registry / AI-agent capability abuse / alink-cli / 0.10.2

alink-cli@0.10.2

一条命令把工作机接入 AgentLink，随时随地遥控本机的编码 agent。One command to link your machine to AgentLink and control your coding agents from anywhere.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package is not malicious by source evidence, but it intentionally exposes high-impact remote agent capabilities after user pairing. Warn users so this capability is an informed installation decision.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs alink-cli and pairs or logs in a machine.

Impact

A holder of the paired remote-session authority could direct agent-related local file and command operations.

Mechanism

Paired daemon exposes local ACP file and terminal handlers.

AI rationale

Evidence

package.jsonbin/agentlink.jsbin/agentlink-account.jsdist/bin.mjsdist/ui.js~/.agentlink/credential~/.agentlink/session~/.agentlink/daemon.pid

Network endpoints1

wss://link.harmopath.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Explicit CLI startup spawns a local AgentLink daemon with hub credentials.
Daemon implements ACP file writes and terminal process spawning for connected agent sessions.
The package persists a background daemon, so a paired remote session can affect the chosen local workspace.

Evidence against

No npm preinstall/install/postinstall hooks are declared.
Remote-control behavior is documented and activated by explicit CLI use and pairing.
Credentials are stored under the package state directory with mode 0600.
No remote payload decoding/execution was found; the UI hint was a false positive.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

10 flagged

dist/NodeSocket-CLfrrutd.mjsView file

Lines 4844-4884javascript

4844 parent: getOrUndefined(fromHeaders(request.headers)),

4845 kind: "server"

4846 });

4847 const prevServices = fiber.context;

4848 fiber.setContext(add(fiber.context, ParentSpan, span));

4849 return onExitPrimitive(httpApp, (exit) => {

4850 fiber.setContext(prevServices);

4851 const endTime = fiber.getRef(Clock).currentTimeNanosUnsafe();

4852 fiber.currentDispatcher.scheduleTask(() => {

4853 let response;

4854 let spanExit = exit;

4855 if (isFailure(exit)) {

4856 const [failureResponse, cause] = causeResponseStripped(exit.cause);

4857 response = failureResponse;

4858 spanExit = isSome(cause) ? failCause(cause.value) : succeed$4(response);

4859 } else response = exit.value;

4860 if (span.sampled) {

4861 const url = toURL(request);

4862 if (isSome(url) && (url.value.username !== "" || url.value.password !== "")) {

4863 url.value.username = "REDACTED";

4864 url.value.password = "REDACTED";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/NodeSocket-CLfrrutd.mjsView on unpkg · L4864

4865 }

4866 const redactedHeaderNames = fiber.getRef(CurrentRedactedNames);

4867 const requestHeaders = redact(request.headers, redactedHeaderNames);

4868 span.attribute("http.request.method", request.method);

4869 if (isSome(url)) {

4870 span.attribute("url.full", url.value.toString());

4871 span.attribute("url.path", url.value.pathname);

4872 if (url.value.search.slice(1) !== "") span.attribute("url.query", url.value.search.slice(1));

4873 span.attribute("url.scheme", url.value.protocol.slice(0, -1));

4874 }

4875 if (request.headers["user-agent"] !== void 0) span.attribute("user_agent.original", request.headers["user-agent"]);

4876 for (const name in requestHeaders) span.attribute(`http.request.header.${name}`, String(requestHeaders[name]));

4877 if (isSome(request.remoteAddress)) span.attribute("client.address", request.remoteAddress.value);

4878 span.attribute("http.response.status_code", response.status);

4879 const responseHeaders = redact(response.headers, redactedHeaderNames);

4880 for (const name in responseHeaders) span.attribute(`http.response.header.${name}`, String(responseHeaders[name]));

4881 }

4882 span.end(endTime, spanExit);

4883 }, 0);

4884 }, true);

bin/agentlink.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

1Cross-file remote execution chain: bin/agentlink.js spawns dist/ui.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; ... L8: import { fileURLToPath } from "node:url"; L9: import WebSocket from "ws"; L10: ... L26: } L27: const saved = JSON.parse(raw); L28: return saved.hub === normalizeHub(hub) && typeof saved.jwt === "string" ? saved.jwt : undefined; ... L57: L58: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com"; L59: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentlink.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = bin/agentlink.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/agentlink.jsView on unpkg

dist/ui.jsView file

317"use strict"; L318: if (process.env.NODE_ENV !== "production") { L319: (function() { ... L545: isMounted: ["isMounted", "Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks."], L546: replaceState: ["replaceState", "Refactor your code to use setState instead (see https://github.com/facebook/react/issues/3236)."] L547: }; ... L2209: ]; L2210: if (process.platform !== "win32") { L2211: module.exports.push( ... L2357: } L2358: process13.exitCode = code || /* istanbul ignore next */ L2359: 0;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/ui.jsView on unpkg · L317

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/ui.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui.jsView on unpkg

dist/bin.mjsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/bin.mjs matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin.mjsView on unpkg

dist/NodeServices-BtcL7AtO.mjsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/NodeServices-BtcL7AtO.mjs matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-BtcL7AtO.mjsView on unpkg

dist/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/daemon.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/NodeSocket-CLfrrutd.mjsView file

4864patternName = generic_password severity = medium line = 4864 matchedText = url.valu...ED";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/NodeSocket-CLfrrutd.mjsView on unpkg · L4864

bin/agentlink.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

Findings

1 Critical8 High5 Medium4 Low

CriticalRemote Asset Decode Executedist/ui.js

HighChild Processbin/agentlink.js

HighShell

HighCross File Remote Execution Contextbin/agentlink.js

HighKnown Malware Source Similaritydist/bin.mjs

HighKnown Malware Source Similaritydist/ui.js

HighKnown Malware Source Similaritybin/agentlink.js

HighKnown Malware Source Similaritydist/NodeServices-BtcL7AtO.mjs

HighKnown Malware Source Similaritydist/daemon.js

MediumSecret Patterndist/NodeSocket-CLfrrutd.mjs

MediumDynamic Requirebin/agentlink.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to alink-cli@0.10.2.

See all versions of alink-cli for other recorded verdicts.

Review the evidence and your use of alink-cli@0.10.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-24 22:21:13.129Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code