENGINE=v5 继续走 v5，

218 // 其余（sdk/pipe/auto/未设）走 v6 常驻核心。

219 void startEngine({

220 env: process.env,

221 config: loadConfig(),

222 importer: (specifier) => import(specifier),

223 }).catch((err) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L221

224 console.error(`Failed to start engine: ${String(err)}`);

225 process.exit(1);

226 });

227}

228function stopOne(port) {

229 try {

230 const pid = execSync(`lsof -i :${port} -t -sTCP:LISTEN 2>/dev/null`, { encoding: 'utf-8' }).trim();

231 if (pid) {

232 process.kill(parseInt(pid, 10), 'SIGTERM');

233 const name = reverseAlias(port);

234 console.log(` ✅ stopped ${name ? `"${name}"` : ''} (PID ${pid}, port ${port})`);

235 return true;

236 }

237 }

238 catch { /* not running */ }

239 return false;

240}

241function getAllPorts() {

•matchType = previous_version_dangerous_delta matchedPackage = @aster110/cc2wechat@5.1.2 matchedIdentity = npm:QGFzdGVyMTEwL2NjMndlY2hhdA:5.1.2 similarity = 0.787 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

dist/v6/reply-context.jsView file

Lines 1-25javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import { createHash } from 'node:crypto';

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code