Loading npm security reports…
alvin-bot@5.101.0: Remote code execution – npm package flagged | LPM Firewall
Flagged — allowed with a warning
Allowed by default policy, but 33 finding(s) warrant review before installing.
alvin-bot@5.101.0 Open-source, self-hosted autonomous AI agent on Telegram, Slack, Discord, WhatsApp, Signal, terminal & web. Claude Agent SDK + multi-provider engine with auto-failover, detached sub-agents, zero-config memory. Local-first, telemetry-free.
scanned 1mo ago · by lpm-firewall-ai The shipped dist is obfuscated and exposes host shell, Python, file, and browser-eval tools, so remaining hidden runtime behavior cannot be ruled out. There is no npm install lifecycle hook and no third-party collector in readable source, so this is dual-use capability rather than a proven install-time malware drop.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
User installs then runs alvin-bot, npm start, or the setup wizard; not an npm preinstall/install/postinstall script.
Impact
If the owner runs the bot, it can execute local commands and use stored provider keys against model APIs; obfuscation leaves extra hidden payloads unproven.
Mechanism
Obfuscated agent runtime with host exec, file, network, and browser-eval tools
AI rationale
The shipped dist is obfuscated and exposes host shell, Python, file, and browser-eval tools, so remaining hidden runtime behavior cannot be ruled out. There is no npm install lifecycle hook and no third-party collector in readable source, so this is dual-use capability rather than a proven install-time malware drop.
Evidence
package.json bin/cli.js dist/providers/tool-executor.js dist/web/setup-api.js dist/web/server.js dist/middleware/auth.js claude-bridge/src/claude.js claude-bridge/src/server.js ~/.alvin-bot ~/.alvin-bot/claude-bridge-state.json APPROVED_USERS_FILE
Network endpoints4
127.0.0.1:9222 api.anthropic.com api.openai.com alvin.alev-b.com
public snapshot AI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
Published dist is deliberately obfuscated (javascript-obfuscator / ALVIN_NO_OBFUSCATE), so scanners cannot fully parse the shipped runtime. Agent tools run host shell via execSync and also expose file write, Python, and web fetch. The CLI browser eval path builds Function from command-line JavaScript inside Playwright. Setup API reads provider API keys from process.env and passes them into fetchLiveModels. Obfuscated web server and Telegram auth persist pairing/session state and import child_process. Claude bridge spawns the claude CLI and writes state under the user home directory. Evidence against
package.json has no preinstall, install, or postinstall hook; only publisher-side prepublishOnly. Readable CLI, plugins, and claude-bridge match a self-hosted multi-provider AI agent, not a dropper. No anonymous webhook or paste host; live keys go to the selected provider model catalog. No runtime self-dependency that would install another release of this package. 24 flagged · loading source 2 L3: const { spawn } = require('child_process');
L4: const crypto = require('crypto');
High Child Process
Package source references child process execution.
claude-bridge/src/claude.js View on unpkg · L2 • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = claude-bridge/src/claude.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
claude-bridge/src/claude.js View on unpkg 2 L3: const { spawn } = require('child_process');
L4: const crypto = require('crypto');
Medium Dynamic Require
Package source references dynamic require/import behavior.
claude-bridge/src/claude.js View on unpkg · L2
3 Critical 18 High 6 Medium 6 Low
Critical Same File Env Network Execution dist/web/setup-api.js#virtual:normalized:round1
Critical Credential Exfiltration dist/web/setup-api.js#virtual:normalized:round1
Critical Trigger Reachable Dangerous Capability dist/web/setup-api.js#virtual:normalized:round1
High Child Process claude-bridge/src/claude.js
High Shell dist/providers/tool-executor.js
High Eval bin/cli.js
High Entrypoint Build Divergence bin/cli.js
High Command Output Exfiltration dist/web/server.js
High Sandbox Evasion Gated Capability bin/cli.js
High Obfuscated Payload Loader dist/middleware/auth.js
High Cross File Remote Execution Context
Affected versions and remediation This report applies to alvin-bot@5.101.0 .
