registry / @raolin2025/claude-code-node / 3.6.21

@raolin2025/claude-code-node@3.6.21

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The credential flow is tied to explicit npm publishing actions and sends the token to the npm registry. The manifest has no install hook, and the inspected flagged runtime operations support the package's stated CLI and integration functions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user invokes a publishing action through the npm publishing tool.

Impact

The inspected flow supports publishing to the token's intended service; no unrelated credential transfer or automatic install-time mutation was identified.

Mechanism

The tool reads the token from the user's npm configuration and uses it for npm registry requests.

AI rationale

Evidence

src/tools/npm-publish.js

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines the CLI entrypoints and a prepublishOnly check; it has no install lifecycle hook.
The publishing tool reads an existing npm token, and its publish actions use that token for requests to the npm registry.
The flagged i18n and multiline-input operations perform text interpolation and terminal cursor calculations.
Shell execution is exposed as a tool with a safety check; the process helper runs commands only when called.
The remaining flagged files cover scheduling, notifications, SSRF and permission checks, MCP command validation, and QQ and Telegram integrations.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 80 file(s), 860 KB of source, external domains: 127.0.0.1, api.deepseek.com, api.github.com, api.search.brave.com, api.sgroup.qq.com, api.telegram.org, bots.qq.com, r.jina.ai, registry.npmjs.org, www.googleapis.com

Source & flagged code

19 flagged

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

11 */

12import { spawn } from 'child_process'

13import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

14import { checkBashSafety } from '../security/bash-guard.js'

15import { detectShell, getShellDescription } from '../utils/shell.js'

16import { createBoundedOutput } from '../utils/output-buffer.js'

18// 启动时探测一次并缓存

19const shellCfg = detectShell()

21/**

22 * 动态生成工具描述，告知 LLM 当前平台的 shell 语义，

23 * 避免模型在 Windows 上写出 Linux 命令导致失败。

24 */

25function buildDescription() {

26 const envHint = getShellDescription()

27 return `Execute a shell command. The command will run in a shell subprocess.

29${envHint}

31Usage:

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/tools/bash.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/bash.jsView on unpkg

src/core/scheduler.jsView file

Lines 306-346javascript

306 const raw = readFileSync(execLogFile, 'utf-8')

307 const lines = raw.split('\n')

308

src/tools/loadCustomTools.jsView file

Lines 115-155javascript

115 )

116 }

117

118 return null

119}

120

121/** 从模块导出里收集所有候选原始工具定义 */

122function collectExports(mod) {

123 const

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

src/security/ssrf-guard.jsView file

Lines 1-28javascript

1/**

2 * SSRF 防护 — 阻止对内网/云元数据端点的请求

3 * 对应原版：src/utils/hooks/ssrfGuard.ts

4 *

5 * v1.2 修复:

6 * - H4: 完整检测 fe80::/10 范围（fe80:: - febf::），而非仅 fe8 前缀

7 * - H3: 导出 dnsLookup 函数供 query-engine 使用自定义 DNS resolver

8 */

9import { lookup as dnsLookup } from 'dns'

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

src/mcp/client.jsView file

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/mcp/client.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp/client.jsView on unpkg

src/channel/qqbot-enhanced.jsView file

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/channel/qqbot-enhanced.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/channel/qqbot-enhanced.jsView on unpkg

src/channel/tg-listener.jsView file

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/channel/tg-listener.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/channel/tg-listener.jsView on unpkg

src/utils/process.jsView file

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/utils/process.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/process.jsView on unpkg

src/security/bash-guard.jsView file

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/security/bash-guard.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/security/bash-guard.jsView on unpkg

Source & flagged code

19 flagged · loading source

src/tools/bash.jsView file

11*/ L12: import { spawn } from 'child_process' L13: import { ToolDef } from '../types/index.js'

