Loading npm security reports…
alvin-bot@5.102.0: AI-agent capability abuse – flagged | LPM Firewall
Flagged as AI-agent capability risk
Allowed by default with warning: agent-facing configuration or capability changes need review before use.
alvin-bot@5.102.0 Self-hosted autonomous AI agent on Telegram, Slack, Discord, WhatsApp, Signal, terminal & web. Claude Agent SDK + multi-provider engine with auto-failover, detached sub-agents, zero-config memory. Local-first, telemetry-free.
scanned 1mo ago · by lpm-firewall-ai The source contains active detection-evasion rewriting combined with permission bypass, which is not needed for ordinary agent invocation. The absence of an automatic lifecycle hook and confirmed exfiltration makes a warning more proportionate than a publication block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Running the Claude bridge's Claude invocation.
Impact
Prompts may evade expected detection or policy controls while the delegated agent runs without its normal permission checks.
Mechanism
The bridge aliases outbound text and passes --dangerously-skip-permissions to the spawned Claude CLI.
AI rationale
The source contains active detection-evasion rewriting combined with permission bypass, which is not needed for ordinary agent invocation. The absence of an automatic lifecycle hook and confirmed exfiltration makes a warning more proportionate than a publication block.
Evidence
claude-bridge/src/claude.js dist/providers/tool-executor.js dist/web/server.js
public snapshot AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
The manifest explicitly builds an obfuscated distribution by default. The Claude bridge labels its outbound rewriting as a detection bypass. It replaces matching outbound identifiers with generated aliases before invoking Claude. The invoked Claude process is given a flag that skips permission checks. Multiple runtime distribution files begin with obfuscated code. Evidence against
The manifest contains no automatic preinstall, install, postinstall, or prepare hook. No credential collection or network exfiltration sink was identified in the inspected evidence. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified Obfuscated UrlStrings
21 flagged · loading source 2 L3: const { spawn } = require('child_process');
L4: const crypto = require('crypto');
High Child Process
Package source references child process execution.
claude-bridge/src/claude.js View on unpkg · L2 • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = claude-bridge/src/claude.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
claude-bridge/src/claude.js View on unpkg 2 L3: const { spawn } = require('child_process');
L4: const crypto = require('crypto');
Medium Dynamic Require
Package source references dynamic require/import behavior.
claude-bridge/src/claude.js View on unpkg · L2
17 High 6 Medium 8 Low
High Child Process claude-bridge/src/claude.js
High Shell dist/providers/tool-executor.js
High Entrypoint Build Divergence bin/cli.js
High Same File Env Network Execution bin/cli.js
High Command Output Exfiltration dist/web/server.js
High Sandbox Evasion Gated Capability bin/cli.js
High Obfuscated Payload Loader dist/middleware/auth.js
High Cross File Remote Execution Context bin/cli.js
High Trigger Reachable Command Output Exfiltration dist/web/server.js
High Trigger Reachable Persistence bin/cli.js
High Runtime Package Install bin/cli.js
High Obfuscated
Affected versions and remediation This report applies to alvin-bot@5.102.0 .
See all versions of alvin-bot for other recorded verdicts.
Review the evidence and your use of alvin-bot@5.102.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-22 05:00:46.940Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
94% Suspicious
AI assessment confidence
Package metadata npm Author Alev-B
Maintainers alvbln
Version 5.102.0
Latest on npm 5.160.2
Published Aug 29, 2026
License SEE LICENSE IN LICENSE
Dependencies 16
Integrity verified
Package size 1.62 MB
Files 331
Keywords telegram bot ai claude agent ai-agent autonomous-agent llm
Manifest
scanned 278 file(s), 3.89 MB of source, external domains: 127.0.0.1, aistudio.google.com, alvin.alev-b.com, api.anthropic.com, api.coingecko.com, api.duckduckgo.com, api.frankfurter.app, api.github.com, api.groq.com, api.openai.com, api.telegram.org, brew.sh, build.nvidia.com, cdn.jsdelivr.net, chat.openai.com, claude.ai, console.anthropic.com, console.groq.com, discord.com, docs.anthropic.com, example.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, integrate.api.nvidia.com, ollama.com, openrouter.ai, platform.openai.com, query2.finance.yahoo.com, t.me, wacli.sh, wttr.in, www.apple.com
2 L3: const { spawn } = require('child_process');
L4: const crypto = require('crypto');
L5:
L6: const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude';
L7:
...