See all versions of alvin-bot for other recorded verdicts.
Review the evidence and your use of alvin-bot@5.101.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-18 04:43:34.668Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
72% Suspicious
AI assessment confidence
Package metadata npm Author alvbln
Maintainers alvbln
Version 5.101.0
Latest on npm 5.160.2
Published Aug 28, 2026
License MIT
Dependencies 16
Integrity verified
Package size 1.61 MB
Files 330
Keywords telegram bot ai claude agent ai-agent autonomous-agent llm
Crypto
DynamicRequire
EnvironmentVars
Eval
Filesystem
Network
Shell
WebSocket
Supply chain HighEntropyStrings Minified Obfuscated UrlStrings
Manifest No manifest risk signals triggered.
scanned 277 file(s), 3.88 MB of source, external domains: 127.0.0.1, aistudio.google.com, alvin.alev-b.com, api.anthropic.com, api.coingecko.com, api.frankfurter.app, api.github.com, api.groq.com, api.openai.com, api.telegram.org, brew.sh, build.nvidia.com, cdn.jsdelivr.net, chat.openai.com, claude.ai, console.anthropic.com, console.groq.com, discord.com, generativelanguage.googleapis.com, github.com, integrate.api.nvidia.com, nodejs.org, ollama.com, openrouter.ai, platform.openai.com, query2.finance.yahoo.com, registry.ollama.ai, slack.com, t.me, wacli.sh, wttr.in, www.apple.com
2 L3: const { spawn } = require('child_process');
L4: const crypto = require('crypto');
L5:
L6: const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude';
L7:
...
L106: const SCRUB_WHITELIST = new Set([
L107: 'API_KEY', 'API_KEYS', 'API_URL', 'BASE_URL', 'BASE64',
L108: 'HTTP_GET', 'HTTP_POST', 'HTTP_PUT', 'HTTP_DELETE', 'HTTP_PATCH',
...
L294:
L295: // Idle timeout: reset on every stdout activity.
L296: // Claude is alive as long as it produces output (tool calls, results, etc.)
Low Weak Crypto
Package source references weak cryptographic algorithms.
claude-bridge/src/claude.js View on unpkg · L2 1 const _0x3c1c2e=_0x3efa,_0x323fd4=_0x3efa;(function(_0x38d153,_0x36c51c){const _0x16947b=_0x3efa,_0x3d237e=_0x3efa,_0x167028=_0x38d153();while(!![]){try{const _0x42e833=-parseInt(_...
High Shell
Package source references shell execution.
dist/providers/tool-executor.js View on unpkg · L1 4533 const js = process.argv[5] || "document.title";
L4534: const result = await page.evaluate(new Function(`return (${js})`));
L4535: console.log(JSON.stringify({ url: page.url(), result }, null, 2));
22 Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.js View on unpkg · L22 22 import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/cli.js View on unpkg · L22 22 Cross-file remote execution chain: bin/cli.js spawns dist/i18n.js; helper contains network access plus dynamic code execution.
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/cli.js View on unpkg · L22 22 Trigger-reachable persistence chain: manifest.bin -> bin/cli.js
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/cli.js View on unpkg · L22 296 install: () => {
L297: execSync("npm install -g playwright", { stdio: "inherit" });
L298: execSync("npx playwright install chromium", { stdio: "inherit" });
High Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/cli.js View on unpkg · L296 • matchType = normalized_sha256
matchedPackage = alvin-bot@5.100.0
matchedPath = bin/cli.js
matchedIdentity = npm:YWx2aW4tYm90:5.100.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cli.js View on unpkg 22 import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/cli.js View on unpkg · L22 dist/web/setup-api.js#virtual:normalized:round1 View file 1 const _0x2bc6d3=_0x3828,_0x4a214d=_0x3828;(function(_0x528c76,_0x251edb){const _0x497650=_0x3828,_0xa16ca1=_0x3828,_0x1b943f=_0x528c76();while(!![]){try{const _0x40669e=parseInt(_0...
