registry  /  @inetafrica/open-claudia  /  2.9.1

@inetafrica/open-claudia@2.9.1

⚠ Under review

Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 127 file(s), 1.29 MB of source, external domains: 127.0.0.1, api.elevenlabs.io, api.example.com, api.github.com, api.telegram.org, cdn.jsdelivr.net, central.inet.africa, chat.example.com, docs.anthropic.com, docs.cursor.com, example.com, github.com, huggingface.co, registry.npmjs.org, ticketcentral.inet.africa, www.apple.com, www.w3.org

Source & flagged code

5 flagged · loading source
bot-agent.jsView file
1const TelegramBot = require("node-telegram-bot-api"); L2: const { spawn, execSync } = require("child_process"); L3: const fs = require("fs"); L4: const path = require("path"); L5: const https = require("https"); L6: const cron = require("node-cron"); ... L20: // Synchronous-style notification using the Telegram API directly L21: const token = process.env.TELEGRAM_BOT_TOKEN; L22: const chatId = process.env.TELEGRAM_CHAT_ID?.split(",")[0]; ... L28: }); L29: req.write(data); L30: req.end();
Critical
Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

bot-agent.jsView on unpkg · L1
1const TelegramBot = require("node-telegram-bot-api"); L2: const { spawn, execSync } = require("child_process"); L3: const fs = require("fs");
High
Child Process

Package source references child process execution.

bot-agent.jsView on unpkg · L1
1634try { L1635: execSync(`npm install -g @inetafrica/open-claudia@${latest} 2>&1`, { L1636: encoding: "utf-8", timeout: 120000,
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bot-agent.jsView on unpkg · L1634
test-project-transcripts-smoke.jsView file
1const fs = require("fs"); L2: const os = require("os");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

test-project-transcripts-smoke.jsView on unpkg · L1
docker-entrypoint.shView file
•path = docker-entrypoint.sh kind = build_helper sizeBytes = 1865 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker-entrypoint.shView on unpkg

Findings

1 Critical3 High5 Medium4 Low
CriticalCommand Output Exfiltrationbot-agent.js
HighChild Processbot-agent.js
HighShell
HighRuntime Package Installbot-agent.js
MediumDynamic Requiretest-project-transcripts-smoke.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdocker-entrypoint.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings