registry / AI-agent capability abuse / alvin-bot / 5.107.0

alvin-bot@5.107.0

Self-hosted autonomous AI agent on Telegram, Slack, Discord, WhatsApp, Signal, terminal & web. Claude Agent SDK + multi-provider engine with auto-failover, detached sub-agents, zero-config memory. Local-first, telemetry-free.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No automatic install-time attack or confirmed exfiltration was found. Deliberate obfuscation of the executable main entry point combined with broad local-agent capabilities leaves a material unresolved risk.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The user starts or imports the package, or invokes its CLI commands.

Impact

An operator who runs it grants the package broad local automation capability; the obfuscation prevents confirming that this power is limited to stated functions.

Mechanism

Obfuscated autonomous-agent runtime with shell, browser, email, and persistence features.

AI rationale

Evidence

dist/index.jsbin/cli.jsclaude-bridge/src/claude.jsplugins/email/index.js~/Library/LaunchAgents/com.alvinbot.app.plist~/Library/LaunchAgents/com.alvinbot.deadman.plist

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The published runtime entry point is deliberately obfuscated, preventing reliable source-level verification of its behavior.
The Claude bridge starts a locally configured Claude executable with inherited environment variables.
The email plugin shells out to send email using caller-supplied recipient and body fields.
The CLI can evaluate caller-supplied JavaScript in a browser session.
The CLI creates a macOS LaunchAgent only through its explicit start or launchd commands.

Evidence against

The manifest has only a prepublishOnly hook; there is no install-time lifecycle hook.
The inspected command execution and persistence features are reached through explicit CLI actions.
No runtime dependency on alvin-bot itself was found in the manifest.
No confirmed credential exfiltration, foreign agent-control write, or automatic destructive action was verified.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEval

Source & flagged code

19 flagged

claude-bridge/src/claude.jsView file

Lines 1-22javascript

1'use strict';

3const { spawn } = require('child_process');

4const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

6const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude-bridge/src/claude.jsView on unpkg · L2

8// --- Stable alias per CLI session ---

9// Each session keeps one alias so resumed requests don't accumulate different

10// names in the Claude context (which would leak un-replaced aliases in output).

11const PREFIXES = ['Chat', 'Dev', 'Run', 'Ask', 'Net', 'App', 'Zen', 'Arc', 'Dot', 'Amp', 'Hex', 'Orb', 'Elm', 'Oak', 'Sky'];

12const SUFFIXES = ['Kit', 'Box', 'Pod', 'Hub', 'Lab', 'Ops', 'Bay', 'Tap', 'Rim', 'Fog', 'Dew', 'Fin', 'Gem', 'Jet', 'Cog'];

13const pick = (arr) => arr[Math.floor(Math.random() * arr.length)];

14const sessionAliasMap = new Map(); // sessionId → { alias, aliasLower, lastUsed }

15const sessionTokenMaps = new Map(); // sessionId → Map<original, replacement>

17function getSessionAlias(sessionId) {

18 if (!sessionId) {

19 const alias = pick(PREFIXES) + pick(SUFFIXES);

20 return { alias, aliasLower: alias.toLowerCase() };

21 }

22 let entry = sessionAliasMap.get(sessionId);

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = claude-bridge/src/claude.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/claude.jsView on unpkg

dist/providers/tool-executor.jsView file

Lines 1-1javascript

1const _0x37b05c=_0x165b,_0x21bdea=_0x165b;(function(_0x28ad7c,_0xe5010d){const _0x2a2434=_0x165b,_0x3afc61=_0x165b,_0xebeceb=_0x28ad7c();while(

bin/cli.jsView file

Lines 2-42javascript

3/**

4 * Alvin Bot CLI — Setup, manage, and chat with your AI agent.

5 *

6 * Usage:

7 * alvin-bot setup — Interactive setup wizard

8 * alvin-bot tui — Terminal chat UI

9 * alvin-bot doctor — Check configuration

10 * alvin-bot audit — Security health check

11 * alvin-bot update — Pull latest & rebuild

12 * alvin-bot start — Start the bot

dist/middleware/auth.jsView file

1(function(_0x452b4e,_0x245d75){const _0x5c84cb=_0x5fdf,_0x51bc7=_0x5fdf,_0x379a48=_0x452b4e();while(!![]){try{const _0x2c58b1=parseInt(_0x5c84cb(0x88))/(-0xc3*0xd+0xa05+-0x1*0x1d)*...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/middleware/auth.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

claude-bridge/src/claude.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

claude-bridge/src/claude.js#virtual:normalized:round1View on unpkg

claude-bridge/src/server.jsView file

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = claude-bridge/src/server.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/server.jsView on unpkg

plugins/email/index.jsView file

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = plugins/email/index.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/email/index.jsView on unpkg

Source & flagged code

19 flagged · loading source

claude-bridge/src/claude.jsView file

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/claude.jsView on unpkg

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

Findings

15 High7 Medium8 Low

HighChild Processclaude-bridge/src/claude.js

HighShelldist/providers/tool-executor.js

HighEntrypoint Build Divergencebin/cli.js

HighSame File Env Network Executionbin/cli.js

HighSandbox Evasion Gated Capabilitybin/cli.js

HighObfuscated Payload Loaderdist/middleware/auth.js

HighCross File Remote Execution Contextbin/cli.js

HighTrigger Reachable Persistencebin/cli.js

HighRuntime Package Installbin/cli.js

HighObfuscated

HighSemantic Analysis Limitedclaude-bridge/src/claude.js#virtual:normalized:round1

HighKnown Malware Source Similaritybin/cli.js

Affected versions and remediation

This report applies to alvin-bot@5.107.0.

See all versions of alvin-bot for other recorded verdicts.

Review the evidence and your use of alvin-bot@5.107.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-31 08:01:35.639Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code