registry / Remote code execution / @raolin2025/claude-code-node / 3.5.0

@raolin2025/claude-code-node@3.5.0

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Source inspection does not substantiate the scanner's malicious exfiltration verdict. It does establish missing sender authorization on reachable remote shell execution, warranting a vulnerability warning.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Start cc-notify with Telegram credentials, then receive a /run command from someone able to message the bot.

Impact

A remote sender can execute commands with the process user's privileges and receive command output.

Mechanism

The listener dispatches incoming command arguments to execSync without an owner allowlist or permission confirmation.

AI rationale

Evidence

src/channel/notify-daemon.jssrc/channel/tg-listener.js

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The cc-notify entrypoint starts Telegram listening when a bot token is configured.
The Telegram message handler dispatches commands without checking sender authorization.
The /run command passes incoming arguments directly to execSync, bypassing agent tool permission checks.
The manifest has no installation lifecycle hooks or runtime self-dependency.
The inspected npm publishing code sends its token to registry.npmjs.org.

Evidence against

Remote programming is consistent with the package's functionality; no covert recipient or malicious intent was established.
The HTTP API checks an API key, but that check does not protect Telegram commands.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 70 file(s), 710 KB of source, external domains: 127.0.0.1, api.deepseek.com, api.github.com, api.search.brave.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, r.jina.ai, registry.npmjs.org, www.googleapis.com

Source & flagged code

15 flagged

src/__tests__/dream.test.jsView file

Lines 401-441javascript

401 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

402 // 无 summarizer → 启发式梦境，方向名为主目标

403 await dm.sleep([

404 { role: 'user', content: '实现排序算法' },

405 { role: 'assistant', content: '完成', toolCalls: [{ name: 'Read', input: {} }] },

406 { role: 'tool', content: 'OK' },

407 { role: 'assistant', content: '用了快速排序' },

408 ], {})

409 // 单短英文词 "OK" 不应因为正文里 tool 结果含 OK 就误命中

410 const ctx = await dm.wakeByDirection('OK')

411 // 正文没有实质 OK 方向，应返回 null 或极弱匹配

412 // 这里排序算法主线不含 OK 关键词，正常应返回 null

413 assert.ok(ctx === null || !ctx.includes('排序算法'))

414})

415

416test('sanitizeSecrets：脱敏 API key / token / 密码 / 私钥', () => {

417 const sk = sanitizeSecrets('key=sk-abcdefgh1234567890')

418 assert.ok(sk.startsWith('key=sk-abc***[redacted:'))

419 assert.ok(!sk.includes('abcdefgh1234567890'))

420 assert.ok(!/sk-abcdefgh1234567890/.test(sanitizeSecrets('使用 sk-abcdefgh1234567890 调用')))

421 assert.ok(sanitizeSecrets('ghp_abcdefghijklmnopqrstuvwxyz1234567890').includes('[redacted'))

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

422 // Bearer token

423 assert.ok(sanitizeSecrets('Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xxxx').includes('[redacted'))

424 // 私钥

425 const pem = '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----'

426 assert.ok(!sanitizeSecrets(pem).includes('MIIEvQIBADANBg'))

427 // 明文普通文本不受影响

428 const normal = '重构 http 客户端，采用指数退避'

429 assert.equal(sanitizeSecrets(normal), normal)

430})

431

432test('安全脱敏：入睡时梦境文本字段不含密钥', async () => {

433 const dir = await mkdtemp(join(tmpdir(), 'dream-sanitize-'))

434 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

435 const dream = await dm.sleep([

436 { role: 'user', content: '配置 API key 为 sk-abcdefgh1234567890 并接入服务' },

437 { role: 'assistant', content: '已配置，使用 ghp_abcdefghijklmnopqrstuvwxyz1234567890 推送', toolCalls: [{ name: 'Read', input: {} }] },

438 { role: 'tool', content: 'OK' },

439 { role: 'assistant', content: '完成' },

440 ], {})

441 const all = await dm.list()

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L444

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

11 */

12import { spawn } from 'child_process'

13import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

14import { checkBashSafety } from '../security/bash-guard.js'

15import { detectShell, getShellDescription } from '../utils/shell.js'

17// 启动时探测一次并缓存

18const shellCfg = detectShell()

20/**

21 * 动态生成工具描述，告知 LLM 当前平台的 shell 语义，

22 * 避免模型在 Windows 上写出 Linux 命令导致失败。

23 */

24function buildDescription() {

25 const envHint = getShellDescription()

26 return `Execute a shell command. The command will run in a shell subprocess.

