registry / alink-cli / 0.8.9

alink-cli@0.8.9

一条命令把工作机接入 AgentLink，随时随地遥控本机的编码 agent。One command to link your machine to AgentLink and control your coding agents from anywhere.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Inspected behavior matches the package's remote coding-agent functionality, with hub-bound saved credentials and read-only access at the indicated agent configuration locations. No concrete malicious lifecycle, credential forwarding, or agent control-surface mutation was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Explicit CLI invocation or a daemon start action in the interactive menu.

Impact

Provides the requested remote coding-agent functionality. No unconsented agent configuration mutation or service-token exfiltration was established.

Mechanism

The launcher authenticates to the selected AgentLink hub and runs coding-agent processes; telemetry sends hashed identifiers and event metadata.

AI rationale

Network endpoints2

wss://link.harmopath.comus.i.posthog.com

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no registry install lifecycle hooks or runtime self-dependency.
dist/bin.mjs reads account identifiers and hashes them for telemetry, rather than forwarding service authentication tokens.
dist/daemon.js reads Claude settings to discover model names without changing those settings.
bin/agentlink.js restricts saved session credentials to their associated hub.
dist/ui.js starts the remote-control daemon through a user menu action with configured credentials.
dist/NodeServices-DDZTiw5K.mjs implements a command-driven child-process service consistent with running coding agents.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

9 flagged

bin/agentlink.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

4import { existsSync } from "node:fs";

5import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

6import { hostname, homedir } from "node:os";

7import { join } from "node:path";

8import { fileURLToPath } from "node:url";

9import WebSocket from "ws";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentlink.jsView on unpkg · L1

11import {

12 exchangeCredentialForSessionJwt,

13 listAgentLinkAccountMachines,

14 listAgentLinkAccountMachinesFromHub,

15 loadAgentLinkAccountConfig,

16 registerAgentLinkAccountMachine,

17} from "./agentlink-account.js";

18import { accountCredentials } from "./agentlink-prompts.js";

20function savedSessionJwt(hub = OFFICIAL_HUB) {

21 try {

Lines 144-184javascript

144 console.log(`\n${url}\n`);

145 return credential;

146}

147

148async function loginAndCreateCredential(hub, config) {

149

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = bin/agentlink.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/agentlink.jsView on unpkg

dist/ui.jsView file

317"use strict"; L318: if (process.env.NODE_ENV !== "production") { L319: (function() { ... L545: isMounted: ["isMounted", "Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks."], L546: replaceState: ["replaceState", "Refactor your code to use setState instead (see https://github.com/facebook/react/issues/3236)."] L547: }; ... L2209: ]; L2210: if (process.platform !== "win32") { L2211: module.exports.push( ... L2357: } L2358: process13.exitCode = code || /* istanbul ignore next */ L2359: 0;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/ui.jsView on unpkg · L317

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/ui.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui.jsView on unpkg

dist/NodeServices-DDZTiw5K.mjsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/NodeServices-BtcL7AtO.mjs matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-DDZTiw5K.mjsView on unpkg

dist/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = alink-cli@0.10.0 matchedPath = dist/daemon.js matchedIdentity = npm:YWxpbmstY2xp:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon.jsView on unpkg

dist/bin.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = alink-cli@0.12.6 matchedIdentity = npm:YWxpbmstY2xp:0.12.6 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.mjsView on unpkg

Source & flagged code

9 flagged · loading source

bin/agentlink.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

1Cross-file remote execution chain: bin/agentlink.js spawns dist/bin.mjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; ... L8: import { fileURLToPath } from "node:url"; L9: import WebSocket from "ws"; L10: ... L26: } L27: const saved = JSON.parse(raw); L28: return saved.hub === normalizeHub(hub) && typeof saved.jwt === "string" ? saved.jwt : undefined; ... L57: L58: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com"; L59: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentlink.jsView on unpkg · L1

Findings

2 Critical7 High4 Medium5 Low

CriticalRemote Asset Decode Executedist/ui.js

CriticalPrevious Version Dangerous Deltadist/bin.mjs

HighChild Processbin/agentlink.js

HighShell

HighCross File Remote Execution Contextbin/agentlink.js

HighKnown Malware Source Similaritydist/ui.js

HighKnown Malware Source Similaritybin/agentlink.js

HighKnown Malware Source Similaritydist/NodeServices-DDZTiw5K.mjs

HighKnown Malware Source Similaritydist/daemon.js

MediumDynamic Requirebin/agentlink.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to alink-cli@0.8.9.

See all versions of alink-cli for other recorded verdicts.

Review the evidence and your use of alink-cli@0.8.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 07:21:11.320Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.