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L11

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/bash.jsView on unpkg

src/core/scheduler.jsView file

326try { L327: child = spawn(cmd, { shell: true, cwd, timeout, env: { ...process.env, ...(task.action?.env || {}) } }) L328: } catch (e) { result.error = String(e.message || e); return resolve() }

High

Shell

Package source references shell execution.

src/core/scheduler.jsView on unpkg · L326

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/core/scheduler.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/scheduler.jsView on unpkg

src/tools/loadCustomTools.jsView file

135async function loadToolFile(filePath, fallbackName, log) { L136: const mod = await import(pathToFileURL(filePath).href) L137: const raws = collectExports(mod)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/loadCustomTools.jsView on unpkg · L135

src/tools/npm-publish.jsView file

4* 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）： L5: * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403 L6: * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP ... L14: */ L15: import { execSync } from 'child_process' L16: import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from 'fs' ... L25: 前置条件: L26: - 项目根目录（含 package.json） L27: - ~/.npmrc 中配置了 bypass-2FA 的 _authToken（npm_... 前缀） ... L97: export function parsePackJson(packJson) { L98: const data = JSON.parse(packJson) L99: const meta = Object.values(data)[0] || {}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/npm-publish.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/tools/npm-publish.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/npm-publish.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/npm-publish.jsView on unpkg · L4

src/channel/notify-daemon.jsView file

30import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' L33: import crypto from 'node:crypto' ... L43: // 生成或加载 API Key L44: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L45: if (!apiKey) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/channel/notify-daemon.jsView on unpkg · L30

22Trigger-reachable chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L43: // 生成或加载 API Key L44: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L45: if (!apiKey) { L46: const configDir = join(process.cwd(), '.claude-code') L47: const configPath = join(configDir, 'notify-api-key.txt') ... L77: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/channel/notify-daemon.jsView on unpkg · L22

22Trigger-reachable credential exfiltration chain: manifest.bin -> src/channel/notify-daemon.js L22: */ L23: import { createServer } from 'node:http' L24: import { ... L30: import { homedir } from 'node:os' L31: import { spawn, execSync } from 'node:child_process' L32: import { createConnection } from 'node:net' ... L43: // 生成或加载 API Key L44: let apiKey = process.env.CC_NOTIFY_API_KEY || '' L45: if (!apiKey) { L46: const configDir = join(process.cwd(), '.claude-code') L47: const configPath = join(configDir, 'notify-api-key.txt') ... L77: try {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

src/channel/notify-daemon.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = @raolin2025/claude-code-node@3.6.19 matchedPath = src/channel/notify-daemon.js matchedIdentity = npm:[redacted]:3.6.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/channel/notify-daemon.jsView on unpkg

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

src/mcp/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp/client.jsView on unpkg

src/channel/qqbot-enhanced.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/channel/qqbot-enhanced.jsView on unpkg

src/channel/tg-listener.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/channel/tg-listener.jsView on unpkg

src/utils/process.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/process.jsView on unpkg

src/security/bash-guard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/security/bash-guard.jsView on unpkg

Findings

3 Critical14 High4 Medium6 Low

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/security/enhanced-permission.js

HighTrigger Reachable Credential Exfiltrationsrc/channel/notify-daemon.js

HighKnown Malware Source Similaritysrc/channel/notify-daemon.js

HighKnown Malware Source Similaritysrc/mcp/client.js

HighKnown Malware Source Similaritysrc/tools/npm-publish.js

HighKnown Malware Source Similaritysrc/channel/qqbot-enhanced.js

HighKnown Malware Source Similaritysrc/channel/tg-listener.js

HighKnown Malware Source Similaritysrc/core/scheduler.js

HighKnown Malware Source Similaritysrc/utils/process.js

HighKnown Malware Source Similaritysrc/tools/bash.js

HighKnown Malware Source Similaritysrc/security/bash-guard.js

MediumDynamic Requiresrc/tools/loadCustomTools.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/tools/npm-publish.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.6.21.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.6.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 06:52:42.142Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.