registry / Remote code execution / @raolin2025/claude-code-node / 2.8.15

@raolin2025/claude-code-node@2.8.15

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This package contains an unguarded remote shell feature that warrants a warning. It is not malicious under the install-time policy because there is no lifecycle hook or automatic control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs cc-notify with a Telegram channel configured, then a bot user sends /run followed by a shell command.

Impact

Anyone able to message the configured bot can run commands as the local user and receive command output.

Mechanism

Untrusted chat text is passed to execSync and its output is sent back to chat.

AI rationale

Evidence

package.jsonsrc/channel/notify-daemon.jssrc/channel/tg-listener.js.claude-code/config.json.claude-code/notify-api-key.txt

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Unknown with low false-positive risk.

Evidence for warning

Telegram messages reach command handling with no sender allowlist.
The /run command passes chat text directly to a shell.
The command output is returned to the originating chat.

Evidence against

package.json has no install lifecycle hook.
The listener requires a user-supplied channel token and an explicit CLI invocation.
Observed network endpoints are configured AI, Telegram, QQ, and npm services; no package-owned receiver was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 62 file(s), 523 KB of source, external domains: api.deepseek.com, api.github.com, api.search.brave.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, r.jina.ai, registry.npmjs.org, www.googleapis.com

Source & flagged code

10 flagged

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

8* - Windows (WSL) → wsl bash（bash 语义） L9: * - Windows (PS) → PowerShell L10: * - Windows (cmd) → cmd.exe 兜底

High

Shell

Package source references shell execution.

src/tools/bash.jsView on unpkg · L8

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

11 * - pack 打包 tarball

12 * - publish 完整发布：打包 + git 合并提交 + push + npm 发布（自动降级兜底）

13 * - manual-publish 仅 npm 发布（bypass token 手动 PUT 兜底）

14 */

15import { execSync } from 'child_process'

16import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs'

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/npm-publish.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/npm-publish.jsView on unpkg · L4

17import { createHash } from 'crypto'

18import { join } from 'path'

19import { ToolDef } from '../types/index.js'

21const TOOL_NAME = 'NpmPublish'

22const TOOL_DESCRIPTION = `

23npm 发布一键工具 — 封装本项目发布经验，无需四处查找方法。

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

10 flagged · loading source

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

8* - Windows (WSL) → wsl bash（bash 语义） L9: * - Windows (PS) → PowerShell L10: * - Windows (cmd) → cmd.exe 兜底

High

Shell

Package source references shell execution.

src/tools/bash.jsView on unpkg · L8

src/tools/npm-publish.jsView file

4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）： L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403 L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP ... L14: */ L15: import { execSync } from 'child_process' L16: import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs' ... L25: 前置条件: L26: - 项目根目录（含 package.json） L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀） ... L97: export function parsePackJson(packJson) { L98: const data = JSON.parse(packJson) L99: const meta = Object.values(data)[0] || {}

Findings

4 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

HighChild Processsrc/tools/bash.js

HighShellsrc/tools/bash.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@2.8.15.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@2.8.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 11:04:39.681Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code