registry / Remote code execution / @raolin2025/claude-code-node / 2.8.17

@raolin2025/claude-code-node@2.8.17

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This package is a dangerous remote agent and shell-control capability with unsafe default chat authorization. It is not malicious under the install-abuse policy because there is no lifecycle hook, stealth installation behavior, or confirmed credential exfiltration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The user runs cc-notify and configures a Telegram or QQ bot credential.

Impact

A person able to message the configured bot can run commands in the daemon's user context or drive the local coding agent.

Mechanism

Unauthenticated chat messages reach shell execution or agent task routing.

AI rationale

Evidence

package.jsonsrc/channel/notify-daemon.jssrc/channel/tg-listener.jssrc/channel/qqbot-account-manager.jssrc/core/query-engine.js.claude-code/notify-api-key.txt~/.cc-node/cc-notify.pid~/.cc-node/cc-notify.log

Network endpoints3

api.telegram.orgapi.sgroup.qq.comwss://api.sgroup.qq.com/websocket

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The cc-notify command executes a shell command received through its run command handler.
Telegram messages are forwarded to the handler without a sender allowlist.
Telegram listening starts when a configured bot token is present.
QQ bot accounts default to open access with a wildcard allowlist.

Evidence against

The manifest has no preinstall, install, or postinstall hook.
The risky daemon is a user-invoked bin command, not import-time behavior.
No package-controlled collection endpoint or secret exfiltration path was found.
AI tool calls use a confirmation flow, although the direct run command bypasses it.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

10 flagged

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

High

Shell

Package source references shell execution.

src/tools/bash.jsView on unpkg · L8

11 */

12import { spawn } from 'child_process'

13import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

14import { checkBashSafety } from '../security/bash-guard.js'

15import { detectShell, getShellDescription } from '../utils/shell.js'

17// 启动时探测一次并缓存

18const shellCfg = detectShell()

20/**

21 * 动态生成工具描述，告知 LLM 当前平台的 shell 语义，

22 * 避免模型在 Windows 上写出 Linux 命令导致失败。

23 */

24function buildDescription() {

25 const envHint = getShellDescription()

26 return `Execute a shell command. The command will run in a shell subprocess.

28${envHint}

30Usage:

31- Provide the command as the value of the 'command' key (use the syntax matching the current shell above)

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

src/channel/notify-daemon.jsView file

30import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' L33: import crypto from 'node:crypto' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/channel/notify-daemon.jsView on unpkg · L30

22Source sends the broad process environment to a literal external destination. L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/channel/notify-daemon.jsView on unpkg · L22

22Trigger-reachable chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

10 flagged · loading source

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

8* - Windows (WSL) → wsl bash（bash 语义） L9: * - Windows (PS) → PowerShell L10: * - Windows (cmd) → cmd.exe 兜底

High

Shell

Package source references shell execution.

src/tools/bash.jsView on unpkg · L8

src/tools/npm-publish.jsView file

4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）： L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403 L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP ... L14: */ L15: import { execSync } from 'child_process' L16: import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs' ... L25: 前置条件: L26: - 项目根目录（含 package.json） L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀） ... L97: export function parsePackJson(packJson) { L98: const data = JSON.parse(packJson) L99: const meta = Object.values(data)[0] || {}

Findings

4 Critical5 High3 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

HighChild Processsrc/tools/bash.js

HighShellsrc/tools/bash.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@2.8.17.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@2.8.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 13:14:09.547Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code