registry / Remote code execution / agents-chat-cli / 3.39.0

agents-chat-cli@3.39.0

多智能体群聊工具 - 支持 OpenCode/Claude Code/Codex/pi 内核，微信风格聊天界面

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains a network-reachable, unauthenticated shell endpoint and an automatic global install lifecycle action. The code supports a critical remote-command-execution risk, but the inspected source does not establish covert malware intent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Install the package or start its CLI; then reach the service's terminal API from a network-accessible client.

Impact

An attacker able to reach the service can execute arbitrary shell commands with the service user's permissions and can alter the user's OpenCode provider configuration.

Mechanism

Postinstall global package installation and unauthenticated shell command forwarding over HTTP.

AI rationale

Evidence

scripts/postinstall.jsapp/lib/kernel-setup.jsapp/server.jsapp/lib/oc.js

Decision evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The manifest runs a postinstall hook automatically.
The postinstall hook calls kernel setup, which globally installs opencode-ai when no supported AI CLI is found.
The HTTP terminal endpoint writes request data directly to a spawned shell's standard input without authentication.
The server listens without a loopback host restriction, so the terminal endpoint can be reachable from the network.
The service can also write OpenCode's global configuration, including a custom provider endpoint and key.

Evidence against

No package self-dependency or staged payload was found.
Registry update checks target this package's npm registry endpoint.
The AI CLI execution and configuration features are consistent with the package's stated chat-agent function, although their exposure is unsafe.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Source & flagged code

19 flagged

package.jsonView file

Lines 21-44json

21 "opencode",

22 "claude",

23 "codex"

24 ],

25 "license": "MIT",

26 "engines": {

27 "node": ">=18.0.0"

28 },

29 "repository": {

30 "type": "git",

31 "url": "https://github.com/iamsamyiok/agents-chat"

32 },

33 "bugs": {

34 "url": "https://github.com/iamsamyiok/agents-chat/issues"

35 },

36 "homepage": "https://github.com/iamsamyiok/agents-chat",

37 "scripts": {

38 "start": "node app/server.js",

39 "test": "node --test --test-force-exit \"test/*.test.js\"",

40 "build:exe": "node scripts/build-exe.js",

41 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 }

43}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

app/server.jsView file

Lines 1-29javascript

1// Agents Chat Portable - 零依赖 HTTP 服务

2// 启动：node app/server.js [--port 3456]

3const APP_VERSION = require('../package.json').version; // 单源版本：与 package.json 始终一致（页面互检/更新检查共用）

4const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck'

bin/agents-chat.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * agents-chat CLI 入口

4 *

5 * 用法:

6 * agents-chat # 启动服务（后台运行）

7 * agents-chat start # 同上

8 * agents-chat stop # 停止服务

9 * agents-chat status # 查看服务状态（含版本与更新检查）

10 * agents-chat open # 仅打开浏览器

11 * agents-chat update # 检查并一键升级到 npm 最新版

scripts/postinstall.jsView file

Lines 1-11javascript

1#!/usr/bin/env node

2// npm 安装钩子：全无 AI 内核时自动安装 opencode，小白开箱即用

3// 铁律：任何失败只提示不抛错——postinstall 非零退出会连带 npm install 整体报错

4try {

5 const { ensureDefaultKernel } = require('../app/lib/kernel-setup');

6 const r

app/lib/kernel-setup.jsView file

3// 单文件 exe 形态无 npm，跳过；AGENTS_CHAT_AUTO_INSTALL=0 可关闭。 L4: // 原则：任何失败只提示，绝不抛错（postinstall 失败会连带 npm install 整体失败）。 L5: const { execSync } = require('child_process'); L6:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/lib/kernel-setup.jsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = agents-chat-cli@3.39.1 matchedPath = app/lib/kernel-setup.js matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.39.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High