Critical Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/web/setup-api.js#virtual:normalized:round1 View on unpkg · L1 1 const _0x2bc6d3=_0x3828,_0x4a214d=_0x3828;(function(_0x528c76,_0x251edb){const _0x497650=_0x3828,_0xa16ca1=_0x3828,_0x1b943f=_0x528c76();while(!![]){try{const _0x40669e=parseInt(_0...
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/web/setup-api.js#virtual:normalized:round1 View on unpkg · L1 1 Trigger-reachable chain: scripts.start -> dist/index.js -> dist/web/server.js -> dist/web/setup-api.js
L1: const _0x2bc6d3=_0x3828,_0x4a214d=_0x3828;(function(_0x528c76,_0x251edb){const _0x497650=_0x3828,_0xa16ca1=_0x3828,_0x1b943f=_0x528c76();while(!![]){try{const _0x40669e=parseInt(_0...
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/web/setup-api.js#virtual:normalized:round1 View on unpkg · L1 1 Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/web/server.js -> dist/web/setup-api.js
L1: const _0x2bc6d3=_0x3828,_0x4a214d=_0x3828;(function(_0x528c76,_0x251edb){const _0x497650=_0x3828,_0xa16ca1=_0x3828,_0x1b943f=_0x528c76();while(!![]){try{const _0x40669e=parseInt(_0...
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/web/setup-api.js#virtual:normalized:round1 View on unpkg · L1 1 const _0x4ed1eb=_0x4e34,_0x6c2deb=_0x4e34;(function(_0xa8f3cf,_0x994b68){const _0x4435a7=_0x4e34,_0x4cc1e6=_0x4e34,_0xf8f818=_0xa8f3cf();while(!![]){try{const _0x10f10c=parseInt(_0...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/web/server.js View on unpkg · L1 1 Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/web/server.js
L1: const _0x4ed1eb=_0x4e34,_0x6c2deb=_0x4e34;(function(_0xa8f3cf,_0x994b68){const _0x4435a7=_0x4e34,_0x4cc1e6=_0x4e34,_0xf8f818=_0xa8f3cf();while(!![]){try{const _0x10f10c=parseInt(_0...
High Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/web/server.js View on unpkg · L1 1 (function(_0x22abf4,_0x55cc42){const _0x63e7dc=_0x5813,_0x41be06=_0x5813,_0x197985=_0x22abf4();while(!![]){try{const _0x590026=-parseInt(_0x63e7dc(0x1d1))/(0x23d+0xc1+-0x2fd)*(pars...
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/middleware/auth.js View on unpkg · L1 • path = install.sh
kind = build_helper
sizeBytes = 10656
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
install.sh View on unpkg claude-bridge/src/claude.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
claude-bridge/src/claude.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = claude-bridge/src/server.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
claude-bridge/src/server.js View on unpkg • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = plugins/email/index.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
plugins/email/index.js View on unpkg bin/cli.js
High Trigger Reachable Credential Exfiltration dist/web/setup-api.js#virtual:normalized:round1
High Trigger Reachable Command Output Exfiltration dist/web/server.js
High Trigger Reachable Persistence bin/cli.js
High Runtime Package Install bin/cli.js
High Semantic Analysis Limited claude-bridge/src/claude.js#virtual:normalized:round1
High Known Malware Source Similarity bin/cli.js
High Known Malware Source Similarity claude-bridge/src/server.js
High Known Malware Source Similarity claude-bridge/src/claude.js
High Known Malware Source Similarity plugins/email/index.js
Medium Dynamic Require claude-bridge/src/claude.js
Medium Install Persistence bin/cli.js
Medium Ships Build Helper install.sh
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto claude-bridge/src/claude.js
Runtime surface package.json Entrypoints main → dist/index.js bin → alvin-bot
Runtime node >=18.0.0
Artifact 4.72 MB · 330 files 1 signature(s)
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings Minified Obfuscated UrlStrings Manifest: clean
24 flagged Lines 1-22 javascript
3 const { spawn } = require ( 'child_process' );
4 const crypto = require ( 'crypto' );
High Child Process
Package source references child process execution.
