registry / AI-agent capability abuse / @raolin2025/claude-code-node / 3.6.3

@raolin2025/claude-code-node@3.6.3

Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications, Telegram & QQ Bot remote programming, rich media upload, multi-account management

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Static inspection found a remote chat command path to shell execution without a demonstrated sender restriction, creating unresolved access-control risk. The npm token handling is scoped to an explicit publish action against the npm registry, and the manifest has no install hook.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A configured Telegram or QQ bot receives a message beginning with `/run ` or `run `.

Impact

A sender able to reach the bot command handler may cause commands to run with the daemon's operating-system privileges.

Mechanism

The daemon extracts the command text and passes it to execSync, then returns command output through the chat integration.

AI rationale

Evidence

src/channel/notify-daemon.js

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The notification daemon processes incoming chat messages and executes `/run` commands through a shell subprocess.
The package describes Telegram and QQ remote programming as a feature, but the command handler does not show a sender authorization check.
Telegram integration uses a configured bot token; this supports a user-configured remote-control feature, while leaving access control unresolved.
The npm publish tool sends its token to the npm registry as a Bearer credential during an explicit publish action.

Evidence against

The manifest defines no install lifecycle scripts, so the reviewed behavior is not triggered during package installation.
The npm publish credential is sent to registry.npmjs.org for a user-selected publish action.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

15 flagged

src/__tests__/dream.test.jsView file

Lines 401-441javascript

401 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

402 // 无 summarizer → 启发式梦境，方向名为主目标

403 await dm.sleep([

404 { role: 'user', content: '实现排序算法' },

405 { role: 'assistant', content: '完成', toolCalls: [{ name: 'Read', input: {} }] },

406 { role: 'tool', content: 'OK' },

407 { role: 'assistant', content: '用了快速排序' },

408 ], {})

409 // 单短英文词 "OK" 不应因为正文里 tool 结果含 OK 就误命中

410 const ctx = await dm.wakeByDirection('OK')

411 // 正文没有实质 OK 方向，应返回 null 或极弱匹配

412 // 这里排序算法主线不含 OK 关键词，正常应返回 null

413 assert.ok(ctx === null || !ctx.includes('排序算法'))

414})

415

416test('sanitizeSecrets：脱敏 API key / token / 密码 / 私钥', () => {

417 const sk = sanitizeSecrets('key=sk-abcdefgh1234567890')

418 assert.ok(sk.startsWith('key=sk-abc***[redacted:'))

419 assert.ok(!sk.includes('abcdefgh1234567890'))

420 assert.ok(!/sk-abcdefgh1234567890/.test(sanitizeSecrets('使用 sk-abcdefgh1234567890 调用')))

421 assert.ok(sanitizeSecrets('ghp_abcdefghijklmnopqrstuvwxyz1234567890').includes('[redacted'))

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

422 // Bearer token

423 assert.ok(sanitizeSecrets('Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xxxx').includes('[redacted'))

424 // 私钥

425 const pem = '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----'

426 assert.ok(!sanitizeSecrets(pem).includes('MIIEvQIBADANBg'))

427 // 明文普通文本不受影响

428 const normal = '重构 http 客户端，采用指数退避'

429 assert.equal(sanitizeSecrets(normal), normal)

430})

431

432test('安全脱敏：入睡时梦境文本字段不含密钥', async () => {

433 const dir = await mkdtemp(join(tmpdir(), 'dream-sanitize-'))

434 const dm = new DreamManager({ dreamsDir: dir, summarizer: null })

435 const dream = await dm.sleep([

436 { role: 'user', content: '配置 API key 为 sk-abcdefgh1234567890 并接入服务' },

437 { role: 'assistant', content: '已配置，使用 ghp_abcdefghijklmnopqrstuvwxyz1234567890 推送', toolCalls: [{ name: 'Read', input: {} }] },

438 { role: 'tool', content: 'OK' },

439 { role: 'assistant', content: '完成' },

440 ], {})

441 const all = await dm.list()

