@raolin2025/claude-code-node@2.8.14
Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a serious user-invoked remote command execution capability with no Telegram sender authorization. It has no install lifecycle hook or evidence of hidden package-controlled exfiltration, so it should be warned rather than blocked as malicious.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user explicitly runs cc-notify with a configured Telegram bot token, then a Telegram user sends /run followed by a command.
Impact
Remote code execution and command-output disclosure in the daemon user's environment.
Mechanism
Telegram message forwarding to unrestricted execSync.
AI rationale
The package contains a serious user-invoked remote command execution capability with no Telegram sender authorization. It has no install lifecycle hook or evidence of hidden package-controlled exfiltration, so it should be warned rather than blocked as malicious.
Evidence
package.jsonsrc/channel/notify-daemon.jssrc/channel/tg-listener.js.claude-code/notify-api-key.txt.claude-code/config.json
Network endpoints1
api.telegram.org
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The Telegram listener forwards received message text to its handler without a sender allowlist.
- The handler executes text following /run through execSync and returns command output to the chat.
- This capability activates only when the user starts cc-notify with a configured Telegram token.
Evidence against
- package.json has no preinstall, install, or postinstall hook and no dependencies.
- The local HTTP control endpoint requires an API key for command-bearing requests.
- No source-backed package-controlled credential exfiltration or install-time mutation was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcesrc/tools/bash.jsView file
11*/
L12: import { spawn } from 'child_process'
L13: import { ToolDef } from '../types/index.js'
High
8* - Windows (WSL) → wsl bash（bash 语义）
L9: * - Windows (PS) → PowerShell
L10: * - Windows (cmd) → cmd.exe 兜底
High
src/tools/npm-publish.jsView file
4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：
L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403
L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP
...
L14: */
L15: import { execSync } from 'child_process'
L16: import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs'
...
L25: 前置条件:
L26: - 项目根目录（含 package.json）
L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀）
...
L97: export function parsePackJson(packJson) {
L98: const data = JSON.parse(packJson)
L99: const meta = Object.values(data)[0] || {}
Findings
4 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executionsrc/channel/notify-daemon.js
CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js
CriticalCredential Exfiltrationsrc/tools/npm-publish.js
CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js
HighChild Processsrc/tools/bash.js
HighShellsrc/tools/bash.js
HighCloud Metadata Accesssrc/security/ssrf-guard.js
HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js
HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @raolin2025/claude-code-node@2.8.14.
See all versions of @raolin2025/claude-code-node for other recorded verdicts.
- Review the evidence and your use of @raolin2025/claude-code-node@2.8.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.