registry  /  chatccc  /  0.2.190

chatccc@0.2.190

Feishu bot bridge for Claude Code

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 64 file(s), 747 KB of source, external domains: 127.0.0.1, api.deepseek.com, api2.cursor.sh, chatgpt.com, litellm.hypergryph.net, open.feishu.cn, open.larksuite.com, www.w3.org

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall-sharp-check.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
bin/chatccc.mjsView file
1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { createRequire } from "node:module";
High
Child Process

Package source references child process execution.

bin/chatccc.mjsView on unpkg · L1
src/git-command.tsView file
47* 在 `cwd` 目录下执行 `git <args>`。 L48: * - 通过 shell 执行（`shell: true`），允许用户使用引号、管道等 shell 语法 L49: * - stdout/stderr 各自最多采集 `maxBytes` 字节，超过则置 truncated=true 并丢弃后续片段
High
Shell

Package source references shell execution.

src/git-command.tsView on unpkg · L47
src/orchestrator.tsView file
478try { L479: const out = execSync(`${npmCmd} update -g chatccc 2>&1`, { encoding: "utf8", timeout: 120000, windowsHide: true }); L480: const elapsed = Date.now() - t0; ... L490: updLog(`fallback: ${npmCmd} install -g chatccc@latest`); L491: appendStartupTrace("update: npm install fallback begin", { npmCmd }); L492: const t1 = Date.now();
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

src/orchestrator.tsView on unpkg · L478

Findings

4 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/chatccc.mjs
HighShellsrc/git-command.ts
HighRuntime Package Installsrc/orchestrator.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings