registry / alink-cli / 0.11.7

alink-cli@0.11.7

一条命令把工作机接入 AgentLink，随时随地遥控本机的编码 agent。One command to link your machine to AgentLink and control your coding agents from anywhere.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Scanner hits come from a user-run remote-agent CLI plus large esbuild bundles of Effect, Ink, and the T3 serve daemon, not from install hooks or a hidden loader. Source shows package-aligned pairing to link.harmopath.com and local ACP agent launch.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The user installs the package and later runs agentlink, alink, or alink-cli.

Impact

No confirmed covert theft, remote payload, or unconsented agent-config hijack.

Mechanism

User-invoked AgentLink CLI and local hub daemon

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json publishes only bin CLIs and build/test/prepack scripts; there is no preinstall, install, or postinstall hook.
bin/agentlink.js is a user-run CLI that pairs with the documented AgentLink hub and starts the local dist/bin.mjs daemon.
dist/ui.js is the bundled Ink TUI; it uses the same official hub and local daemon-control path.
dist/NodeServices-BtcL7AtO.mjs is bundled Effect child-process platform code, not a hidden loader.
dist/daemon.js is the AgentLink ACP adapter that launches already-installed local coding-agent CLIs.
dist/bin.mjs is the bundled serve/hub-tunnel daemon copied in by the documented build, with AgentLink hub flags.

Evidence against

The scanner treated local dynamic imports and bundled T3/Effect/Ink sources as remote payload execution and known malware.
The CLI can attach a local agent daemon to a user- or env-selected hub and the bundled T3 daemon has default PostHog telemetry.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

9 flagged

bin/agentlink.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; L4: import { createServer } from "node:http"; L5: import { existsSync } from "node:fs"; ... L28: } L29: const saved = JSON.parse(raw); L30: return saved.hub === normalizeHub(hub) && typeof saved.jwt === "string" ? saved.jwt : undefined; ... L59: L60: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com"; L61: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink"); L62: const CREDENTIAL_FILE = join(STATE_DIR, "credential");

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/agentlink.jsView on unpkg · L1

•Trigger-reachable chain: manifest.bin -> bin/agentlink.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/agentlink.jsView on unpkg

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

1Cross-file remote execution chain: bin/agentlink.js spawns dist/bin.mjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; L4: import { createServer } from "node:http"; L5: import { existsSync } from "node:fs"; ... L28: } L29: const saved = JSON.parse(raw); L30: return saved.hub === normalizeHub(hub) && typeof saved.jwt === "string" ? saved.jwt : undefined; ... L59: L60: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com"; L61: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink"); L62: const CREDENTIAL_FILE = join(STATE_DIR, "credential");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentlink.jsView on unpkg · L1

221async function printQr(text) { L222: const { renderQr } = await import(new URL("../dist/qr.js", import.meta.url)); L223: renderQr(text);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agentlink.jsView on unpkg · L221

dist/ui.jsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/ui.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui.jsView on unpkg

dist/NodeServices-BtcL7AtO.mjsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/NodeServices-BtcL7AtO.mjs matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-BtcL7AtO.mjsView on unpkg

dist/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/daemon.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon.jsView on unpkg

dist/bin.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = alink-cli@0.12.6 matchedIdentity = npm:YWxpbmstY2xp:0.12.6 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.mjsView on unpkg

Source & flagged code

9 flagged · loading source

bin/agentlink.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/agentlink.jsView on unpkg · L1

•Trigger-reachable chain: manifest.bin -> bin/agentlink.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/agentlink.jsView on unpkg

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Findings

3 Critical6 High4 Medium5 Low

CriticalRemote Asset Decode Executebin/agentlink.js

CriticalTrigger Reachable Dangerous Capabilitybin/agentlink.js

CriticalPrevious Version Dangerous Deltadist/bin.mjs

HighChild Processbin/agentlink.js

HighShell

HighCross File Remote Execution Contextbin/agentlink.js

HighKnown Malware Source Similaritydist/ui.js

HighKnown Malware Source Similaritydist/NodeServices-BtcL7AtO.mjs

HighKnown Malware Source Similaritydist/daemon.js

MediumDynamic Requirebin/agentlink.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to alink-cli@0.11.7.

See all versions of alink-cli for other recorded verdicts.

Review the evidence and your use of alink-cli@0.11.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 03:20:21.556Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.