registry / Remote code execution / @raolin2025/claude-code-node / 3.4.1

@raolin2025/claude-code-node@3.4.1

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Source inspection establishes unrestricted Telegram command execution once the listener is configured. This warrants a vulnerability warning, while the scanner's malicious classification is not substantiated by the inspected behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Run cc-notify with a Telegram bot token configured, then send the bot a /run command.

Impact

Anyone able to message the bot can execute commands with the daemon user's privileges and receive command output.

Mechanism

Polling forwards incoming messages to a command handler that executes /run arguments with execSync, without a sender or chat allowlist.

AI rationale

Evidence

package.jsonsrc/channel/notify-daemon.jssrc/channel/tg-listener.js

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The cc-notify command starts Telegram polling when a bot token is configured.
Telegram updates reach message handling without an authorized sender or chat check.
The /run command passes message arguments directly to a shell through execSync.

Evidence against

No npm installation lifecycle hook or runtime self-dependency is present.
The inspected npm publishing requests send authentication to registry.npmjs.org.
Remote programming is an implemented package feature; inspected source does not establish malicious intent.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 697 KB of source, external domains: 127.0.0.1, api.deepseek.com, api.github.com, api.search.brave.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, r.jina.ai, registry.npmjs.org, www.googleapis.com

Source & flagged code

15 flagged

src/__tests__/dream.test.jsView file

Lines 401-441javascript

401 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

402 // 无 summarizer → 启发式梦境，方向名为主目标

403 await dm.sleep([

404 { role: 'user', content: '实现排序算法' },

405 { role: 'assistant', content: '完成', toolCalls: [{ name: 'Read', input: {} }] },

406 { role: 'tool', content: 'OK' },

407 { role: 'assistant', content: '用了快速排序' },

408 ], {})

409 // 单短英文词 "OK" 不应因为正文里 tool 结果含 OK 就误命中

410 const ctx = await dm.wakeByDirection('OK')

411 // 正文没有实质 OK 方向，应返回 null 或极弱匹配

412 // 这里排序算法主线不含 OK 关键词，正常应返回 null

413 assert.ok(ctx === null || !ctx.includes('排序算法'))

414})

415

416test('sanitizeSecrets：脱敏 API key / token / 密码 / 私钥', () => {

417 const sk = sanitizeSecrets('key=sk-abcdefgh1234567890')

418 assert.ok(sk.startsWith('key=sk-abc***[redacted:'))

419 assert.ok(!sk.includes('abcdefgh1234567890'))

420 assert.ok(!/sk-abcdefgh1234567890/.test(sanitizeSecrets('使用 sk-abcdefgh1234567890 调用')))

421 assert.ok(sanitizeSecrets('ghp_abcdefghijklmnopqrstuvwxyz1234567890').includes('[redacted'))

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

422 // Bearer token

423 assert.ok(sanitizeSecrets('Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xxxx').includes('[redacted'))

424 // 私钥

425 const pem = '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----'

426 assert.ok(!sanitizeSecrets(pem).includes('MIIEvQIBADANBg'))

427 // 明文普通文本不受影响

428 const normal = '重构 http 客户端，采用指数退避'

429 assert.equal(sanitizeSecrets(normal), normal)

430})

431

432test('安全脱敏：入睡时梦境文本字段不含密钥', async () => {

433 const dir = await mkdtemp(join(tmpdir(), 'dream-sanitize-'))

434 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

435 const dream = await dm.sleep([

436 { role: 'user', content: '配置 API key 为 sk-abcdefgh1234567890 并接入服务' },

437 { role: 'assistant', content: '已配置，使用 ghp_abcdefghijklmnopqrstuvwxyz1234567890 推送', toolCalls: [{ name: 'Read', input: {} }] },

438 { role: 'tool', content: 'OK' },

439 { role: 'assistant', content: '完成' },

440 ], {})

441 const all = await dm.list()

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L444

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

11 */

src/core/scheduler.jsView file

Lines 306-346javascript

306 const raw = readFileSync(execLogFile, 'utf-8')

307 const lines = raw.split('\n')

308 if

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

src/security/ssrf-guard.jsView file

Lines 1-28javascript

1/**

2 * SSRF 防护 — 阻止对内网/云元数据端点的请求

3 * 对应原版：src/utils/hooks/ssrfGuard.ts

4 *

5 * v1.2 修复:

6 * - H4: 完整检测 fe80::/10 范围（fe80:: - febf::），而非仅 fe8 前缀

7 * - H3: 导出 dnsLookup 函数供 query-engine 使用自定义 DNS resolver

8 */

9import { lookup as dnsLookup } from 'dns'

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

15 flagged · loading source

src/__tests__/dream.test.jsView file

421patternName = github_pat severity = critical line = 421

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Findings

9 Critical5 High3 Medium5 Low

CriticalCritical Secretsrc/__tests__/dream.test.js

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

CriticalPrevious Version Dangerous Deltasrc/channel/notify-daemon.js

CriticalSecret Patternsrc/__tests__/dream.test.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.4.1.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-04 09:22:49.371Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code