registry / @saltpub/xiaojiu-agent-bridge / 0.1.3
@saltpub/xiaojiu-agent-bridge@0.1.3
Bridge Xiaojiu IM with local CLI coding agents
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest’s lifecycle scripts perform build and typecheck tasks. The flagged process, network, telemetry, and Claude-history behavior is consistent with the bridge’s CLI and user-invoked resume flow; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; session history is read when the bridge handles /resume.
Impact
No malicious impact was identified; the inspected behavior supports the configured bridge and its user-invoked session-resume flow.
Mechanism
The CLI authenticates to the default Xiaojiu API, and /resume reads local Claude session previews for the bridge chat.
AI rationale
The manifest’s lifecycle scripts perform build and typecheck tasks. The flagged process, network, telemetry, and Claude-history behavior is consistent with the bridge’s CLI and user-invoked resume flow; no concrete attack behavior was found.
Evidence
package.jsondist/cli.js
Network endpoints1
messenger-api.4399om.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json maps the CLI executable to its bin file; its prepare and prepublishOnly scripts run build and typecheck tasks.
- The CLI sends the app secret to the default Xiaojiu messenger API token endpoint.
- Claude session history is read for the /resume command; history previews are withheld in group chats and returned through the bridge chat.
- The optional telemetry module is imported only when its environment variable is set.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @saltpub/xiaojiu-agent-bridge@0.1.1
matchedIdentity = npm:[redacted]:0.1.1
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg24import crossSpawn from "cross-spawn";
L25: import { execFile } from "child_process";
L26: function spawnProcess(command, args = [], options = {}) {
High
3import { join } from "path";
L4: if (!process.env.XIAOJIU_BRIDGE_HOME && process.env.npm[redacted] === "cli") {
L5: const localHome = join(process.cwd(), ".xiaojiu");
L6: if (existsSync(join(localHome, "config.json"))) {
...
L17: import { fileURLToPath } from "url";
L18: var packageJsonPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json");
L19: var manifest = JSON.parse(readFileSync(packageJsonPath, "utf8"));
L20: var packageName = manifest.name;
...
L24: import crossSpawn from "cross-spawn";
L25: import { execFile } from "child_process";
L26: function spawnProcess(command, args = [], options = {}) {
...
L87: let settled = false;
Findings
1 Critical2 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @saltpub/xiaojiu-agent-bridge@0.1.3.
See all versions of @saltpub/xiaojiu-agent-bridge for other recorded verdicts.
- Review the evidence and your use of @saltpub/xiaojiu-agent-bridge@0.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.