registry / Remote code execution / @raolin2025/claude-code-node / 3.6.18

@raolin2025/claude-code-node@3.6.18

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The direct Telegram `/run` shell path creates a real, conditionally reachable host command-execution risk, but it is an explicit remote-control feature and source does not establish public reachability or malicious intent. The credential and account-action hints do not establish a separate attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A `/run <command>` message reaches the configured Telegram bot.

Impact

An unintended bot user could execute host commands and read or alter data available to the daemon’s account.

Mechanism

The daemon passes the message text to `execSync` and sends the command output back to the chat.

AI rationale

Evidence

src/channel/notify-daemon.jssrc/channel/tg-listener.js

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes the notification daemon as a command-line entry point; its manifest has no automatic install hook.
A configured Telegram listener forwards incoming messages to the notification handler, which executes `/run` text directly with `execSync` and returns command output to the chat. The inspected message path does not check sender identity, so exposure depends on who can message the configured bot.
The daemon’s HTTP API checks an API key; this check is separate from the Telegram message path.
The npm publishing tool reads the local npm token for explicit publish actions and is registered in ask mode; the inspected credential and account-action navigation points do not establish unrelated credential transfer or automatic account changes.

Evidence against

A configured bot can expose host command execution to people able to message it, without a sender-identity check in the inspected path; the source does not establish that the bot is publicly discoverable or who can reach it.

Behavioral surface

Source

ChildProcess

Source & flagged code

10 flagged

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

src/core/scheduler.jsView file

326try { L327: child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } }) L328: } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

src/tools/loadCustomTools.jsView file

135async function loadToolFile(filePath, fallbackName, log) { L136: const mod = await import(pathToFileURL(filePath).href) L137: const raws = collectExports(mod)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/loadCustomTools.jsView on unpkg · L135

src/tools/npm-publish.jsView file

4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）： L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403 L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP ... L14: */ L15: import { execSync } from 'child_process' L16: import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from 'fs' ... L25: 前置条件: L26: - 项目根目录（含 package.json） L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀） ... L97: export function parsePackJson(packJson) { L98: const data = JSON.parse(packJson) L99: const meta = Object.values(data)[0] || {}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/npm-publish.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/npm-publish.jsView on unpkg · L4

src/channel/notify-daemon.jsView file

30import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' L33: import crypto from 'node:crypto' ... L43: // 生成或加载 API Key L44: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L45: if (!apiKey) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/channel/notify-daemon.jsView on unpkg · L30

22Trigger-reachable chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L43: // 生成或加载 API Key L44: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L45: if (!apiKey) { L46: const configDir = join(process.cwd(), '.claude-code') L47: const configPath = join(configDir, 'notify-api-key.txt') ... L77: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/channel/notify-daemon.jsView on unpkg · L22

22Trigger-reachable credential exfiltration chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L43: // 生成或加载 API Key L44: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L45: if (!apiKey) { L46: const configDir = join(process.cwd(), '.claude-code') L47: const configPath = join(configDir, 'notify-api-key.txt') ... L77: try {

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

10 flagged · loading source

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

src/core/scheduler.jsView file

326try { L327: child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } }) L328: } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

src/tools/loadCustomTools.jsView file

135async function loadToolFile(filePath, fallbackName, log) { L136: const mod = await import(pathToFileURL(filePath).href) L137: const raws = collectExports(mod)

Findings

3 Critical5 High4 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

MediumDynamic Requiresrc/tools/loadCustomTools.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.6.18.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.6.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 21:55:44.845Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code