Loading npm security reports…

alvin-bot@5.100.0: Malicious npm security report (Block) | LPM Firewall

registry / alvin-bot / 5.100.0

alvin-bot@5.100.0

Open-source, self-hosted autonomous AI agent on Telegram, Slack, Discord, WhatsApp, Signal, terminal & web. Claude Agent SDK + multi-provider engine with auto-failover, detached sub-agents, zero-config memory. Local-first, telemetry-free.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The runtime bridge masks identifiers and launches Claude with its permission checks disabled. This can give bot-controlled prompts unrestricted local-agent execution.

Static reason

One or more suspicious static signals were detected.

Trigger

Starting the bot with the Claude bridge provider and processing a request.

Impact

A prompt reaching the bridge can act through the local Claude CLI without its normal approval controls.

Mechanism

Identifier masking plus unconditional permission-bypass execution.

Policy narrative

The package includes a Claude bridge that rewrites OpenClaw identifiers before sending prompts onward, then starts the local Claude CLI with the dangerous permission-bypass flag. The source explicitly describes the rewriting as a detection bypass. Although npm installation itself has no automatic lifecycle hook, running the configured bot activates this bridge and exposes the local agent environment to unrestricted actions from processed requests.

Rationale

The deliberate concealment and unconditional disabling of a foreign AI agent's permission guard are concrete harmful runtime behavior. The absence of an install hook reduces scope but does not neutralize the runtime control bypass.

Evidence

claude-bridge/src/claude.jsdist/index.jspackage.json/tmp

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence with false-positive risk.

Source & flagged code

15 flagged · loading source

claude-bridge/src/claude.jsView file

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto'); L5: L6: const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude'; L7: ... L106: const SCRUB_WHITELIST = new Set([ L107: 'API_KEY', 'API_KEYS', 'API_URL', 'BASE_URL', 'BASE64', L108: 'HTTP_GET', 'HTTP_POST', 'HTTP_PUT', 'HTTP_DELETE', 'HTTP_PATCH', ... L294: L295: // Idle timeout: reset on every stdout activity. L296: // Claude is alive as long as it produces output (tool calls, results, etc.)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude-bridge/src/claude.jsView on unpkg · L2

bin/cli.jsView file

22Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L22: import { homedir } from "os"; L23: import { execSync } from "child_process"; L24: import { initI18n, t, getLocale } from "../dist/i18n.js"; ... L28: // Data directory — same logic as src/paths.ts L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot"); L30: ... L42: const ensureRL = () => { L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout }); L44: return rl; ... L83: try { L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version; L85: } catch { return ""; }

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L22

1312console.log(`\n The Claude Agent SDK needs the native Claude Code binary.`); L1313: console.log(` Install with:\n curl -fsSL https://claude.ai/install.sh | sh`); L1314: console.log(` (npm install @anthropic-ai/claude-code is the alternative path.)\n`); ... L1320: try { L1321: execSync("curl -fsSL https://claude.ai/install.sh | sh", { stdio: "inherit", timeout: 120_000 }); L1322: const localBin = join(homedir(), ".local", "bin"); L1323: if (!process.env.PATH.includes(localBin)) { L1324: process.env.PATH = `${localBin}:${process.env.PATH || ""}`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L1312

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/cli.js: import { existsSync, writeFileSync, readFileSync, mkdirSync, copyFileSync, readdirSync, statSync, accessSync, realpathSync, unlinkSync, constants as fsConstants } from "fs"; signup: "https://claude.ai", signup: "https://console.anthropic.com/settings/keys", signup: "https://claude.ai", signup: "https://console.groq.com", signup: "https://aistudio.google.com", signup: "https://build.nvidia.com", signup: "https://platform.openai.com",

dist/services/browser-manager.jsView file

1const _0x275279=_0x3bb8;(function(_0x286110,_0x38d971){const _0x34fb5c=_0x3bb8,_0x153861=_0x3bb8,_0x3de4c4=_0x286110();while(!![]){try{const _0x414a25=-parseInt(_0x34fb5c(0x19d))/(...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/services/browser-manager.jsView on unpkg · L1

dist/middleware/auth.jsView file

1(function(_0x2e8389,_0x2be4cb){const _0x29ea6f=_0x8337,_0x1cefd0=_0x8337,_0x5b7f64=_0x2e8389();while(!![]){try{const _0x3e1518=parseInt(_0x29ea6f(0x186))/(-0x6*0x28+0x831+-0x3a0*0x...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/middleware/auth.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

15 flagged

claude-bridge/src/claude.jsView file

Lines 1-22javascript

1'use strict';

2

3const { spawn } = require('child_process');

4const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

5

6const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude';

7

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude-bridge/src/claude.jsView on unpkg · L2

8// --- Stable alias per CLI session ---

9// Each session keeps one alias so resumed requests don't accumulate different

10// names in the Claude context (which would leak un-replaced aliases in output).

11const PREFIXES = ['Chat', 'Dev', 'Run', 'Ask', 'Net', 'App', 'Zen', 'Arc', 'Dot', 'Amp', 'Hex', 'Orb', 'Elm', 'Oak', 'Sky'];

12const SUFFIXES = ['Kit', 'Box', 'Pod', 'Hub', 'Lab', 'Ops', 'Bay', 'Tap', 'Rim', 'Fog', 'Dew', 'Fin', 'Gem', 'Jet', 'Cog'];

13const pick = (arr) => arr[Math.floor(Math.random() * arr.length)];

14const sessionAliasMap = new Map(); // sessionId → { alias, aliasLower, lastUsed }

15const sessionTokenMaps = new Map(); // sessionId → Map<original, replacement>

16

17function getSessionAlias(sessionId) {

18 if (!sessionId) {

19 const alias = pick(PREFIXES) + pick(SUFFIXES);

20 return { alias, aliasLower: alias.toLowerCase() };

21 }

22 let entry = sessionAliasMap.get(sessionId);

bin/cli.jsView file

Lines 2-42javascript

2

3/**

4 * Alvin Bot CLI — Setup, manage, and chat with your AI agent.

