registry / alink-cli / 0.12.0

alink-cli@0.12.0

一条命令把工作机接入 AgentLink，随时随地遥控本机的编码 agent。One command to link your machine to AgentLink and control your coding agents from anywhere.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The high-risk behavior is an explicit remote-control feature rather than a hidden lifecycle payload. Source inspection found no install hook, remote payload execution, or unconsented credential exfiltration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

An explicit alink, agentlink, or alink-cli invocation.

Impact

A user who pairs a machine can remotely operate configured coding agents; this is the stated CLI capability, not hidden install-time behavior.

Mechanism

Starts a packaged daemon that relays authenticated remote requests to local coding agents.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The CLI explicitly starts its packaged daemon only when the user runs the command.
The daemon handles remote run messages by invoking a detected coding-agent ACP process.
The flagged Function use is a bundled MessagePack decoder generator, not remote payload execution.
The manifest has no preinstall, install, or postinstall hook.

Evidence against

No fetched asset is decoded and executed.
No credential or environment harvesting/exfiltration path was found.
The remote-control and agent-launch behavior is the package's explicit, user-invoked function.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

11 flagged

dist/NodeSocket-CLfrrutd.mjsView file

4864patternName = generic_password severity = medium line = 4864

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/NodeSocket-CLfrrutd.mjsView on unpkg · L4864

bin/agentlink.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

4import { createServer } from "node:http";

5import { existsSync } from "node:fs";

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/agentlink.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentlink.jsView on unpkg · L1

6import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

7import { hostname, homedir } from "node:os";

8import { join } from "node:path";

9import { fileURLToPath } from "node:url";

10import WebSocket from "ws";

12import {

13 exchangeCredentialForSessionJwt,

14 listAgentLinkAccountMachines,

15 listAgentLinkAccountMachinesFromHub,

16 loadAgentLinkAccountConfig,

17 registerAgentLinkAccountMachine,

18 registerAgentLinkSessionMachine,

19} from "./agentlink-account.js";

20import { accountCredentials } from "./agentlink-prompts.js";

Lines 211-251javascript

211 clearTimeout(timer);

212 server.close();

213 reject(new Error("无法启动本地登录回调。"));

214 return;

215 }

216 const url =

•Trigger-reachable chain: manifest.bin -> bin/agentlink.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/agentlink.jsView on unpkg

dist/ui.jsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/ui.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui.jsView on unpkg

317"use strict"; L318: if (process.env.NODE_ENV !== "production") { L319: (function() { ... L545: isMounted: ["isMounted", "Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks."], L546: replaceState: ["replaceState", "Refactor your code to use setState instead (see https://github.com/facebook/react/issues/3236)."] L547: }; ... L2209: ]; L2210: if (process.platform !== "win32") { L2211: module.exports.push( ... L2357: } L2358: process13.exitCode = code || /* istanbul ignore next */ L2359: 0;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/ui.jsView on unpkg · L317

dist/NodeServices-BtcL7AtO.mjsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/NodeServices-BtcL7AtO.mjs matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-BtcL7AtO.mjsView on unpkg

dist/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/daemon.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon.jsView on unpkg

dist/bin.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = alink-cli@0.12.6 matchedIdentity = npm:YWxpbmstY2xp:0.12.6 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.mjsView on unpkg

Source & flagged code

11 flagged · loading source

dist/NodeSocket-CLfrrutd.mjsView file

4864patternName = generic_password severity = medium line = 4864

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/NodeSocket-CLfrrutd.mjsView on unpkg · L4864

bin/agentlink.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; L4: import { createServer } from "node:http"; L5: import { existsSync } from "node:fs"; ... L28: } L29: const saved = JSON.parse(raw); L30: return saved.hub === normalizeHub(hub) && typeof saved.jwt === "string" ? saved.jwt : undefined; ... L59: L60: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com"; L61: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink"); L62: const CREDENTIAL_FILE = join(STATE_DIR, "credential");

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

bin/agentlink.jsView on unpkg · L1

•

Findings

3 Critical6 High6 Medium4 Low

CriticalRemote Asset Decode Executebin/agentlink.js

CriticalTrigger Reachable Dangerous Capabilitybin/agentlink.js

CriticalPrevious Version Dangerous Deltadist/bin.mjs

HighChild Processbin/agentlink.js

HighShell

HighCross File Remote Execution Contextbin/agentlink.js

HighKnown Malware Source Similaritydist/ui.js

HighKnown Malware Source Similaritydist/NodeServices-BtcL7AtO.mjs

HighKnown Malware Source Similaritydist/daemon.js

MediumSecret Patterndist/NodeSocket-CLfrrutd.mjs

MediumDynamic Requirebin/agentlink.js

MediumNetwork

Affected versions and remediation

This report applies to alink-cli@0.12.0.

See all versions of alink-cli for other recorded verdicts.

Review the evidence and your use of alink-cli@0.12.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 13:24:51.572Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.