alink-cli@0.11.9
一条命令把工作机接入 AgentLink，随时随地遥控本机的编码 agent。One command to link your machine to AgentLink and control your coding agents from anywhere.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not concretely malicious: it has no install lifecycle hook and the alleged remote decode-and-execute behavior is unsupported by the inspected entrypoint. Its remote agent-control design and default account-derived telemetry are meaningful dangerous capabilities that warrant a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user runs alink-cli or alink after installation and completes pairing or login.
Impact
A connected user account can control coding agents remotely; telemetry exposes a stable hashed account-derived identifier and system metadata.
Mechanism
Remote agent daemon with identifier-based telemetry.
AI rationale
The package is not concretely malicious: it has no install lifecycle hook and the alleged remote decode-and-execute behavior is unsupported by the inspected entrypoint. Its remote agent-control design and default account-derived telemetry are meaningful dangerous capabilities that warrant a warning.
Evidence
package.jsonbin/agentlink.jsbin/agentlink-account.jsdist/bin.mjs~/.agentlink/credential~/.agentlink/session~/.agentlink/status.json~/.codex/auth.json~/.claude.json~/.t3/telemetry/anonymous-id
Network endpoints2
wss://link.harmopath.comus.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- A user-invoked start command launches the bundled daemon with remote hub credentials, enabling remote coding-agent control.
- The bundled daemon reads Codex or Claude account identifiers, hashes one, and sends enabled-by-default telemetry to PostHog.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- The entrypoint's dynamic imports name fixed local dist files; no remote asset is decoded and executed.
- No source evidence shows credential harvesting, destructive behavior, or unconsented AI-agent configuration mutation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcedist/NodeSocket-CLfrrutd.mjsView file
4864patternName = generic_password
severity = medium
line = 4864
matchedText = url.valu...ED";
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/NodeSocket-CLfrrutd.mjsView on unpkg · L4864bin/agentlink.jsView file
1#!/usr/bin/env node
L2: import { spawn } from "node:child_process";
L3: import { randomBytes } from "node:crypto";
L4: import { createServer } from "node:http";
L5: import { existsSync } from "node:fs";
...
L28: }
L29: const saved = JSON.parse(raw);
L30: return saved.hub === normalizeHub(hub) && typeof saved.jwt === "string" ? saved.jwt : undefined;
...
L59:
L60: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com";
L61: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink");
L62: const CREDENTIAL_FILE = join(STATE_DIR, "credential");
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
bin/agentlink.jsView on unpkg · L1Findings
3 Critical6 High5 Medium4 Low
CriticalRemote Asset Decode Executebin/agentlink.js
CriticalTrigger Reachable Dangerous Capabilitybin/agentlink.js
CriticalPrevious Version Dangerous Deltabin/agentlink.js
HighChild Processbin/agentlink.js
HighShell
HighCross File Remote Execution Contextbin/agentlink.js
HighKnown Malware Source Similaritydist/ui.js
HighKnown Malware Source Similaritydist/NodeServices-BtcL7AtO.mjs
HighKnown Malware Source Similaritydist/daemon.js
MediumSecret Patterndist/NodeSocket-CLfrrutd.mjs
MediumDynamic Requirebin/agentlink.js
MediumNetwork
Affected versions and remediation
This report applies to alink-cli@0.11.9.
See all versions of alink-cli for other recorded verdicts.
- Review the evidence and your use of alink-cli@0.11.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.