28${envHint}

30Usage:

31- Provide the command as the value of the 'command' key (use the syntax matching the current shell above)

src/core/scheduler.jsView file

Lines 306-346javascript

306 const raw = readFileSync(execLogFile, 'utf-8')

307 const lines = raw.split('\n')

308 if (lines.length > EXEC_LOG_KEEP) {

309 const kept = lines.slice(-Math.floor(EXEC_LOG_KEEP / 2))

310 writeFileSync(execLogFile, kept.join('\n'))

311 }

312 } catch { /* 审计日志写入失败不阻断任务 */ }

313 }

314

315 /** 默认 exec 执行器:spawn(cmd,{shell:true,timeout,cwd,env}) → 统一结果 + 审计 */

316 async function defaultRunExec(task) {

317 const cmd = task.action?.cmd || ''

318 const cwd = task.action?.cwd || undefined

319 const timeout = task.timeoutMs ?? EXEC_DEFAULT_TIMEOUT

320 const startedAt = Date.now()

321 const result = { ok: false, error: '', exitCode: null, stdout: '', stderr: '', durationMs: 0 }

322 if (!cmd) { result.error = 'exec 任务缺少 action.cmd'; return result }

323

324 await new Promise((resolve) => {

325 let child

326 try {

327 child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } })

328 } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

329 let out = '', err = ''

330 child.stdout?.on('data', d => { out = (out + d).slice(-2048) })

331 child.stderr?.on('data', d => { err = (err + d).slice(-2048) })

332 child.on('error', e => { result.error = String(e.message || e); resolve() })

333 child.on('close', (code, signal) => {

334 result.exitCode = code

335 result.error = signal ? `killed by ${signal}` : (code === 0 ? '' : `exit code ${code}`)

336 resolve()

337 })

338 })

339 result.ok = result.exitCode === 0 && !result.error

340 result.stdout = result.stdout || ''

341 result.stderr = result.stderr || ''

342 result.durationMs = Date.now() - startedAt

343 return result

344 }

345

346 const runExecFn = runExec || defaultRunExec

src/tools/git-tool.jsView file

Lines 207-247javascript

207 if (labelFilter && !pr.labels?.some(l => l.name === labelFilter)) continue

208 try {

209 const review = await this.reviewer.reviewPR(pr.number, { commentThreshold: 'WARNING' })

210 results.push({ prNumber: pr.number, title: pr.title, findings: review.findings.length, status: 'reviewed' })

211 } catch (e) {

212 results.push({ prNumber: pr.number, title: pr.title, status: 'error', error: e.message })

213 }

214 }

215 return { total: prList.length, reviewed: results.filter(r => r.status === 'reviewed').length, errors: results.filter(r => r.status === 'error'), details: results }

216 }

217

218 async comment({ prNumber, body, path, line }) {

219 if (!prNumber || !body) throw new Error('prNumber and body required')

220 this.ensureGitHubClient()

221

222 if (path && line) {

223 // Get PR diff, parse and find the position for the specific line

224 const pr = await this.github.getPR(prNumber)

225 const diffText = await this.github.getPRDiff(prNumber)

226

227 // Import diff parser dynamically (ESM)

228 const { splitDiffByFile, getPositionInDiff, getHunksForFileRaw } = await import('../git/utils/diff-parser.js')

229

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/git-tool.jsView on unpkg · L227

230 const fileMap = splitDiffByFile(diffText)

231 const hunks = getHunksForFileRaw(fileMap, path)

232

233 if (!hunks || hunks.length === 0) {

234 throw new Error('File ' + path + ' not found in PR diff')

235 }

236

237 const position = getPositionInDiff(hunks, line)

238 if (position === null) {

239 throw new Error('Line ' + line + ' not found in diff for ' + path)

240 }

241

242 // Use latest commit SHA as commit_id

243 const commitId = pr.head?.sha || null

244

245 return await this.github.createComment(prNumber, body, { path, position, commitId })

246 }

247

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

11 * - pack 打包 tarball

12 * - publish 完整发布：打包 + git 合并提交 + push + npm 发布（自动降级兜底）

13 * - manual-publish 仅 npm 发布（bypass token 手动 PUT 兜底）

14 */

15import { execSync } from 'child_process'

