@cakagus/codeclaw@1.5.1
AI agent terminal + Telegram bot untuk coding, trading, dan research — dengan skill system auto-upgrade.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package routes scheduled reports through the user's Telegram bot to a hard-coded recipient, without disclosing that destination in the feature's enable message. This is an unauthorized account action toward a publisher-selected target.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Run telegram.js and enable auto-trade; the scheduler then runs every four hours.
Impact
This uses the user's bot credentials to send messages to a publisher-selected Telegram account without the user selecting that destination.
Mechanism
The scheduler uses TG_ALLOWLIST when set, otherwise it routes hourly ICT reports to Telegram chat 6206096363 using the configured bot token.
Attack narrative
When auto-trade is enabled, telegram.js schedules analysis reports every four hours and sends them to chat ID 6206096363 by default. The bot authenticates through api.telegram.org with the user's configured bot token. The feature's enable message describes scheduled analysis but does not disclose that reports go to this fixed chat; TG_ALLOWLIST can override the recipient.
AI rationale
The package routes scheduled reports through the user's Telegram bot to a hard-coded recipient, without disclosing that destination in the feature's enable message. This is an unauthorized account action toward a publisher-selected target.
Evidence
telegram.jslib/telegram-api.js
Network endpoints1
api.telegram.org
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The hourly analysis routine can send messages to a supplied Telegram chat ID.
- It sends the generated analysis report to that chat.
- When auto-trade is enabled, a scheduled task targets chat ID 6206096363 by default; TG_ALLOWLIST can override it.
- The Telegram client authenticates with the configured bot token, and the package starts the scheduler when telegram.js runs.
Evidence against
- The scheduled task runs only after auto-trade has been enabled.
- No install lifecycle scripts are declared.
- The flagged gold-analysis script sends reports only to the configured Telegram chat and contains no unrelated collector.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
13 flaggedbin/codeclaw.jsView file
17if (cmd === "doctor") {
L18: const { runDoctor, printDoctorReport } = await import(path.join(PKG_ROOT, "lib", "doctor.js"));
L19: const fix = argv.includes("--fix");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/codeclaw.jsView on unpkg · L17lib/doctor.jsView file
•matchType = normalized_sha256
matchedPackage = @cakagus/codeclaw@1.5.0
matchedPath = lib/doctor.js
matchedIdentity = npm:QGNha2FndXMvY29kZWNsYXc:1.5.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/doctor.jsView on unpkg2import path from "node:path";
L3: import { execSync } from "node:child_process";
L4: import { CONFIG_FILE, SKILLS_DIR, SKILLS_INDEX, IS_LEGACY } from "./paths.js";
...
L7: try {
L8: return { ok: true, out: execSync(cmd, { encoding: "utf8", stdio: "pipe", timeout: 10000, shell: "/bin/bash" }).trim() };
L9: } catch (e) {
L10: return { ok: false, out: (e.stdout || "").toString().trim(), err: (e.stderr || e.message || "").toString().trim() };
L11: }
...
L13:
L14: async function tryFetch(url, opts = {}) {
L15: try {
...
L23: function isTermux() {
Findings
1 Critical9 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationscripts/gold-analysis.mjs#virtual:normalized:round1
HighSemantic Analysis Limitedlib/research.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/tools.js
HighKnown Malware Source Similaritylib/doctor.js
HighKnown Malware Source Similaritytelegram.js
HighKnown Malware Source Similaritylib/telegram-api.js
HighKnown Malware Source Similarityscripts/gen-badges.mjs
HighKnown Malware Source Similaritylib/research.js
HighKnown Malware Source Fingerprint Signaturelib/tools.js
HighPrevious Version Dangerous Deltatelegram.js
MediumDynamic Require
Affected versions and remediation
This report applies to @cakagus/codeclaw@1.5.1.
See all versions of @cakagus/codeclaw for other recorded verdicts.
- Avoid installing @cakagus/codeclaw@1.5.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.