claude-bridge/src/claude.js View on unpkg · L2 Medium Dynamic Require
Package source references dynamic require/import behavior.
claude-bridge/src/claude.js View on unpkg · L2 6 const CLAUDE_BIN = process.env. CLAUDE_BIN || 'claude' ;
7
Low Weak Crypto
Package source references weak cryptographic algorithms.
claude-bridge/src/claude.js View on unpkg · L2 8 // --- Stable alias per CLI session ---
9 // Each session keeps one alias so resumed requests don't accumulate different
10 // names in the Claude context (which would leak un-replaced aliases in output).
11 const PREFIXES = [ 'Chat' , 'Dev' , 'Run' , 'Ask' , 'Net' , 'App' , 'Zen' , 'Arc' , 'Dot' , 'Amp' , 'Hex' , 'Orb' , 'Elm' , 'Oak' , 'Sky' ];
12 const SUFFIXES = [ 'Kit' , 'Box' , 'Pod' , 'Hub' , 'Lab' , 'Ops' , 'Bay' , 'Tap' , 'Rim' , 'Fog' , 'Dew' , 'Fin' , 'Gem' , 'Jet' , 'Cog' ];
13 const pick = ( arr ) => arr[Math. floor (Math. random () * arr. length )];
14 const sessionAliasMap = new Map (); // sessionId → { alias, aliasLower, lastUsed }
15 const sessionTokenMaps = new Map (); // sessionId → Map<original, replacement>
17 function getSessionAlias ( sessionId ) {
19 const alias = pick ( PREFIXES ) + pick ( SUFFIXES );
20 return { alias, aliasLower: alias. toLowerCase () };
22 let entry = sessionAliasMap. get (sessionId);
• matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = claude-bridge/src/claude.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
claude-bridge/src/claude.js View on unpkg Lines 1-1 javascript
1 const _0x3c1c2e = _0x3efa, _0x323fd4 = _0x3efa;( function ( _0x38d153 , _0x36c51c ){ const _0x16947b = _0x3efa, _0x3d237e = _0x3efa, _0x167028 = _0x38d153 (); while (
Lines 2-42 javascript
4 * Alvin Bot CLI — Setup, manage, and chat with your AI agent.
7 * alvin-bot setup — Interactive setup wizard
8 * alvin-bot tui — Terminal chat UI
9 * alvin-bot doctor — Check configuration
10 * alvin-bot audit — Security health check
11 * alvin-bot update — Pull latest & rebuild
12 * alvin-bot start — Start the bot
dist/web/setup-api.js#virtual:normalized:round1 View file 1 const _0x2bc6d3=_0x3828,_0x4a214d=_0x3828;(function(_0x528c76,_0x251edb){const _0x497650=_0x3828,_0xa16ca1=_0x3828,_0x1b943f=_0x528c76();while(!![]){try{const _0x40669e=parseInt(_0...
Critical Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/web/setup-api.js#virtual:normalized:round1 View on unpkg · L1 1 const _0x2bc6d3=_0x3828,_0x4a214d=_0x3828;(function(_0x528c76,_0x251edb){const _0x497650=_0x3828,_0xa16ca1=_0x3828,_0x1b943f=_0x528c76();while(!![]){try{const _0x40669e=parseInt(_0...