5 *

6 * Usage:

7 * alvin-bot setup — Interactive setup wizard

8 * alvin-bot tui — Terminal chat UI

9 * alvin-bot doctor — Check configuration

10 * alvin-bot audit — Security health check

11 * alvin-bot update — Pull latest & rebuild

12 * alvin-bot start — Start the bot

dist/services/browser-manager.jsView file

Lines 1-1javascript

1const _0x275279=_0x3bb8;(function(_0x286110,_0x38d971){const _0x34fb5c=_0x3bb8,_0x153861=_0x3bb8,_0x3de4c4=_0x286110();while(!![]){try

dist/middleware/auth.jsView file

1(function(_0x2e8389,_0x2be4cb){const _0x29ea6f=_0x8337,_0x1cefd0=_0x8337,_0x5b7f64=_0x2e8389();while(!![]){try{const _0x3e1518=parseInt(_0x29ea6f(0x186))/(-0x6*0x28+0x831+-0x3a0*0x...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/middleware/auth.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Lines 1292-1332javascript

1292 } catch {}

1293 for (const p of [join(homedir(), ".local", "bin", "claude"), "/usr/local/bin/claude"]) {

1294 if (existsSync(p)) return p;

1295 }

1296 return null;

1297}

1298

1299/**

1300 * Interactive Claude SDK setup: ensures the native claude CLI is installed,

1301 * runs `claude auth login` if not authenticated. Returns { ok: bool }.

1302 *

1303 * Designed to be called both from the setup wizard and from

1304 * `alvin-bot provider switch claude-sdk`.

1305 */

1306async function configureClaudeSdkInline() {

1307 let cliPath = findClaudeBinary();

1308 if (cliPath) {

1309 console.log(` ✅ Claude CLI found at ${cliPath}`);

1310 } else {

1311 console.log(` ⚠️ Claude CLI not found (native binary required).`);

1312 console.log(`\n The Claude Agent SDK needs the native Claude Code binary.`);

1313 console.log(` Install with:\n curl -fsSL https://claude.ai/install.sh | sh`);

1314 console.log(` (npm install @anthropic-ai/claude-code is the alternative path.)\n`);

1315

1316 const yc = getLocale() === "de" ? ["j", "ja", "y", "yes"] : ["y", "yes"];

1317 const doInstall = (await ask(` Install now via the official installer? (y/n): `)).trim().toLowerCase();

1318 if (yc.includes(doInstall)) {

1319 console.log(`\n Installing Claude CLI...`);

1320 try {

1321 execSync("curl -fsSL https://claude.ai/install.sh | sh", { stdio: "inherit", timeout: 120_000 });

1322 const localBin = join(homedir(), ".local", "bin");

1323 if (!process.env.PATH.includes(localBin)) {

1324 process.env.PATH = `${localBin}:${process.env.PATH || ""}`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L1312

1325 }

1326 cliPath = findClaudeBinary();

1327 if (cliPath) console.log(` ✅ Claude CLI installed at ${cliPath}\n`);

1328 } catch {

1329 console.log(` ❌ Installation failed. Run manually: curl -fsSL https://claude.ai/install.sh | sh`);

1330 }

1331 }

1332 }

Lines 4513-4553javascript

4513 break;

4514 }

4515 const url = process.argv[4];

4516 if (!url) {

4517 console.error(`Usage: alvin-bot browser ${sub} <url> [args]`);

4518 process.exit(1);

4519 }

4520 const ctx = browser.contexts()[0] || (await browser.newContext());

4521 const page = await ctx.newPage();

4522 try {

4523 await page.goto(url, { waitUntil: "domcontentloaded", timeout: 30000 });

4524 if (sub === "goto") {

4525 console.log(JSON.stringify({ url: page.url(), title: await page.title() }, null, 2));

4526 } else if (sub === "shot" || sub === "screenshot") {

4527 const name = process.argv[5] || `shot_${Date.now()}.png`;

4528 const { CDP_SCREENSHOTS_DIR } = await import("../dist/paths.js");

4529 const out = name.startsWith("/") ? name : `${CDP_SCREENSHOTS_DIR}/${name}`;

4530 await page.screenshot({ path: out, fullPage: true });

4531 console.log(JSON.stringify({ url: page.url(), title: await page.title(), screenshot: out }, null, 2));

4532 } else if (sub === "eval") {

4533 const js = process.argv[5] || "document.title";

4534 const result = await page.evaluate(new Function(`return (${js})`));

4535 console.log(JSON.stringify({ url: page.url(), result }, null, 2));

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/cli.jsView on unpkg · L4533

4536 }

4537 } finally {

4538 await page.close();

4539 }

4540 } finally {

4541 await browser.close();

4542 }

4543 break;

4544 }

4545 default:

4546 console.log(`alvin-bot browser — bot-managed Chromium (CDP on port 9222)

4547 console.log(" alvin-bot skill create <id> <file> Record a way of working as a skill");

4548

4549 start [headful|headless] Start Chromium with CDP (default: headless)

4550 stop Stop the bot-managed Chromium

4551 status Show PID + binary + endpoint

4552 doctor Diagnose common issues

4553 goto <url> Navigate and print page info as JSON