registry / @raolin2025/claude-code-node / 3.6.0

@raolin2025/claude-code-node@3.6.0

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Inspected source supports package-aligned, user-invoked features: no lifecycle hook is declared, notifier API requests require an API key, and npm credentials are used for registry publishing. Scanner hints do not establish unauthorized exfiltration or install-time control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the notifier or CLI and configures a channel or invokes a publishing action.

Impact

No confirmed unauthorized credential transfer, install-time mutation, or other attack behavior was found.

Mechanism

The notifier accepts authenticated commands; the publishing tool uses a local npm token for requests to the npm registry.

AI rationale

Evidence

src/channel/notify-daemon.jssrc/tools/npm-publish.jssrc/security/enhanced-permission.js

Network endpoints2

api.telegram.orgregistry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes CLI entrypoints but defines no install lifecycle hook.
The notifier authenticates API requests with a generated or configured API key; its shell command feature is activated by an explicit remote command.
The npm publishing tool reads a local npm token for explicit publishing actions and sends it to registry.npmjs.org.
The permission module stores project permission rules with restrictive file mode; the SSRF guard blocks loopback and private IPv4 ranges.
The inspected test file contains unit-test coverage descriptions, and the scheduler uses an unreferenced timer.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

15 flagged

src/__tests__/dream.test.jsView file

Lines 401-441javascript

401 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

402 // 无 summarizer → 启发式梦境，方向名为主目标

403 await dm.sleep([

404 { role: 'user', content: '实现排序算法' },

405 { role: 'assistant', content: '完成', toolCalls: [{ name: 'Read', input: {} }] },

406 { role: 'tool', content: 'OK' },

407 { role: 'assistant', content: '用了快速排序' },

408 ], {})

409 // 单短英文词 "OK" 不应因为正文里 tool 结果含 OK 就误命中

410 const ctx = await dm.wakeByDirection('OK')

411 // 正文没有实质 OK 方向，应返回 null 或极弱匹配

412 // 这里排序算法主线不含 OK 关键词，正常应返回 null

413 assert.ok(ctx === null || !ctx.includes('排序算法'))

414})

415

416test('sanitizeSecrets：脱敏 API key / token / 密码 / 私钥', () => {

417 const sk = sanitizeSecrets('key=sk-abcdefgh1234567890')

418 assert.ok(sk.startsWith('key=sk-abc***[redacted:'))

419 assert.ok(!sk.includes('abcdefgh1234567890'))

420 assert.ok(!/sk-abcdefgh1234567890/.test(sanitizeSecrets('使用 sk-abcdefgh1234567890 调用')))

421 assert.ok(sanitizeSecrets('ghp_abcdefghijklmnopqrstuvwxyz1234567890').includes('[redacted'))

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

422 // Bearer token

423 assert.ok(sanitizeSecrets('Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xxxx').includes('[redacted'))

424 // 私钥

425 const pem = '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----'

426 assert.ok(!sanitizeSecrets(pem).includes('MIIEvQIBADANBg'))

427 // 明文普通文本不受影响

428 const normal = '重构 http 客户端，采用指数退避'

429 assert.equal(sanitizeSecrets(normal), normal)

430})

431

432test('安全脱敏：入睡时梦境文本字段不含密钥', async () => {

433 const dir = await mkdtemp(join(tmpdir(), 'dream-sanitize-'))

434 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

435 const dream = await dm.sleep([

436 { role: 'user', content: '配置 API key 为 sk-abcdefgh1234567890 并接入服务' },

437 { role: 'assistant', content: '已配置，使用 ghp_abcdefghijklmnopqrstuvwxyz1234567890 推送', toolCalls: [{ name: 'Read', input: {} }] },

438 { role: 'tool', content: 'OK' },

439 { role: 'assistant', content: '完成' },

440 ], {})

441 const all = await dm.list()

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L444

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

11 */

src/core/scheduler.jsView file

Lines 306-346javascript

306 const raw = readFileSync(execLogFile, 'utf-8')

307 const lines = raw.split('\n')

308 if

src/tools/git-tool.jsView file

Lines 207-247javascript

207 if (labelFilter && !pr.labels?.some(l => l.name === labelFilter)) continue

208 try {

209 const review =

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

15 flagged · loading source

src/__tests__/dream.test.jsView file

421patternName = github_pat severity = critical line = 421

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Findings

8 Critical5 High4 Medium5 Low

CriticalCritical Secretsrc/__tests__/dream.test.js

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

CriticalSecret Patternsrc/__tests__/dream.test.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.6.0.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 02:43:16.621Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.