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L444

src/tools/bash.jsView file

Lines 1-31javascript

1/**

2 * Bash 工具 — 执行 shell 命令（跨平台）

3 * 对应原版: src/tools/BashTool/

4 *

5 * 跨平台：通过 src/utils/shell.js 探测层自动选择可用 shell。

6 * - Linux/macOS → /bin/bash（或 SHELL）

7 * - Windows (Git Bash) → Git Bash（bash 语义）

8 * - Windows (WSL) → wsl bash（bash 语义）

9 * - Windows (PS) → PowerShell

10 * - Windows (cmd) → cmd.exe 兜底

11 */

src/core/scheduler.jsView file

Lines 306-346javascript

306 const raw = readFileSync(execLogFile, 'utf-8')

307 const lines = raw.split('\n')

308 if

src/tools/git-tool.jsView file

Lines 207-247javascript

207 if (labelFilter && !pr.labels?.some(l => l.name === labelFilter)) continue

208 try {

209 const review =

src/tools/npm-publish.jsView file

Lines 1-24javascript

1/**

2 * NpmPublish - npm 发布一键工具

3 *

4 * 封装了本项目 npm 发布的全部经验（见 NPM_STAGED_PUBLISH_GUIDE.md）：

5 * - 标准 `npm publish` 常因 npm CLI 强制 otplease/2FA 返回 403

6 * - 最有效方法：bypass-2FA GAT token + 手动构造 PUT 请求 + `npm-auth-type: bearer`，无需 OTP

7 *

8 * 功能：

9 * - version 升版本号（patch/minor/major 或指定版本）

10 * - status 检查登录 / 当前版本 / registry 版本 / 暂存区状态

src/channel/notify-daemon.jsView file

Lines 2-50javascript

2 * cc-notify — 通知守护进程（v2.0 增强版）

3 *

4 * 架构：

5 * Telegram ← Bot API → cc-notify (长轮询) → cc-node

src/security/ssrf-guard.jsView file

8*/ L9: import { lookup as dnsLookup } from 'dns' L10: import { isIP } from 'net'

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/security/ssrf-guard.jsView on unpkg · L8

src/security/enhanced-permission.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ult.reasons.join('; ') : undefined, detail: result, } } case 'webfetch': { const url = input.url || '' if (!url) return { safe: true } const result = await checkurlsafety(url) return { safe: result.allowed, reason: result.reason, } } default: return { safe: true } } } _extractpattern(toolname, input) { switch (toolname) { case 'bash': return input.command || '' case 'read': case 'edit': case 'write': return input.file_path || '' case 'glob': case 'grep':

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/security/enhanced-permission.jsView on unpkg

Source & flagged code

15 flagged · loading source

src/__tests__/dream.test.jsView file

421patternName = github_pat severity = critical line = 421

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/__tests__/dream.test.jsView on unpkg · L421

421patternName = github_pat severity = critical line = 421

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L421

437patternName = github_pat severity = critical line = 437

Critical

Secret Pattern

GitHub personal access token in src/__tests__/dream.test.js

src/__tests__/dream.test.jsView on unpkg · L437

444patternName = github_pat severity = critical line = 444

Findings

8 Critical5 High4 Medium5 Low

CriticalCritical Secretsrc/__tests__/dream.test.js

CriticalSame File Env Network Executionsrc/channel/notify-daemon.js

CriticalHardcoded Runtime Data Exfiltrationsrc/channel/notify-daemon.js

CriticalCredential Exfiltrationsrc/tools/npm-publish.js

CriticalTrigger Reachable Dangerous Capabilitysrc/channel/notify-daemon.js

CriticalSecret Patternsrc/__tests__/dream.test.js

HighChild Processsrc/tools/bash.js

HighShellsrc/core/scheduler.js

HighCloud Metadata Accesssrc/security/ssrf-guard.js

Affected versions and remediation

This report applies to @raolin2025/claude-code-node@3.6.3.

See all versions of @raolin2025/claude-code-node for other recorded verdicts.

Review the evidence and your use of @raolin2025/claude-code-node@3.6.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 03:23:33.280Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code