registry / Remote code execution / alvin-bot / 5.101.2

alvin-bot@5.101.2

Open-source, self-hosted autonomous AI agent on Telegram, Slack, Discord, WhatsApp, Signal, terminal & web. Claude Agent SDK + multi-provider engine with auto-failover, detached sub-agents, zero-config memory. Local-first, telemetry-free.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The direct shell interpolation is a concrete command-injection risk in an agent-facing plugin. There is no evidence of an automatic lifecycle attack, so blocking publication is not supported.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A caller or agent invokes an email action with a crafted message identifier, search value, or other argument.

Impact

Crafted input may execute commands with the privileges of the running bot process.

Mechanism

The plugin interpolates arguments into a himalaya command and executes it with execSync.

AI rationale

The direct shell interpolation is a concrete command-injection risk in an agent-facing plugin. There is no evidence of an automatic lifecycle attack, so blocking publication is not supported.

Evidence

plugins/email/index.jsdist/providers/tool-executor.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The email plugin interpolates an argument string into a command passed to execSync.
Plugin handlers build that argument string directly from caller-supplied parameters.
A shipped obfuscated tool-executor bundle also invokes execSync, limiting auditability of additional execution paths.

Evidence against

The manifest has no install lifecycle hook or runtime dependency on alvin-bot itself.
The bootstrap path is reached through the explicit alvin-bot setup command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 277 file(s), 3.88 MB of source, external domains: 127.0.0.1, aistudio.google.com, api.anthropic.com, api.coingecko.com, api.example.com, api.frankfurter.app, api.github.com, api.groq.com, api.openai.com, api.slack.com, api.telegram.org, brew.sh, build.nvidia.com, cdn.jsdelivr.net, chat.openai.com, claude.ai, console.anthropic.com, console.groq.com, generativelanguage.googleapis.com, integrate.api.nvidia.com, nodejs.org, ollama.com, openrouter.ai, platform.openai.com, query2.finance.yahoo.com, t.me, wacli.sh, wttr.in, www.apple.com

Source & flagged code

21 flagged

claude-bridge/src/claude.jsView file

Lines 1-22javascript

1'use strict';

3const { spawn } = require('child_process');

4const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

6const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude-bridge/src/claude.jsView on unpkg · L2

8// --- Stable alias per CLI session ---

9// Each session keeps one alias so resumed requests don't accumulate different

10// names in the Claude context (which would leak un-replaced aliases in output).

11const PREFIXES = ['Chat', 'Dev', 'Run', 'Ask', 'Net', 'App', 'Zen', 'Arc', 'Dot', 'Amp', 'Hex', 'Orb', 'Elm', 'Oak', 'Sky'];

12const SUFFIXES = ['Kit', 'Box', 'Pod', 'Hub', 'Lab', 'Ops', 'Bay', 'Tap', 'Rim', 'Fog', 'Dew', 'Fin', 'Gem', 'Jet', 'Cog'];

13const pick = (arr) => arr[Math.floor(Math.random() * arr.length)];

14const sessionAliasMap = new Map(); // sessionId → { alias, aliasLower, lastUsed }

15const sessionTokenMaps = new Map(); // sessionId → Map<original, replacement>

17function getSessionAlias(sessionId) {

18 if (!sessionId) {

19 const alias = pick(PREFIXES) + pick(SUFFIXES);

20 return { alias, aliasLower: alias.toLowerCase() };

21 }

22 let entry = sessionAliasMap.get(sessionId);

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.149.0 matchedPath = claude-bridge/src/claude.js matchedIdentity = npm:YWx2aW4tYm90:5.149.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/claude.jsView on unpkg

dist/providers/tool-executor.jsView file

Lines 1-1javascript

1const _0x54bca0=_0x5748,_0x479a3b=_0x5748;(function(_0x3c65f4,_0x322d6e){const _0x5cd44c=_0x5748,_0x296de9=_0x5748,_0x2b4fbe=_0x3c65f4();while(

bin/cli.jsView file

Lines 2-42javascript

3/**

4 * Alvin Bot CLI — Setup, manage, and chat with your AI agent.

5 *

6 * Usage:

7 * alvin-bot setup — Interactive setup wizard

8 * alvin-bot tui — Terminal chat UI

9 * alvin-bot doctor — Check configuration

10 * alvin-bot audit — Security health check

11 * alvin-bot update — Pull latest & rebuild

12 * alvin-bot start — Start the bot

dist/web/server.jsView file

1const _0x1aefc7=_0x1477,_0x722c48=_0x1477;(function(_0x4a01c1,_0x3cf558){const _0x356940=_0x1477,_0x318b95=_0x1477,_0x3a802d=_0x4a01c1();while(!![]){try{const _0x4e4f4c=-parseInt(_...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/web/server.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/web/server.js L1: const _0x1aefc7=_0x1477,_0x722c48=_0x1477;(function(_0x4a01c1,_0x3cf558){const _0x356940=_0x1477,_0x318b95=_0x1477,_0x3a802d=_0x4a01c1();while(!![]){try{const _0x4e4f4c=-parseInt(_...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/web/server.jsView on unpkg · L1

dist/middleware/auth.jsView file

1(function(_0x4bfc52,_0x352eee){const _0x4b4197=_0x2c0a,_0x3cf1c5=_0x2c0a,_0x387b46=_0x4bfc52();while(!![]){try{const _0x4512fa=-parseInt(_0x4b4197(0xb9))/(0x4a4+0x15d9+-0x1a7c)+-pa...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/middleware/auth.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

claude-bridge/src/claude.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 17

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

claude-bridge/src/claude.js#virtual:normalized:round1View on unpkg

claude-bridge/src/server.jsView file

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.149.0 matchedPath = claude-bridge/src/server.js matchedIdentity = npm:YWx2aW4tYm90:5.149.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/server.jsView on unpkg

plugins/email/index.jsView file

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.149.0 matchedPath = plugins/email/index.js matchedIdentity = npm:YWx2aW4tYm90:5.149.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/email/index.jsView on unpkg

Source & flagged code

21 flagged · loading source

claude-bridge/src/claude.jsView file

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/claude.jsView on unpkg

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

Findings

17 High6 Medium7 Low

HighChild Processclaude-bridge/src/claude.js

HighShelldist/providers/tool-executor.js

HighEntrypoint Build Divergencebin/cli.js

HighSame File Env Network Executionbin/cli.js

HighCommand Output Exfiltrationdist/web/server.js

HighSandbox Evasion Gated Capabilitybin/cli.js

HighObfuscated Payload Loaderdist/middleware/auth.js

HighCross File Remote Execution Contextbin/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/web/server.js

HighTrigger Reachable Persistencebin/cli.js

HighRuntime Package Installbin/cli.js

HighObfuscated

Affected versions and remediation

This report applies to alvin-bot@5.101.2.

See all versions of alvin-bot for other recorded verdicts.

Review the evidence and your use of alvin-bot@5.101.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 05:08:53.630Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code