registry / alvin-bot / 5.106.0

alvin-bot@5.106.0

Self-hosted autonomous AI agent on Telegram, Slack, Discord, WhatsApp, Signal, terminal & web. Claude Agent SDK + multi-provider engine with auto-failover, detached sub-agents, zero-config memory. Local-first, telemetry-free.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The persistence behavior is real but is not activated during npm installation and is tied to a user-managed launchd deployment. The obfuscated runtime and automatic companion watcher warrant a warning rather than a publish block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Run the bot after it has been configured as a macOS LaunchAgent.

Impact

The bot can persist and restart under the user account beyond the primary managed process.

Mechanism

Runtime installation of a launchd dead-man persistence watcher.

AI rationale

Evidence

dist/index.jsbin/cli.jsdist/services/deadman-watcher.js~/Library/LaunchAgents

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The published runtime entry is deliberately obfuscated.
Starting the bot imports the obfuscated runtime, which invokes a dead-man watcher installer.
The launchd setup writes and loads a second user LaunchAgent that restarts the bot.

Evidence against

There is no preinstall, install, or postinstall hook; the only lifecycle script is prepublishOnly.
The primary LaunchAgent installation is behind the explicit alvin-bot launchd install command.
No self-dependency or concrete secret-exfiltration path was found in the inspected files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Source & flagged code

19 flagged

claude-bridge/src/claude.jsView file

Lines 1-22javascript

1'use strict';

3const { spawn } = require('child_process');

4const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

6const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude-bridge/src/claude.jsView on unpkg · L2

8// --- Stable alias per CLI session ---

9// Each session keeps one alias so resumed requests don't accumulate different

10// names in the Claude context (which would leak un-replaced aliases in output).

11const PREFIXES = ['Chat', 'Dev', 'Run', 'Ask', 'Net', 'App', 'Zen', 'Arc', 'Dot', 'Amp', 'Hex', 'Orb', 'Elm', 'Oak', 'Sky'];

12const SUFFIXES = ['Kit', 'Box', 'Pod', 'Hub', 'Lab', 'Ops', 'Bay', 'Tap', 'Rim', 'Fog', 'Dew', 'Fin', 'Gem', 'Jet', 'Cog'];

13const pick = (arr) => arr[Math.floor(Math.random() * arr.length)];

14const sessionAliasMap = new Map(); // sessionId → { alias, aliasLower, lastUsed }

15const sessionTokenMaps = new Map(); // sessionId → Map<original, replacement>

17function getSessionAlias(sessionId) {

18 if (!sessionId) {

19 const alias = pick(PREFIXES) + pick(SUFFIXES);

20 return { alias, aliasLower: alias.toLowerCase() };

21 }

22 let entry = sessionAliasMap.get(sessionId);

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = claude-bridge/src/claude.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/claude.jsView on unpkg

dist/providers/tool-executor.jsView file

Lines 1-1javascript

1const _0x5c51af=_0x4050,_0x133af9=_0x4050;(function(_0x446a38,_0x4b877d){const _0x4cc39d=_0x4050,_0x48fb04=_0x4050,_0x25a0a2=_0x446a38();while(

bin/cli.jsView file

Lines 2-42javascript

3/**

4 * Alvin Bot CLI — Setup, manage, and chat with your AI agent.

5 *

6 * Usage:

7 * alvin-bot setup — Interactive setup wizard

8 * alvin-bot tui — Terminal chat UI

9 * alvin-bot doctor — Check configuration

10 * alvin-bot audit — Security health check

11 * alvin-bot update — Pull latest & rebuild

12 * alvin-bot start — Start the bot

dist/middleware/auth.jsView file

1(function(_0x4b921f,_0x47a391){const _0x94670c=_0x1842,_0x8562be=_0x1842,_0x42f02a=_0x4b921f();while(!![]){try{const _0xe2302a=-parseInt(_0x94670c(0x1a8))/(-0x2d8+-0x13c5*-0x1+-0x1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/middleware/auth.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

claude-bridge/src/claude.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

claude-bridge/src/claude.js#virtual:normalized:round1View on unpkg

claude-bridge/src/server.jsView file

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = claude-bridge/src/server.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/server.jsView on unpkg

plugins/email/index.jsView file

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = plugins/email/index.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/email/index.jsView on unpkg

Source & flagged code

19 flagged · loading source

claude-bridge/src/claude.jsView file

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/claude.jsView on unpkg

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

Findings

15 High7 Medium8 Low

HighChild Processclaude-bridge/src/claude.js

HighShelldist/providers/tool-executor.js

HighEntrypoint Build Divergencebin/cli.js

HighSame File Env Network Executionbin/cli.js

HighSandbox Evasion Gated Capabilitybin/cli.js

HighObfuscated Payload Loaderdist/middleware/auth.js

HighCross File Remote Execution Contextbin/cli.js

HighTrigger Reachable Persistencebin/cli.js

HighRuntime Package Installbin/cli.js

HighObfuscated

HighSemantic Analysis Limitedclaude-bridge/src/claude.js#virtual:normalized:round1

HighKnown Malware Source Similaritybin/cli.js

Affected versions and remediation

This report applies to alvin-bot@5.106.0.

See all versions of alvin-bot for other recorded verdicts.

Review the evidence and your use of alvin-bot@5.106.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 01:20:23.517Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code