registry / @raolin2025/claude-code-node / 3.6.14

@raolin2025/claude-code-node@3.6.14

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source inspection did not substantiate the scanner's exfiltration claims: Telegram requests use configured channel credentials, and npm token use is confined to the explicitly selected publishing flow and npm registry. The manifest has no automatic install lifecycle hook; the flagged capabilities do not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the notification daemon with Telegram configured, or selecting a publishing action in the npm tool.

Impact

These inspected flows do not establish hidden credential exfiltration or an unconsented install-time attack.

Mechanism

The daemon sends typing status to the configured Telegram API; the publishing tool sends its npm token to the npm registry for publishing.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines a prepublishOnly check; it has no preinstall, install, or postinstall hook.
The notification daemon sends Telegram typing requests only when a configured bot token and chat ID are present.
The npm publishing tool handles a token for requests to registry.npmjs.org and runs only when an action is selected.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 76 file(s), 779 KB of source, external domains: 127.0.0.1, api.deepseek.com, api.github.com, api.search.brave.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, r.jina.ai, registry.npmjs.org, www.googleapis.com

Source & flagged code

12 flagged

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

src/core/scheduler.jsView file

326try { L327: child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } }) L328: } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

src/tools/loadCustomTools.jsView file

Lines 115-155javascript

115 )

116 }

117

118 return null

119}

120

121/** 从模块导出里收集所有候选原始工具定义 */

122function collectExports(mod) {

123 const out = []

124 if (mod == null) return out

125 if (mod.tools !== undefined) {

126 if (Array.isArray(mod.tools)) out.push(...mod.tools)

127 else out.push(mod.tools)

128 }

129 if (mod.tool !== undefined) out.push(mod.tool)

130 if (mod.default !== undefined) out.push(mod.default)

131 return out.filter((x) => x != null)

132}

133

134/** 加载单个 index.js 文件，返回 ToolDef[] */

135async function loadToolFile(filePath, fallbackName, log) {

136 const mod = await import(pathToFileURL(filePath).href)

137 const raws = collectExports(mod)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/loadCustomTools.jsView on unpkg · L135

138 const defs = []

139 for (const raw of raws) {

140 const def = normalizeTool(raw, fallbackName)

141 if (def) defs.push(def)

142 else log && log(`[custom-tools] 跳过无法识别的导出: ${filePath}`)

143 }

144 return defs

145}

146

147/**

148 * 扫描一个目录，返回 { tools, errors }。

149 * 支持两种布局：<dir>/<name>/index.{js,mjs,cjs}（推荐）与 <dir>/<name>.{js,mjs,cjs}。

150 * @param {string} dir

151 * @param {{source?:string, log?:(m:string)=>void, ensureModule?:boolean}} opts

152 */

153export async function loadToolsFromDir(dir, { source = 'custom', log, ensureModule = true } = {}) {

154 const tools = []

155 const errors = []

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

src/channel/notify-daemon.jsView file

30import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' L33: import crypto from 'node:crypto' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/channel/notify-daemon.jsView on unpkg · L30

22Source sends the broad process environment to a literal external destination. L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/channel/notify-daemon.jsView on unpkg · L22

22Trigger-reachable chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L42: // 生成或加载 API Key L43: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L44: if (!apiKey) { L45: const configDir = join(process.cwd(), '.claude-code') L46: const configPath = join(configDir, 'notify-api-key.txt') ... L76: try {

src/security/ssrf-guard.jsView file

Lines 1-28javascript

1/**

2 * SSRF 防护 — 阻止对内网/云元数据端点的请求

3 * 对应原版：src/utils/hooks/ssrfGuard.ts

4 *

5 * v1.2 修复:

6 * - H4: 完整检测 fe80::/10 范围（fe80:: - febf::），而非仅 fe8 前缀

7 * - H3: 导出 dnsLookup 函数供 query-engine 使用自定义 DNS resolver

8 */

9import { lookup as dnsLookup } from 'dns'

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

src/channel/tg-listener.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @raolin2025/claude-code-node@3.6.13 matchedIdentity = npm:[redacted]:3.6.13 similarity = 0.947 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/channel/tg-listener.jsView on unpkg

Source & flagged code

12 flagged · loading source

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

src/core/scheduler.jsView file

326try { L327: child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } }) L328: } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

src/tools/loadCustomTools.jsView file

135async function loadToolFile(filePath, fallbackName, log) { L136: const mod = await import(pathToFileURL(filePath).href) L137: const raws = collectExports(mod)

Findings

5 Critical5 High4 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

CriticalPrevious Version Dangerous Deltasrc/channel/tg-listener.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.6.14.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.6.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 06:59:50.479Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.