registry / AI-agent capability abuse / alink-cli / 0.11.8

alink-cli@0.11.8

一条命令把工作机接入 AgentLink，随时随地遥控本机的编码 agent。One command to link your machine to AgentLink and control your coding agents from anywhere.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The inspected package implements an explicitly user-invoked remote-control service for local coding agents, which is a dangerous dual-use capability. It lacks install-time execution and no concrete malicious chain was confirmed, so a warning is appropriate rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs alink or alink-cli and completes pairing or login.

Impact

A party able to use the paired remote account could direct local coding-agent work and commands in the selected workspace.

Mechanism

Authenticated Hub-connected daemon with local agent and pseudo-terminal access.

AI rationale

Evidence

package.jsonREADME.mdbin/agentlink.jsdist/daemon.jsdist/bin.mjs~/.agentlink/credential~/.agentlink/session~/.claude/settings.json~/.claude.json~/.codex/config.toml

Network endpoints1

wss://link.harmopath.com

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package advertises remote control of local coding agents.
The CLI starts a daemon with a Hub URL and machine credential.
The bundled daemon reads Claude and Codex configuration to detect local agents.
The bundled runtime can launch a pseudo-terminal in a supplied working directory.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Remote pairing is initiated only when the user runs the CLI.
Credentials are stored locally with owner-only file permissions.
No remote payload decoding or dynamic code execution was confirmed in the inspected source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

10 flagged

dist/NodeSocket-CLfrrutd.mjsView file

4864patternName = generic_password severity = medium line = 4864 matchedText = url.valu...ED";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/NodeSocket-CLfrrutd.mjsView on unpkg · L4864

bin/agentlink.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

4import { createServer } from "node:http";

5import { existsSync } from "node:fs";

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/agentlink.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentlink.jsView on unpkg · L1

6import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

7import { hostname, homedir } from "node:os";

8import { join } from "node:path";

9import { fileURLToPath } from "node:url";

10import WebSocket from "ws";

12import {

13 exchangeCredentialForSessionJwt,

14 listAgentLinkAccountMachines,

15 listAgentLinkAccountMachinesFromHub,

16 loadAgentLinkAccountConfig,

17 registerAgentLinkAccountMachine,

18 registerAgentLinkSessionMachine,

19} from "./agentlink-account.js";

20import { accountCredentials } from "./agentlink-prompts.js";

Lines 201-241javascript

201 const address = server.address();

202 if (!address || typeof address === "string") {

203 clearTimeout(timer);

204 server.close();

•Trigger-reachable chain: manifest.bin -> bin/agentlink.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/agentlink.jsView on unpkg

dist/ui.jsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/ui.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui.jsView on unpkg

dist/NodeServices-BtcL7AtO.mjsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/NodeServices-BtcL7AtO.mjs matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-BtcL7AtO.mjsView on unpkg

dist/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/daemon.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon.jsView on unpkg

dist/bin.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = alink-cli@0.10.2 matchedIdentity = npm:YWxpbmstY2xp:0.10.2 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.mjsView on unpkg

Source & flagged code

10 flagged · loading source

dist/NodeSocket-CLfrrutd.mjsView file

4864patternName = generic_password severity = medium line = 4864 matchedText = url.valu...ED";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/NodeSocket-CLfrrutd.mjsView on unpkg · L4864

bin/agentlink.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; L4: import { createServer } from "node:http"; L5: import { existsSync } from "node:fs"; ... L28: } L29: const saved = JSON.parse(raw); L30: return saved.hub === normalizeHub(hub) && typeof saved.jwt === "string" ? saved.jwt : undefined; ... L59: L60: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com"; L61: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink"); L62: const CREDENTIAL_FILE = join(STATE_DIR, "credential");

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/agentlink.jsView on unpkg · L1

Findings

3 Critical6 High5 Medium4 Low

CriticalRemote Asset Decode Executebin/agentlink.js

CriticalTrigger Reachable Dangerous Capabilitybin/agentlink.js

CriticalPrevious Version Dangerous Deltadist/bin.mjs

HighChild Processbin/agentlink.js

HighShell

HighCross File Remote Execution Contextbin/agentlink.js

HighKnown Malware Source Similaritydist/ui.js

HighKnown Malware Source Similaritydist/NodeServices-BtcL7AtO.mjs

HighKnown Malware Source Similaritydist/daemon.js

MediumSecret Patterndist/NodeSocket-CLfrrutd.mjs

MediumDynamic Requirebin/agentlink.js

MediumNetwork

Affected versions and remediation

This report applies to alink-cli@0.11.8.

See all versions of alink-cli for other recorded verdicts.

Review the evidence and your use of alink-cli@0.11.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 08:38:36.768Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code