16import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from 'fs'

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/npm-publish.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/npm-publish.jsView on unpkg · L4

17import { createHash } from 'crypto'

18import { join } from 'path'

19import { ToolDef } from '../types/index.js'

21const TOOL_NAME = 'NpmPublish'

22const TOOL_DESCRIPTION = `

23npm 发布一键工具 — 封装本项目发布经验，无需四处查找方法。

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

6 * QQ ← OpenClaw QQ Bot → cc-notify (HTTP API) → cc-node

7 * HTTP API → cc-notify → cc-node

8 *

9 * 支持：

10 * - Telegram Bot 长轮询监听（增强版）

11 * - QQ Bot 消息（通过 OpenClaw 转发到 HTTP API /chat 端点）

12 * - HTTP API（带 API Key 认证）

13 * - C 方案智能路由（运行中 → socket 转发，未运行 → 启动新进程）

14 * - 多通道消息推送

15 * - API Key 自动生成 + 持久化

16 *

17 * 用法：

18 * cc-notify # 前台运行

19 * cc-notify --daemon # 后台守护进程

20 * cc-notify --stop # 停止守护进程

21 * cc-notify --status # 查看状态

22 */

23import { createServer } from 'node:http'

24import {

25 readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync,

26 mkdirSync, openSync, closeSync, statSync, renameSync,

27} from 'node:fs'

28import { join } from 'node:path'

29import { pathToFileURL } from 'node:url'

30import { homedir } from 'node:os'

31import { spawn, execSync } from 'node:child_process'

32import { createConnection } from 'node:net'

33import crypto from 'node:crypto'

34import { SOCK_DIR, SOCK_PATH, CC_NODE_PID, CC_NOTIFY_PID, CC_NOTIFY_LOG, DEFAULT_HTTP_PORT } from '../core/paths.js'

35import { ChannelManager } from './index.js'

37// ============================================================

38// 配置加载

39// ============================================================

41function loadConfig() {

42 // 生成或加载 API Key

43 let apiKey = process.env.CC_NOTIFY_API_KEY || ''

44 if (!apiKey) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/channel/notify-daemon.jsView on unpkg · L30

45 const configDir = join(process.cwd(), '.claude-code')

46 const configPath = join(configDir, 'notify-api-key.txt')

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/channel/notify-daemon.jsView on unpkg · L22

47 try {

48 if (existsSync(configPath)) {

49 apiKey = readFileSync(configPath, 'utf8').trim()

50 } else {

22Trigger-reachable chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/channel/notify-daemon.jsView on unpkg · L22

22Trigger-reachable credential exfiltration chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

src/channel/notify-daemon.jsView on unpkg · L22

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

15 flagged · loading source

src/__tests__/dream.test.jsView file

421patternName = github_pat severity = critical line = 421

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L444

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

src/core/scheduler.jsView file

326try { L327: child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } }) L328: } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

src/tools/git-tool.jsView file

227// Import diff parser dynamically (ESM) L228: const { splitDiffByFile, getPositionInDiff, getHunksForFileRaw } = await import('../git/utils/diff-parser.js') L229:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/git-tool.jsView on unpkg · L227

src/tools/npm-publish.jsView file

4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）： L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403 L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP ... L14: */ L15: import { execSync } from 'child_process' L16: import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from 'fs' ... L25: 前置条件: L26: - 项目根目录（含 package.json） L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀） ... L97: export function parsePackJson(packJson) { L98: const data = JSON.parse(packJson) L99: const meta = Object.values(data)[0] || {}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/npm-publish.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/npm-publish.jsView on unpkg · L4

src/channel/notify-daemon.jsView file

30import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' L33: import crypto from 'node:crypto' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/channel/notify-daemon.jsView on unpkg · L30

22Source sends the broad process environment to a literal external destination. L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/channel/notify-daemon.jsView on unpkg · L22

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/channel/notify-daemon.jsView on unpkg · L22

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

src/channel/notify-daemon.jsView on unpkg · L22

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Findings

8 Critical5 High4 Medium5 Low

CriticalCritical Secretsrc/__tests__/dream.test.js

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

CriticalSecret Patternsrc/__tests__/dream.test.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

MediumDynamic Requiresrc/tools/git-tool.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/tools/npm-publish.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.5.0.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-06 21:02:07.873Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.