registry / @raolin2025/claude-code-node / 3.6.17

@raolin2025/claude-code-node@3.6.17

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Source inspection found explicit CLI entrypoints and a prepublishOnly check, with no automatic install-time attack chain. Credential use is tied to the npm registry publishing workflow or notification-driven child process; no concrete malicious behavior was established.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The CLI or notification daemon is explicitly run; publishing occurs through its publishing tool.

Impact

No unrelated credential exfiltration or unconsented agent control-surface mutation was established.

Mechanism

The publishing tool reads the npm token for requests to the npm registry. The notification daemon forwards configured service credentials to a child CLI when routing a message.

AI rationale

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes the CLI and notification daemon as explicit entrypoints; its only lifecycle hook is prepublishOnly.
The shell tool imports a bash safety guard before providing command execution.
The scheduler source describes task scheduling and bounded history management.
The notification daemon passes configured API credentials to a child CLI for a user message and reads notification configuration; inspected code showed no unrelated credential recipient.
The npm publishing tool reads the npm token and sends it to registry.npmjs.org as part of its publish workflow.
The SSRF guard blocks loopback and private address ranges; enhanced permissions use path and URL safety checks.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

11 flagged

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

src/core/scheduler.jsView file

Lines 306-346javascript

306 const raw = readFileSync(execLogFile, 'utf-8')

307 const lines = raw.split('\n')

308 if (lines.length > EXEC_LOG_KEEP) {

309 const kept = lines.slice(-Math.floor(EXEC_LOG_KEEP / 2))

310 writeFileSync(execLogFile, kept.join('\n'))

311 }

312 } catch { /* 审计日志写入失败不阻断任务 */ }

313 }

314

315 /** 默认 exec 执行器:spawn(cmd,{shell:true,timeout,cwd,env}) → 统一结果 + 审计 */

316 async function defaultRunExec(task) {

317 const cmd = task.action?.cmd || ''

318 const cwd = task.action?.cwd || undefined

319 const timeout = task.timeoutMs ?? EXEC_DEFAULT_TIMEOUT

320 const startedAt = Date.now()

321 const result = { ok: false, error: '', exitCode: null, stdout: '', stderr: '', durationMs: 0 }

322 if (!cmd) { result.error = 'exec 任务缺少 action.cmd'; return result }

323

324 await new Promise((resolve) => {

325 let child

326 try {

327 child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } })

328 } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

329 let out = '', err = ''

330 child.stdout?.on('data', d => { out = (out + d).slice(-2048) })

331 child.stderr?.on('data', d => { err = (err + d).slice(-2048) })

332 child.on('error', e => { result.error = String(e.message || e); resolve() })

333 child.on('close', (code, signal) => {

334 result.exitCode = code

335 result.error = signal ? `killed by ${signal}` : (code === 0 ? '' : `exit code ${code}`)

336 resolve()

337 })

338 })

339 result.ok = result.exitCode === 0 && !result.error

340 result.stdout = result.stdout || ''

341 result.stderr = result.stderr || ''

342 result.durationMs = Date.now() - startedAt

343 return result

344 }

345

346 const runExecFn = runExec || defaultRunExec

src/tools/loadCustomTools.jsView file

135async function loadToolFile(filePath, fallbackName, log) { L136: const mod = await import(pathToFileURL(filePath).href) L137: const raws = collectExports(mod)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/loadCustomTools.jsView on unpkg · L135

src/tools/npm-publish.jsView file

4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）： L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403 L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP ... L14: */ L15: import { execSync } from 'child_process' L16: import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from 'fs' ... L25: 前置条件: L26: - 项目根目录（含 package.json） L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀） ... L97: export function parsePackJson(packJson) { L98: const data = JSON.parse(packJson) L99: const meta = Object.values(data)[0] || {}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/npm-publish.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/npm-publish.jsView on unpkg · L4

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

11 flagged · loading source

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

src/core/scheduler.jsView file

326try { L327: child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } }) L328: } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

src/tools/loadCustomTools.jsView file

135async function loadToolFile(filePath, fallbackName, log) { L136: const mod = await import(pathToFileURL(filePath).href) L137: const raws = collectExports(mod)

Findings

4 Critical5 High4 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

CriticalPrevious Version Dangerous Deltasrc/channel/notify-daemon.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

MediumDynamic Requiresrc/tools/loadCustomTools.js

Medium

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.6.17.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.6.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 20:48:13.539Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.