@cakagus/codeclaw@1.5.2
AI agent terminal + Telegram bot untuk coding, trading, dan research — dengan skill system auto-upgrade.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no install hook, and the flagged gold-analysis path uses credentials with their expected services. However, the opt-in auto-trade scheduler sends messages through the user’s Telegram bot to a hard-coded recipient by default, an account action toward a publisher-chosen target.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user enables `/trade auto on` and the Telegram bot reaches a scheduled four-hour tick.
Impact
Unrequested messages are sent to a fixed third-party Telegram account using the user’s bot account.
Mechanism
The scheduler uses `TG_ALLOWLIST` when set, otherwise targets chat `6206096363`, then sends `[AUTO HOURLY]` messages through the user’s Telegram bot token.
Attack narrative
Enabling auto-trade starts a four-hour scheduler. Unless `TG_ALLOWLIST` is explicitly set, it sends generated trading analysis to the hard-coded Telegram chat `6206096363` through the user’s bot account. The user-facing toggle describes automated analysis but does not disclose this fixed recipient.
AI rationale
The package has no install hook, and the flagged gold-analysis path uses credentials with their expected services. However, the opt-in auto-trade scheduler sends messages through the user’s Telegram bot to a hard-coded recipient by default, an account action toward a publisher-chosen target.
Evidence
telegram.jslib/trade-analyzer.js
Network endpoints1
api.telegram.org
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The `/trade auto on` command enables the hourly scheduler; the trade state defaults to off.
- When enabled, the scheduler defaults its recipient to hard-coded Telegram chat `6206096363` unless `TG_ALLOWLIST` is set.
- The scheduler sends `[AUTO HOURLY]` analysis messages to that recipient using the bot’s Telegram account.
Evidence against
- The hourly scheduler requires the user to enable auto-trade; it does not run when the stored state is off.
- The flagged gold-analysis script sends its configured API keys only to their intended market-data and Telegram services, with its notification destination taken from config.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
11 flaggedbin/codeclaw.jsView file
17if (cmd === "doctor") {
L18: const { runDoctor, printDoctorReport } = await import(path.join(PKG_ROOT, "lib", "doctor.js"));
L19: const fix = argv.includes("--fix");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/codeclaw.jsView on unpkg · L17lib/doctor.jsView file
•matchType = normalized_sha256
matchedPackage = @cakagus/codeclaw@1.5.1
matchedPath = lib/doctor.js
matchedIdentity = npm:QGNha2FndXMvY29kZWNsYXc:1.5.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/doctor.jsView on unpkg2import path from "node:path";
L3: import { execSync } from "node:child_process";
L4: import { CONFIG_FILE, SKILLS_DIR, SKILLS_INDEX, IS_LEGACY } from "./paths.js";
...
L7: try {
L8: return { ok: true, out: execSync(cmd, { encoding: "utf8", stdio: "pipe", timeout: 10000, shell: "/bin/bash" }).trim() };
L9: } catch (e) {
L10: return { ok: false, out: (e.stdout || "").toString().trim(), err: (e.stderr || e.message || "").toString().trim() };
L11: }
...
L13:
L14: async function tryFetch(url, opts = {}) {
L15: try {
...
L23: function isTermux() {
Findings
1 Critical7 High6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationscripts/gold-analysis.mjs#virtual:normalized:round1
HighSemantic Analysis Limitedlib/research.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/tools.js
HighKnown Malware Source Similaritylib/doctor.js
HighKnown Malware Source Similaritylib/telegram-api.js
HighKnown Malware Source Similarityscripts/gen-badges.mjs
HighKnown Malware Source Similaritylib/research.js
HighPrevious Version Dangerous Deltatelegram.js
MediumDynamic Requirebin/codeclaw.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistence
Affected versions and remediation
This report applies to @cakagus/codeclaw@1.5.2.
See all versions of @cakagus/codeclaw for other recorded verdicts.
- Avoid installing @cakagus/codeclaw@1.5.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.