registry / @yoooclaw/phone-notifications / 1.13.0
@yoooclaw/phone-notifications@1.13.0
⚠ Under review后台同步手机通知数据到本地存储，供 Agent 查询消费
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/bin/ntf.cjsView file
67class CommanderError extends Error {
L68: constructor(exitCode, code, message) {
L69: super(message);
...
L785: var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
L787: var path = require("node:path");
...
L831: this._outputConfiguration = {
L832: writeOut: (str) => process2.stdout.write(str),
L833: writeErr: (str) => process2.stderr.write(str),
...
L2190: }
L2191: function homeDir() {
L2192: return process.env.HOME || process.env.USERPROFILE || "/tmp";
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/bin/ntf.cjsView on unpkg · L67785var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
L787: var path = require("node:path");
High
784var require_command = __commonJS((exports2) => {
L785: var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
Medium
Findings
3 Critical2 High4 Medium6 Low
CriticalCredential Exfiltrationdist/index.cjs
CriticalCommand Output Exfiltrationdist/bin/ntf.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighChild Processdist/bin/ntf.cjs
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
MediumDynamic Requiredist/bin/ntf.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.cjs
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @yoooclaw/phone-notifications@1.13.0.
See all versions of @yoooclaw/phone-notifications for other recorded verdicts.
- Review the evidence and your use of @yoooclaw/phone-notifications@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.