L106: const SCRUB_WHITELIST = new Set([
L107: 'API_KEY', 'API_KEYS', 'API_URL', 'BASE_URL', 'BASE64',
L108: 'HTTP_GET', 'HTTP_POST', 'HTTP_PUT', 'HTTP_DELETE', 'HTTP_PATCH',
...
L294:
L295: // Idle timeout: reset on every stdout activity.
L296: // Claude is alive as long as it produces output (tool calls, results, etc.)
Low Weak Crypto
Package source references weak cryptographic algorithms.
claude-bridge/src/claude.js View on unpkg · L2 1 const _0x14cdef=_0x4af3,_0x5e4b98=_0x4af3;(function(_0xf6ca81,_0xa566cb){const _0xf40737=_0x4af3,_0x16b68b=_0x4af3,_0x50a8b8=_0xf6ca81();while(!![]){try{const _0x41b227=-parseInt(_...
High Shell
Package source references shell execution.
dist/providers/tool-executor.js View on unpkg · L1 22 Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.js View on unpkg · L22 1312 console.log(`\n The Claude Agent SDK needs the native Claude Code binary.`);
L1313: console.log(` Install with:\n curl -fsSL https://claude.ai/install.sh | sh`);
L1314: console.log(` (npm install @anthropic-ai/claude-code is the alternative path.)\n`);
...
L1320: try {
L1321: execSync("curl -fsSL https://claude.ai/install.sh | sh", { stdio: "inherit", timeout: 120_000 });
L1322: const localBin = join(homedir(), ".local", "bin");
L1323: if (!process.env.PATH.includes(localBin)) {
L1324: process.env.PATH = `${localBin}:${process.env.PATH || ""}`;
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.js View on unpkg · L1312 22 import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/cli.js View on unpkg · L22 22 Cross-file remote execution chain: bin/cli.js spawns dist/i18n.js; helper contains network access plus dynamic code execution.
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/cli.js View on unpkg · L22 22 Trigger-reachable persistence chain: manifest.bin -> bin/cli.js
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/cli.js View on unpkg · L22 296 install: () => {
L297: execSync("npm install -g playwright", { stdio: "inherit" });
L298: execSync("npx playwright install chromium", { stdio: "inherit" });
High Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/cli.js View on unpkg · L296 • matchType = normalized_sha256
matchedPackage = alvin-bot@5.100.0
matchedPath = bin/cli.js
matchedIdentity = npm:YWx2aW4tYm90:5.100.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cli.js View on unpkg 22 import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/cli.js View on unpkg · L22 4533 const js = process.argv[5] || "document.title";
L4534: const result = await page.evaluate(new Function(`return (${js})`));
L4535: console.log(JSON.stringify({ url: page.url(), result }, null, 2));
Low Eval
Package source references a known benign dynamic code generation pattern.
bin/cli.js View on unpkg · L4533 1 const _0x4b578f=_0x21d3,_0x55d927=_0x21d3;(function(_0x162b75,_0x2a7c8d){const _0x3f178c=_0x21d3,_0x1f483e=_0x21d3,_0xf1cec2=_0x162b75();while(!![]){try{const _0x4cb1b6=parseInt(_0...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/web/server.js View on unpkg · L1 1 Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/web/server.js
L1: const _0x4b578f=_0x21d3,_0x55d927=_0x21d3;(function(_0x162b75,_0x2a7c8d){const _0x3f178c=_0x21d3,_0x1f483e=_0x21d3,_0xf1cec2=_0x162b75();while(!![]){try{const _0x4cb1b6=parseInt(_0...
High Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/web/server.js View on unpkg · L1 1 (function(_0x44a3fd,_0x5a00b8){const _0x34906d=_0xa409,_0x212aa0=_0xa409,_0x59017e=_0x44a3fd();while(!![]){try{const _0x5196a5=-parseInt(_0x34906d(0xd0))/(-0x1*-0x1cf3+-0xac0+-0x22...