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/web/setup-api.js#virtual:normalized:round1 View on unpkg · L1 1 Trigger-reachable chain: scripts.start -> dist/index.js -> dist/web/server.js -> dist/web/setup-api.js
L1: const _0x2bc6d3=_0x3828,_0x4a214d=_0x3828;(function(_0x528c76,_0x251edb){const _0x497650=_0x3828,_0xa16ca1=_0x3828,_0x1b943f=_0x528c76();while(!![]){try{const _0x40669e=parseInt(_0...
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/web/setup-api.js#virtual:normalized:round1 1 const _0x4ed1eb=_0x4e34,_0x6c2deb=_0x4e34;(function(_0xa8f3cf,_0x994b68){const _0x4435a7=_0x4e34,_0x4cc1e6=_0x4e34,_0xf8f818=_0xa8f3cf();while(!![]){try{const _0x10f10c=parseInt(_0...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/web/server.js View on unpkg · L1 1 Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/web/server.js
L1: const _0x4ed1eb=_0x4e34,_0x6c2deb=_0x4e34;(function(_0xa8f3cf,_0x994b68){const _0x4435a7=_0x4e34,_0x4cc1e6=_0x4e34,_0xf8f818=_0xa8f3cf();while(!![]){try{const _0x10f10c=parseInt(_0...
High Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/web/server.js View on unpkg · L1 1 (function(_0x22abf4,_0x55cc42){const _0x63e7dc=_0x5813,_0x41be06=_0x5813,_0x197985=_0x22abf4();while(!![]){try{const _0x590026=-parseInt(_0x63e7dc(0x1d1))/(0x23d+0xc1+-0x2fd)*(pars...
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/middleware/auth.js View on unpkg · L1 • path = install.sh
kind = build_helper
sizeBytes = 10656
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
install.sh View on unpkg claude-bridge/src/claude.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
claude-bridge/src/claude.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = claude-bridge/src/server.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
claude-bridge/src/server.js View on unpkg • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = plugins/email/index.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
plugins/email/index.js View on unpkg !!
[]){
try
{
const
_0x42e833
=-
parseInt
(
_0x16947b
(
0x1d4
))
/
(
0x1
*-
0x1aa1
+-
0xb9
*
0x11
+
0x26eb
)
*
(
parseInt
(
_0x3d237e
(
0x14f
))
/
(
0x197d
+-
0xcc2
+-
0x1
*
0xcb9
))
+-
parseInt
(
_0x16947b
(
0x161
))
/
(
-
0x2f2
+
0x1
*
0x3a1
+
0x2
*-
0x56
)
*
(
parseInt
(
_0x16947b
(
0x15e
))
/
(
0x821
+-
0xc1
*
0x24
+
0x1
*
0x1307
))
+
parseInt
(
_0x16947b
(
0x149
))
/
(
0x213b
+-
0xd
*-
0x143
+-
0xd
*
0x3d1
)
+-
parseInt
(
_0x3d237e
(
0x1a3
))
/
(
0x1917
+-
0x697
+-
0xb
*
0x1ae
)
*
(
parseInt
(
_0x3d237e
(
0x14a
))
/
(
0x4d
*
0x5f
+-
0x105
*
0x13
+-
0x92d
))
+
parseInt
(
_0x3d237e
(
0x1cf
)
...
High Shell
Package source references shell execution.
dist/providers/tool-executor.js View on unpkg · L1 Long lines were clipped for display.
