registry / Remote code execution / @raolin2025/claude-code-node / 3.6.10

@raolin2025/claude-code-node@3.6.10

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The daemon provides remote shell execution through Telegram without a sender authorization check, creating a concrete remote command execution risk once an operator configures the bot. The inspected npm credential handling is tied to an explicit publish operation and the npm registry.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An operator configures and starts the notification daemon with a Telegram bot token; a Telegram user sends a `/run` command to that bot.

Impact

A user able to message the bot can execute shell commands with the daemon's operating-system privileges.

Mechanism

The handler strips the `/run` prefix and passes the remaining message to `execSync`.

AI rationale

Evidence

src/channel/notify-daemon.js

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

The notification daemon treats incoming `/run` messages as commands and executes the supplied text with `execSync`.
When configured with a Telegram token, the daemon forwards listener messages to the same handler; that handler has no sender authorization check before command processing.
This creates remote command execution for users able to message the configured bot. The inspected HTTP API has a separate API key check.

Evidence against

The manifest has no install lifecycle scripts; the daemon is an explicit CLI entrypoint.
The npm publishing code sends its token to the npm registry as part of an explicitly invoked publish operation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Source & flagged code

15 flagged

src/__tests__/dream.test.jsView file

Lines 401-441javascript

401 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

402 // 无 summarizer → 启发式梦境，方向名为主目标

403 await dm.sleep([

404 { role: 'user', content: '实现排序算法' },

405 { role: 'assistant', content: '完成', toolCalls: [{ name: 'Read', input: {} }] },

406 { role: 'tool', content: 'OK' },

407 { role: 'assistant', content: '用了快速排序' },

408 ], {})

409 // 单短英文词 "OK" 不应因为正文里 tool 结果含 OK 就误命中

410 const ctx = await dm.wakeByDirection('OK')

411 // 正文没有实质 OK 方向，应返回 null 或极弱匹配

412 // 这里排序算法主线不含 OK 关键词，正常应返回 null

413 assert.ok(ctx === null || !ctx.includes('排序算法'))

414})

415

416test('sanitizeSecrets：脱敏 API key / token / 密码 / 私钥', () => {

417 const sk = sanitizeSecrets('key=sk-abcdefgh1234567890')

418 assert.ok(sk.startsWith('key=sk-abc***[redacted:'))

419 assert.ok(!sk.includes('abcdefgh1234567890'))

420 assert.ok(!/sk-abcdefgh1234567890/.test(sanitizeSecrets('使用 sk-abcdefgh1234567890 调用')))

421 assert.ok(sanitizeSecrets('ghp_abcdefghijklmnopqrstuvwxyz1234567890').includes('[redacted'))

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

422 // Bearer token

423 assert.ok(sanitizeSecrets('Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xxxx').includes('[redacted'))

424 // 私钥

425 const pem = '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----'

426 assert.ok(!sanitizeSecrets(pem).includes('MIIEvQIBADANBg'))

427 // 明文普通文本不受影响

428 const normal = '重构 http 客户端，采用指数退避'

429 assert.equal(sanitizeSecrets(normal), normal)

430})

431

432test('安全脱敏：入睡时梦境文本字段不含密钥', async () => {

433 const dir = await mkdtemp(join(tmpdir(), 'dream-sanitize-'))

434 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

435 const dream = await dm.sleep([

436 { role: 'user', content: '配置 API key 为 sk-abcdefgh1234567890 并接入服务' },

437 { role: 'assistant', content: '已配置，使用 ghp_abcdefghijklmnopqrstuvwxyz1234567890 推送', toolCalls: [{ name: 'Read', input: {} }] },

438 { role: 'tool', content: 'OK' },

439 { role: 'assistant', content: '完成' },

440 ], {})

441 const all = await dm.list()

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L444

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

11 */

src/core/scheduler.jsView file

Lines 306-346javascript

306 const raw = readFileSync(execLogFile, 'utf-8')

307 const lines = raw.split('\n')

308

src/tools/loadCustomTools.jsView file

Lines 115-155javascript

115 )

116 }

117

118 return null

119}

120

121/** 从模块导出里收集所有候选原始工具定义 */

122function collectExports(mod) {

123 const

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

15 flagged · loading source

src/__tests__/dream.test.jsView file

421patternName = github_pat severity = critical line = 421

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Findings

8 Critical5 High4 Medium5 Low

CriticalCritical Secretsrc/__tests__/dream.test.js

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

CriticalSecret Patternsrc/__tests__/dream.test.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.6.10.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.6.10 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 06:52:15.662Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code