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/middleware/auth.js View on unpkg · L1 • path = install.sh
kind = build_helper
sizeBytes = 10656
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
install.sh View on unpkg claude-bridge/src/claude.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
claude-bridge/src/claude.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = claude-bridge/src/server.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
claude-bridge/src/server.js View on unpkg • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = plugins/email/index.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
plugins/email/index.js View on unpkg High
Semantic Analysis Limited
claude-bridge/src/claude.js#virtual:normalized:round1
High Known Malware Source Similarity bin/cli.js
High Known Malware Source Similarity claude-bridge/src/server.js
High Known Malware Source Similarity claude-bridge/src/claude.js
High Known Malware Source Similarity plugins/email/index.js
Medium Dynamic Require claude-bridge/src/claude.js
Medium Install Persistence bin/cli.js
Medium Ships Build Helper install.sh
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto claude-bridge/src/claude.js
Runtime surface package.json Entrypoints main → dist/index.js bin → alvin-bot
Runtime node >=18.0.0
Artifact 4.74 MB · 331 files 1 signature(s)
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings Minified Obfuscated UrlStrings NoLicense
21 flagged Lines 1-22 javascript
3 const { spawn } = require ( 'child_process' );
4 const crypto = require ( 'crypto' );
High Child Process
Package source references child process execution.
claude-bridge/src/claude.js View on unpkg · L2 Medium Dynamic Require
Package source references dynamic require/import behavior.
claude-bridge/src/claude.js View on unpkg · L2 6 const CLAUDE_BIN = process.env. CLAUDE_BIN || 'claude' ;
7
Low Weak Crypto
Package source references weak cryptographic algorithms.
claude-bridge/src/claude.js View on unpkg · L2 8 // --- Stable alias per CLI session ---
9 // Each session keeps one alias so resumed requests don't accumulate different
10 // names in the Claude context (which would leak un-replaced aliases in output).
11 const PREFIXES = [ 'Chat' , 'Dev' , 'Run' , 'Ask' , 'Net' , 'App' , 'Zen' , 'Arc' , 'Dot' , 'Amp' , 'Hex' , 'Orb' , 'Elm' , 'Oak' , 'Sky' ];
12 const SUFFIXES = [ 'Kit' , 'Box' , 'Pod' , 'Hub' , 'Lab' , 'Ops' , 'Bay' , 'Tap' , 'Rim' , 'Fog' , 'Dew' , 'Fin' , 'Gem' , 'Jet' , 'Cog' ];
13 const pick = ( arr ) => arr[Math. floor (Math. random () * arr. length )];
14 const sessionAliasMap = new Map (); // sessionId → { alias, aliasLower, lastUsed }
15 const sessionTokenMaps = new Map (); // sessionId → Map<original, replacement>
17 function getSessionAlias ( sessionId ) {
19 const alias = pick ( PREFIXES ) + pick ( SUFFIXES );
20 return { alias, aliasLower: alias. toLowerCase () };
22 let entry = sessionAliasMap. get (sessionId);
• matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = claude-bridge/src/claude.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
claude-bridge/src/claude.js View on unpkg Lines 1-1 javascript
1 const _0x14cdef = _0x4af3, _0x5e4b98 = _0x4af3;( function ( _0xf6ca81 , _0xa566cb ){ const _0xf40737 = _0x4af3, _0x16b68b = _0x4af3, _0x50a8b8 = _0xf6ca81 (); while (
Lines 2-42 javascript
4 * Alvin Bot CLI — Setup, manage, and chat with your AI agent.
7 * alvin-bot setup — Interactive setup wizard
8 * alvin-bot tui — Terminal chat UI
9 * alvin-bot doctor — Check configuration
10 * alvin-bot audit — Security health check
11 * alvin-bot update — Pull latest & rebuild
12 * alvin-bot start — Start the bot
1 const _0x4b578f=_0x21d3,_0x55d927=_0x21d3;(function(_0x162b75,_0x2a7c8d){const _0x3f178c=_0x21d3,_0x1f483e=_0x21d3,_0xf1cec2=_0x162b75();while(!![]){try{const _0x4cb1b6=parseInt(_0...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/web/server.js View on unpkg · L1 1 Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/web/server.js
L1: const _0x4b578f=_0x21d3,_0x55d927=_0x21d3;(function(_0x162b75,_0x2a7c8d){const _0x3f178c=_0x21d3,_0x1f483e=_0x21d3,_0xf1cec2=_0x162b75();while(!![]){try{const _0x4cb1b6=parseInt(_0...
High Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/web/server.js View on unpkg · L1 1 (function(_0x44a3fd,_0x5a00b8){const _0x34906d=_0xa409,_0x212aa0=_0xa409,_0x59017e=_0x44a3fd();while(!![]){try{const _0x5196a5=-parseInt(_0x34906d(0xd0))/(-0x1*-0x1cf3+-0xac0+-0x22...
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/middleware/auth.js View on unpkg · L1 • path = install.sh
kind = build_helper
sizeBytes = 10656
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
install.sh View on unpkg claude-bridge/src/claude.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
claude-bridge/src/claude.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = claude-bridge/src/server.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
claude-bridge/src/server.js View on unpkg • matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = plugins/email/index.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
plugins/email/index.js View on unpkg !!
[]){
try
{
const
_0x41b227
=-
parseInt
(
_0xf40737
(
0x212
))
/
(
-
0x1c7d
+
0x2689
+-
0xa0b
)
+
parseInt
(
_0xf40737
(
0x1d2
))
/
(
0xa52
+
0x1953
+-
0x23a3
)
*
(
parseInt
(
_0xf40737
(
0x1e2
))
/
(
0x99
*
0x31
+-
0x3fb
*-
0x7
+
0x1
*-
0x3923
))
+-
parseInt
(
_0x16b68b
(
0x1d1
))
/
(
0x1
*-
0x1dd2
+-
0x15de
+-
0x4
*-
0xced
)
*
(
-
parseInt
(
_0xf40737
(
0x1d8
))
/
(
0x2607
*
0x1
+
0x87d
+-
0x2e7f
*
0x1
))
+
parseInt
(
_0xf40737
(
0x1e5
))
/
(
0x1
*-
0x1db7
+
0x62
*-
0xf
+
0x237b
)
*
(
-
parseInt
(
_0x16b68b
(
0x1c2
))
/
(
-
0x1f5e
+-
0x3
*-
0x246
+
0x1893
))
+-
parseInt
(
_0x16b68b
(
0x24
...
High Shell
Package source references shell execution.
dist/providers/tool-executor.js View on unpkg · L1 Long lines were clipped for display.
13
* alvin-bot stop — Stop the bot
16 * --lang en|de — Language (default: en, auto-detects from LANG env)
19 import { createInterface } from "readline" ;
20 import { existsSync, writeFileSync, readFileSync, mkdirSync, copyFileSync, readdirSync, statSync, accessSync, realpathSync, unlinkSync, constants as fsConstants } from "fs" ;
21 import { resolve, join } from "path" ;
22 import { homedir } from "os" ;
23 import { execSync } from "child_process" ;
24 import { initI18n, t, getLocale } from "../dist/i18n.js" ;
25 import { renderDeadmanPlist } from "../dist/services/deadman-watcher.js" ;
26 import { signalRunningBot } from "./provider-signal.mjs" ;
28 // Data directory — same logic as src/paths.ts
29 const DATA_DIR = process.env. ALVIN_DATA_DIR || join ( homedir (), ".alvin-bot" );
34 // Lazy-create the readline interface. If we create it eagerly, stdin becomes
35 // "active" and Node refuses to exit even when a command like `doctor` has
36 // finished synchronously. Before v4.4.6 this caused `alvin-bot doctor` to
37 // hang indefinitely when .env was missing — early-return worked, but the
38 // process couldn't terminate. Creating rl only when `ask()` is actually
39 // called keeps non-interactive commands (audit/doctor/version/start/stop)
40 // terminating cleanly.
42 const ensureRL = () => {
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.js View on unpkg · L22 Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/cli.js View on unpkg · L22 Lines 1292-1332 javascript
1293 for ( const p of [ join ( homedir (), ".local" , "bin" , "claude" ), "/usr/local/bin/claude" ]) {
1294 if ( existsSync (p)) return p;
1300 * Interactive Claude SDK setup: ensures the native claude CLI is installed,
1301 * runs `claude auth login` if not authenticated. Returns { ok: bool }.
1303 * Designed to be called both from the setup wizard and from
1304 * `alvin-bot provider switch claude-sdk`.