13
* alvin-bot stop — Stop the bot
16 * --lang en|de — Language (default: en, auto-detects from LANG env)
19 import { createInterface } from "readline" ;
20 import { existsSync, writeFileSync, readFileSync, mkdirSync, copyFileSync, readdirSync, statSync, accessSync, realpathSync, unlinkSync, constants as fsConstants } from "fs" ;
21 import { resolve, join } from "path" ;
22 import { homedir } from "os" ;
23 import { execSync } from "child_process" ;
24 import { initI18n, t, getLocale } from "../dist/i18n.js" ;
25 import { renderDeadmanPlist } from "../dist/services/deadman-watcher.js" ;
26 import { signalRunningBot } from "./provider-signal.mjs" ;
28 // Data directory — same logic as src/paths.ts
29 const DATA_DIR = process.env. ALVIN_DATA_DIR || join ( homedir (), ".alvin-bot" );
34 // Lazy-create the readline interface. If we create it eagerly, stdin becomes
35 // "active" and Node refuses to exit even when a command like `doctor` has
36 // finished synchronously. Before v4.4.6 this caused `alvin-bot doctor` to
37 // hang indefinitely when .env was missing — early-return worked, but the
38 // process couldn't terminate. Creating rl only when `ask()` is actually
39 // called keeps non-interactive commands (audit/doctor/version/start/stop)
40 // terminating cleanly.
42 const ensureRL = () => {
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.js View on unpkg · L22 Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/cli.js View on unpkg · L22 Lines 4513-4553 javascript
4515 const url = process.argv[ 4 ];
4517 console. error ( `Usage: alvin-bot browser ${ sub } <url> [args]` );
4520 const ctx = browser. contexts ()[ 0 ] || ( await browser. newContext ());
4521 const page = await ctx. newPage ();
4523 await page. goto (url, { waitUntil: "domcontentloaded" , timeout: 30000 });
4524 if (sub === "goto" ) {
4525 console. log ( JSON . stringify ({ url: page. url (), title: await page. title () }, null , 2 ));
4526 } else if (sub === "shot" || sub === "screenshot" ) {
4527 const name = process.argv[ 5 ] || `shot_${ Date . now () }.png` ;
4528 const { CDP_SCREENSHOTS_DIR } = await import ( "../dist/paths.js" );
4529 const out = name. startsWith ( "/" ) ? name : `${ CDP_SCREENSHOTS_DIR }/${ name }` ;
4530 await page. screenshot ({ path: out, fullPage: true });
4531 console. log ( JSON . stringify ({ url: page. url (), title: await page. title (), screenshot: out }, null , 2 ));
4532 } else if (sub === "eval" ) {
4533 const js = process.argv[ 5 ] || "document.title" ;
4534 const result = await page. evaluate ( new Function ( `return (${ js })` ));
4535 console. log ( JSON . stringify ({ url: page. url (), result }, null , 2 ));
4541 await browser. close ();
4546 console. log ( `alvin-bot browser — bot-managed Chromium (CDP on port 9222)
4547 console.log(" alvin-bot skill create <id> <file> Record a way of working as a skill");
4549 start [headful|headless] Start Chromium with CDP (default: headless)
4550 stop Stop the bot-managed Chromium
4551 status Show PID + binary + endpoint
4552 doctor Diagnose common issues
4553 goto <url> Navigate and print page info as JSON
22 import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/cli.js View on unpkg · L22 22 Cross-file remote execution chain: bin/cli.js spawns dist/i18n.js; helper contains network access plus dynamic code execution.
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/cli.js View on unpkg · L22 22 Trigger-reachable persistence chain: manifest.bin -> bin/cli.js
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/cli.js View on unpkg · L22 296 install: () => {
L297: execSync("npm install -g playwright", { stdio: "inherit" });
L298: execSync("npx playwright install chromium", { stdio: "inherit" });
High Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/cli.js View on unpkg · L296 • matchType = normalized_sha256
matchedPackage = alvin-bot@5.100.0
matchedPath = bin/cli.js
matchedIdentity = npm:YWx2aW4tYm90:5.100.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cli.js View on unpkg 1 Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/web/server.js -> dist/web/setup-api.js
L1: const _0x2bc6d3=_0x3828,_0x4a214d=_0x3828;(function(_0x528c76,_0x251edb){const _0x497650=_0x3828,_0xa16ca1=_0x3828,_0x1b943f=_0x528c76();while(!![]){try{const _0x40669e=parseInt(_0...
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/web/setup-api.js#virtual:normalized:round1 View on unpkg · L1