registry / Remote code execution / @raolin2025/claude-code-node / 2.8.16

@raolin2025/claude-code-node@2.8.16

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is not malicious install-time behavior, but it ships an unguarded remote shell capability reachable through configured bot channels. The concrete exposure warrants a warning for dangerous capability rather than a publication block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs cc-notify with a configured Telegram or QQ bot and sends a /run command.

Impact

Anyone able to send a command through a configured bot channel can run commands as the local user.

Mechanism

Remote command text is executed with execSync.

AI rationale

Evidence

package.jsonsrc/channel/tg-listener.jssrc/channel/notify-daemon.js.claude-code/notify-api-key.txt.cc-node/cc-notify.pid.cc-node/cc-notify.log

Network endpoints3

api.telegram.orgapi.sgroup.qq.combots.qq.com/app/getAppAccessToken

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The Telegram listener accepts incoming bot messages and routes slash commands without a sender allowlist.
Its /run command passes Telegram-supplied text directly to a shell through execSync.
A second /run handler in cc-notify also executes received command text.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
The risky daemon is activated only by the cc-notify executable and requires configured channel credentials.
Observed network use is for configured Telegram and QQ bot services; no package-controlled collection endpoint was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 62 file(s), 525 KB of source, external domains: api.deepseek.com, api.github.com, api.search.brave.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, r.jina.ai, registry.npmjs.org, www.googleapis.com

Source & flagged code

10 flagged

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

High

Shell

Package source references shell execution.

src/tools/bash.jsView on unpkg · L8

11 */

12import { spawn } from 'child_process'

13import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

14import { checkBashSafety } from '../security/bash-guard.js'

15import { detectShell, getShellDescription } from '../utils/shell.js'

17// 启动时探测一次并缓存

18const shellCfg = detectShell()

20/**

21 * 动态生成工具描述，告知 LLM 当前平台的 shell 语义，

22 * 避免模型在 Windows 上写出 Linux 命令导致失败。

23 */

24function buildDescription() {

25 const envHint = getShellDescription()

26 return `Execute a shell command. The command will run in a shell subprocess.

28${envHint}

30Usage:

31- Provide the command as the value of the 'command' key (use the syntax matching the current shell above)

src/tools/npm-publish.jsView file

4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）： L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403 L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP ... L14: */ L15: import { execSync } from 'child_process' L16: import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs' ... L25: 前置条件: L26: - 项目根目录（含 package.json） L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀） ... L97: export function parsePackJson(packJson) { L98: const data = JSON.parse(packJson) L99: const meta = Object.values(data)[0] || {}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/npm-publish.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/npm-publish.jsView on unpkg · L4

src/channel/notify-daemon.jsView file

30import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' L33: import crypto from 'node:crypto' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/channel/notify-daemon.jsView on unpkg · L30

22Source sends the broad process environment to a literal external destination. L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/channel/notify-daemon.jsView on unpkg · L22

22Trigger-reachable chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

src/security/ssrf-guard.jsView file

Lines 1-28javascript

1/**

2 * SSRF 防护 — 阻止对内网/云元数据端点的请求

3 * 对应原版：src/utils/hooks/ssrfGuard.ts

4 *

5 * v1.2 修复:

6 * - H4: 完整检测 fe80::/10 范围（fe80:: - febf::），而非仅 fe8 前缀

7 * - H3: 导出 dnsLookup 函数供 query-engine 使用自定义 DNS resolver

8 */

9import { lookup as dnsLookup } from 'dns'

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

10 flagged · loading source

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

8* - Windows (WSL) → wsl bash（bash 语义） L9: * - Windows (PS) → PowerShell L10: * - Windows (cmd) → cmd.exe 兜底

High

Shell

Package source references shell execution.

src/tools/bash.jsView on unpkg · L8

src/tools/npm-publish.jsView file

Findings

4 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

HighChild Processsrc/tools/bash.js

HighShellsrc/tools/bash.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@2.8.16.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@2.8.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 11:53:21.490Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code