registry / Remote code execution / @raolin2025/claude-code-node / 2.7.7

@raolin2025/claude-code-node@2.7.7

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection confirms dangerous unauthenticated remote command execution in an explicitly user-started daemon, but not malicious installation behavior, covert credential exfiltration, or a foreign AI-agent control-surface mutation. The scanner's credential-exfiltration label is not supported by the inspected npm publishing code.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs cc-notify with a configured Telegram or QQ bot, then a remote sender submits /run <command>.

Impact

An untrusted bot participant could execute commands with the daemon user's privileges.

Mechanism

Remote message to execSync command execution

AI rationale

Evidence

package.jsonsrc/channel/notify-daemon.jssrc/channel/tg-listener.jssrc/channel/qqbot-listener.jssrc/tools/npm-publish.js.claude-code/notify-api-key.txt.claude-code/config.jsonsrc/index.js

Network endpoints3

api.telegram.orgapi.sgroup.qq.combots.qq.com/app/getAppAccessToken

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicitly invoked cc-notify service accepts remote-channel messages and executes /run text with execSync without visible sender authorization.
Telegram messages are forwarded to the common message handler without an allowlist check, exposing that command path to bot participants.
The package includes a remote AI-agent/notification daemon capable of starting cc-node with received text.

Evidence against

package.json has no preinstall, install, postinstall, or other lifecycle hook.
The daemon starts only when its cc-notify entrypoint is run directly; importing it avoids startup side effects.
The HTTP control API requires an API key for chat and send endpoints.
The npm token code sends authenticated publish requests only to registry.npmjs.org as part of an explicit publishing tool.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Source & flagged code

10 flagged

src/tools/bash.jsView file

4*/ L5: import { spawn } from 'child_process' L6: import { existsSync } from 'node:fs'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L4

55// 跨平台 shell 选择： L56: // - Windows: 优先用 Git Bash（如已安装），否则用 cmd.exe /c L57: // - 其他平台: 用 SHELL 环境变量或默认 /bin/bash

High

Shell

Package source references shell execution.

src/tools/bash.jsView on unpkg · L55

src/tools/npm-publish.jsView file

4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）： L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403 L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP ... L14: */ L15: import { execSync } from 'child_process' L16: import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs' ... L25: 前置条件: L26: - 项目根目录（含 package.json） L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀） ... L92: try { L93: const npmrc = readFileSync(join(process.env.HOME, '.npmrc'), 'utf-8') L94: const m = npmrc.match(/_authToken=([^\s]+)/)

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/npm-publish.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/npm-publish.jsView on unpkg · L4

src/channel/notify-daemon.jsView file

30import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' L33: import crypto from 'node:crypto' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/channel/notify-daemon.jsView on unpkg · L30

22Source sends the broad process environment to a literal external destination. L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/channel/notify-daemon.jsView on unpkg · L22

22Trigger-reachable chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

10 flagged · loading source

src/tools/bash.jsView file

4*/ L5: import { spawn } from 'child_process' L6: import { existsSync } from 'node:fs'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L4

55// 跨平台 shell 选择： L56: // - Windows: 优先用 Git Bash（如已安装），否则用 cmd.exe /c L57: // - 其他平台: 用 SHELL 环境变量或默认 /bin/bash

High

Shell

Package source references shell execution.

src/tools/bash.jsView on unpkg · L55

src/tools/npm-publish.jsView file

Findings

4 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

HighChild Processsrc/tools/bash.js

HighShellsrc/tools/bash.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@2.7.7.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@2.7.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-19 22:12:03.359Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code