1306 async function configureClaudeSdkInline () {
1307 let cliPath = findClaudeBinary ();
1309 console. log ( ` ✅ Claude CLI found at ${ cliPath }` );
1311 console. log ( ` ⚠️ Claude CLI not found (native binary required).` );
1312 console. log ( ` \n The Claude Agent SDK needs the native Claude Code binary.` );
1313 console. log ( ` Install with: \n curl -fsSL https://claude.ai/install.sh | sh` );
1314 console. log ( ` (npm install @anthropic-ai/claude-code is the alternative path.) \n ` );
1316 const yc = getLocale () === "de" ? [ "j" , "ja" , "y" , "yes" ] : [ "y" , "yes" ];
1317 const doInstall = ( await ask ( ` Install now via the official installer? (y/n): ` )). trim (). toLowerCase ();
1318 if (yc. includes (doInstall)) {
1319 console. log ( ` \n Installing Claude CLI...` );
1321 execSync ( "curl -fsSL https://claude.ai/install.sh | sh" , { stdio: "inherit" , timeout: 120_000 });
1322 const localBin = join ( homedir (), ".local" , "bin" );
1323 if ( ! process.env. PATH . includes (localBin)) {
1324 process.env. PATH = `${ localBin }:${ process . env . PATH || ""}` ;
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.js View on unpkg · L1312 1326 cliPath = findClaudeBinary ();
1327 if (cliPath) console. log ( ` ✅ Claude CLI installed at ${ cliPath } \n ` );
1329 console. log ( ` ❌ Installation failed. Run manually: curl -fsSL https://claude.ai/install.sh | sh` );
Lines 4513-4553 javascript
4515 const url = process.argv[ 4 ];
4517 console. error ( `Usage: alvin-bot browser ${ sub } <url> [args]` );
4520 const ctx = browser. contexts ()[ 0 ] || ( await browser. newContext ());
4521 const page = await ctx. newPage ();
4523 await page. goto (url, { waitUntil: "domcontentloaded" , timeout: 30000 });
4524 if (sub === "goto" ) {
4525 console. log ( JSON . stringify ({ url: page. url (), title: await page. title () }, null , 2 ));
4526 } else if (sub === "shot" || sub === "screenshot" ) {
4527 const name = process.argv[ 5 ] || `shot_${ Date . now () }.png` ;
4528 const { CDP_SCREENSHOTS_DIR } = await import ( "../dist/paths.js" );
4529 const out = name. startsWith ( "/" ) ? name : `${ CDP_SCREENSHOTS_DIR }/${ name }` ;
4530 await page. screenshot ({ path: out, fullPage: true });
4531 console. log ( JSON . stringify ({ url: page. url (), title: await page. title (), screenshot: out }, null , 2 ));
4532 } else if (sub === "eval" ) {
4533 const js = process.argv[ 5 ] || "document.title" ;
4534 const result = await page. evaluate ( new Function ( `return (${ js })` ));
4535 console. log ( JSON . stringify ({ url: page. url (), result }, null , 2 ));
Low Eval
Package source references a known benign dynamic code generation pattern.
bin/cli.js View on unpkg · L4533 4541 await browser. close ();
4546 console. log ( `alvin-bot browser — bot-managed Chromium (CDP on port 9222)
4547 console.log(" alvin-bot skill create <id> <file> Record a way of working as a skill");
4549 start [headful|headless] Start Chromium with CDP (default: headless)
4550 stop Stop the bot-managed Chromium
4551 status Show PID + binary + endpoint
4552 doctor Diagnose common issues
4553 goto <url> Navigate and print page info as JSON
22 import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/cli.js View on unpkg · L22 22 Cross-file remote execution chain: bin/cli.js spawns dist/i18n.js; helper contains network access plus dynamic code execution.
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/cli.js View on unpkg · L22 22 Trigger-reachable persistence chain: manifest.bin -> bin/cli.js
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L28: // Data directory — same logic as src/paths.ts
L29: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L30:
...
L42: const ensureRL = () => {
L43: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L44: return rl;
...
L83: try {
L84: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L85: } catch { return ""; }
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/cli.js View on unpkg · L22 296 install: () => {
L297: execSync("npm install -g playwright", { stdio: "inherit" });
L298: execSync("npx playwright install chromium", { stdio: "inherit" });
High Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/cli.js View on unpkg · L296 • matchType = normalized_sha256
matchedPackage = alvin-bot@5.100.0
matchedPath = bin/cli.js
matchedIdentity = npm:YWx2aW4tYm90:5.100.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cli.js View on unpkg