22Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L33: // Data directory — same logic as src/paths.ts
L34: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L35:
...
L47: const ensureRL = () => {
L48: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L49: return rl;
...
L88: try {
L89: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L90: } catch { return ""; }
HighEntrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L22 1327console.log(`\n The Claude Agent SDK needs the native Claude Code binary.`);
L1328: console.log(` Install with:\n curl -fsSL https://claude.ai/install.sh | sh`);
L1329: console.log(` (npm install @anthropic-ai/claude-code is the alternative path.)\n`);
...
L1335: try {
L1336: execSync("curl -fsSL https://claude.ai/install.sh | sh", { stdio: "inherit", timeout: 120_000 });
L1337: const localBin = join(homedir(), ".local", "bin");
L1338: if (!process.env.PATH.includes(localBin)) {
L1339: process.env.PATH = `${localBin}:${process.env.PATH || ""}`;
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L1327 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
import { createInterface } from "readline";
import { existsSync, writeFileSync, readFileSync, mkdirSync, copyFileSync, readdirSync, statSync, accessSync, realpathSync, unlinkSync, chmodSync, constants as fsConstants } from "...
// Lazy-create the readline interface. If we create it eagerly, stdin becomes
desc: () => t("provider.claude.desc"),
name: "Claude — API key",
desc: () => t("provider.claudeapi.desc"),
// CLI bridge — no API key, no Agent SDK, but keeps full tools + sub-agents.
desc: () => "Advanced. Runs on your Claude Max/Pro subscription through the local Claude Code CLI bridge — no API key, no Agent SDK, full too
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
bin/cli.jsView on unpkg 22import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L33: // Data directory — same logic as src/paths.ts
L34: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L35:
...
L47: const ensureRL = () => {
L48: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L49: return rl;
...
L88: try {
L89: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L90: } catch { return ""; }
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/cli.jsView on unpkg · L22 22Cross-file remote execution chain: bin/cli.js spawns dist/i18n.js; helper contains network access plus dynamic code execution.
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L33: // Data directory — same logic as src/paths.ts
L34: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L35:
...
L47: const ensureRL = () => {
L48: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L49: return rl;
...
L88: try {
L89: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L90: } catch { return ""; }
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/cli.jsView on unpkg · L22 22Trigger-reachable persistence chain: manifest.bin -> bin/cli.js
L22: import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L33: // Data directory — same logic as src/paths.ts
L34: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L35:
...
L47: const ensureRL = () => {
L48: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L49: return rl;
...
L88: try {
L89: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L90: } catch { return ""; }
HighTrigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/cli.jsView on unpkg · L22 309install: () => {
L310: execSync("npm install -g playwright", { stdio: "inherit" });
L311: execSync("npx playwright install chromium", { stdio: "inherit" });
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
bin/cli.jsView on unpkg · L309 •matchType = normalized_sha256
matchedPackage = alvin-bot@5.149.0
matchedPath = bin/cli.js
matchedIdentity = npm:YWx2aW4tYm90:5.149.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/cli.jsView on unpkg 22import { homedir } from "os";
L23: import { execSync } from "child_process";
L24: import { initI18n, t, getLocale } from "../dist/i18n.js";
...
L33: // Data directory — same logic as src/paths.ts
L34: const DATA_DIR = process.env.ALVIN_DATA_DIR || join(homedir(), ".alvin-bot");
L35:
...
L47: const ensureRL = () => {
L48: if (!rl) rl = createInterface({ input: process.stdin, output: process.stdout });
L49: return rl;
...
L88: try {
L89: return JSON.parse(readFileSync(resolve(import.meta.dirname || ".", "../package.json"), "utf-8")).version;
L90: } catch { return ""; }
MediumInstall Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/cli.jsView on unpkg · L22 4902const js = process.argv[5] || "document.title";
L4903: const result = await page.evaluate(new Function(`return (${js})`));
L4904: console.log(JSON.stringify({ url: page.url(), result }, null, 2));
LowEval
Package source references a known benign dynamic code generation pattern.
bin/cli.jsView on unpkg · L4902