registry / Remote code execution / @raolin2025/claude-code-node / 3.6.19

@raolin2025/claude-code-node@3.6.19

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The daemon provides a reachable chat command that executes sender-supplied shell text, while the inspected Telegram path does not restrict execution to authorized senders. This is a concrete remote command execution exposure.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A message containing `/run` reaches the configured chat daemon.

Impact

An unauthorized chat user who can reach the configured bot may execute commands with the daemon’s operating-system privileges.

Mechanism

The daemon extracts the command text and executes it with `execSync`; the inspected Telegram message path does not check the sender against an authorized-user list.

Attack narrative

The package publishes `cc-notify` as a command-line entrypoint. Its chat handler executes text after `/run` as a shell command, and the Telegram message path dispatches commands without an evident sender authorization check. This creates a remote command execution path for users able to message the configured bot.

AI rationale

Evidence

package.jsonsrc/channel/notify-daemon.jssrc/channel/tg-listener.js

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Malicious at 92.0% confidence as Malware with low false-positive risk.

Evidence for block

The package exposes the notification daemon as the `cc-notify` executable.
The daemon accepts `/run` messages and passes the supplied command to `execSync`.
Telegram messages are dispatched to command handling without a sender authorization check in the inspected message path.
The Telegram listener also implements shell execution with `execSync`.

Evidence against

The remote command feature is presented as part of the package’s remote programming and notification functionality.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 79 file(s), 831 KB of source, external domains: 127.0.0.1, api.deepseek.com, api.github.com, api.search.brave.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, r.jina.ai, registry.npmjs.org, www.googleapis.com

Source & flagged code

11 flagged

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

11 */

12import { spawn } from 'child_process'

13import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

14import { checkBashSafety } from '../security/bash-guard.js'

15import { detectShell, getShellDescription } from '../utils/shell.js'

16import { createBoundedOutput } from '../utils/output-buffer.js'

18// 启动时探测一次并缓存

19const shellCfg = detectShell()

21/**

22 * 动态生成工具描述，告知 LLM 当前平台的 shell 语义，

23 * 避免模型在 Windows 上写出 Linux 命令导致失败。

24 */

25function buildDescription() {

26 const envHint = getShellDescription()

27 return `Execute a shell command. The command will run in a shell subprocess.

29${envHint}

31Usage:

src/core/scheduler.jsView file

Lines 306-346javascript

306 const raw = readFileSync(execLogFile, 'utf-8')

307 const lines = raw.split('\n')

308

src/tools/loadCustomTools.jsView file

Lines 115-155javascript

115 )

116 }

117

118 return null

119}

120

121/** 从模块导出里收集所有候选原始工具定义 */

122function collectExports(mod) {

123 const

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

src/security/ssrf-guard.jsView file

Lines 1-28javascript

1/**

2 * SSRF 防护 — 阻止对内网/云元数据端点的请求

3 * 对应原版：src/utils/hooks/ssrfGuard.ts

4 *

5 * v1.2 修复:

6 * - H4: 完整检测 fe80::/10 范围（fe80:: - febf::），而非仅 fe8 前缀

7 * - H3: 导出 dnsLookup 函数供 query-engine 使用自定义 DNS resolver

8 */

9import { lookup as dnsLookup } from 'dns'

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

src/channel/tg-listener.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @raolin2025/claude-code-node@3.6.17 matchedIdentity = npm:[redacted]:3.6.17 similarity = 0.922 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/channel/tg-listener.jsView on unpkg

Source & flagged code

11 flagged · loading source

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

src/core/scheduler.jsView file

326try { L327: child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } }) L328: } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

src/tools/loadCustomTools.jsView file

135async function loadToolFile(filePath, fallbackName, log) { L136: const mod = await import(pathToFileURL(filePath).href) L137: const raws = collectExports(mod)

Findings

4 Critical5 High4 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

CriticalPrevious Version Dangerous Deltasrc/channel/tg-listener.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

MediumDynamic Requiresrc/tools/loadCustomTools.js

Medium

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.6.19.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Avoid installing @raolin2025/claude-code-node@3.6.19. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 22:05:21.828Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages