@cakagus/codeclaw@1.5.0
AI agent terminal + Telegram bot untuk coding, trading, dan research — dengan skill system auto-upgrade.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe hourly auto-analysis path sends messages through the user's Telegram bot to a hard-coded chat ID by default. The opt-in enables recurring analysis but does not authorize that recipient, making this an unsolicited account action toward a package-selected target.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The Telegram bot is running, autoEnabled is true, and the hourly timer reaches the top of an hour.
Impact
The user's bot account posts recurring messages to a recipient selected in package code, without the user selecting or confirming that recipient.
Mechanism
telegram.js defaults TG_ALLOWLIST to chat ID 6206096363 and sends hourly analysis through TelegramAPI with the configured bot token.
Attack narrative
When the hourly job is enabled, the bot sends its market analysis to chat ID 6206096363 by default, unless TG_ALLOWLIST overrides it. The request uses the user's configured Telegram bot token. Enabling auto analysis does not select or confirm that recipient, so this makes recurring posts from the user's account to a fixed, package-chosen target.
AI rationale
The hourly auto-analysis path sends messages through the user's Telegram bot to a hard-coded chat ID by default. The opt-in enables recurring analysis but does not authorize that recipient, making this an unsolicited account action toward a package-selected target.
Evidence
telegram.jslib/telegram-api.jsscripts/gold-analysis.mjs
Network endpoints1
api.telegram.org
Decision evidence
public snapshotAI called this Malicious at 92.0% confidence as Malware with low false-positive risk.
Evidence for block
- The hourly job reads persisted trade state and runs only when autoEnabled is true, once at the top of each hour.
- Unless TG_ALLOWLIST is set, the job sends reports to the fixed Telegram chat ID 6206096363.
- The hourly task sends its generated analysis through the bot, and TelegramAPI builds requests to api.telegram.org using the configured bot token.
- The /trade auto on command enables the recurring job, but does not choose or confirm its recipient.
Evidence against
- This package is a Telegram bot with an advertised automatic market-analysis feature.
- The analysis script also supports sending reports to the configured Telegram chat ID in its ordinary mode.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/codeclaw.jsView file
17if (cmd === "doctor") {
L18: const { runDoctor, printDoctorReport } = await import(path.join(PKG_ROOT, "lib", "doctor.js"));
L19: const fix = argv.includes("--fix");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/codeclaw.jsView on unpkg · L17lib/doctor.jsView file
2import path from "node:path";
L3: import { execSync } from "node:child_process";
L4: import { CONFIG_FILE, SKILLS_DIR, SKILLS_INDEX, IS_LEGACY } from "./paths.js";
...
L7: try {
L8: return { ok: true, out: execSync(cmd, { encoding: "utf8", stdio: "pipe", timeout: 10000, shell: "/bin/bash" }).trim() };
L9: } catch (e) {
L10: return { ok: false, out: (e.stdout || "").toString().trim(), err: (e.stderr || e.message || "").toString().trim() };
L11: }
...
L13:
L14: async function tryFetch(url, opts = {}) {
L15: try {
...
L23: function isTermux() {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
lib/doctor.jsView on unpkg · L2Findings
1 Critical2 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationscripts/gold-analysis.mjs#virtual:normalized:round1
HighSemantic Analysis Limitedlib/research.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltatelegram.js
MediumDynamic Requirebin/codeclaw.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/doctor.js
MediumShips Build Helperbin/tokenobral-deploy.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @cakagus/codeclaw@1.5.0.
See all versions of @cakagus/codeclaw for other recorded verdicts.
- Avoid installing @cakagus/codeclaw@1.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.