@saltpub/xiaojiu-agent-bridge@0.1.1
Bridge Xiaojiu IM with local CLI coding agents
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo covert install-time behavior, unrelated endpoint, or concrete credential theft was found. The explicit remote-to-local agent execution and persistence capability is dangerous enough to warn, but the inspected code does not establish malicious intent.
Static reason
One or more suspicious static signals were detected.
Trigger
A user configures the bridge and runs its run or start command; an authorized Xiaojiu message then arrives.
Impact
Authorized chat users can cause the configured local coding agent to act in its configured workspace and permissions context.
Mechanism
Webhook-to-local coding-agent execution with optional daemon persistence.
AI rationale
No covert install-time behavior, unrelated endpoint, or concrete credential theft was found. The explicit remote-to-local agent execution and persistence capability is dangerous enough to warn, but the inspected code does not establish malicious intent.
Evidence
dist/cli.jsbin/xiaojiu-agent-bridge.mjs
Network endpoints1
messenger-api.4399om.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Webhook messages are passed to a local coding-agent executor.
- The explicit start command installs and starts an OS-managed daemon with automatic restart.
- The bridge sends configured app credentials to the Xiaojiu API to obtain a token.
Evidence against
- The package has no preinstall, install, or postinstall hook.
- Daemon setup is reached only through an explicit CLI start command.
- Message intake applies owner, user, and chat access checks before queuing work.
- Observed network hosts are the named Xiaojiu API and npm registry; no unrelated exfiltration endpoint was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli.jsView file
24import crossSpawn from "cross-spawn";
L25: import { execFile } from "child_process";
L26: function spawnProcess(command, args = [], options = {}) {
High
2488'Set sh = CreateObject("WScript.Shell")',
L2489: `sh.Run "cmd.exe /c ""${quoted}""", 0, True`,
L2490: ""
High
3import { join } from "path";
L4: if (!process.env.XIAOJIU_BRIDGE_HOME && process.env.npm[redacted] === "cli") {
L5: const localHome = join(process.cwd(), ".xiaojiu");
L6: if (existsSync(join(localHome, "config.json"))) {
...
L17: import { fileURLToPath } from "url";
L18: var packageJsonPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json");
L19: var manifest = JSON.parse(readFileSync(packageJsonPath, "utf8"));
L20: var packageName = manifest.name;
...
L24: import crossSpawn from "cross-spawn";
L25: import { execFile } from "child_process";
L26: function spawnProcess(command, args = [], options = {}) {
...
L87: let settled = false;
High
Findings
3 High4 Medium6 Low
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @saltpub/xiaojiu-agent-bridge@0.1.1.
See all versions of @saltpub/xiaojiu-agent-bridge for other recorded verdicts.
- Review the evidence and your use of @saltpub/xiaojiu-agent-bridge@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.