registry / chatccc / 0.2.194

chatccc@0.2.194

⚠ Under review

Feishu bot bridge for Claude Code

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 770 KB of source, external domains: 127.0.0.1, api.deepseek.com, api2.cursor.sh, chatgpt.com, litellm.hypergryph.net, open.feishu.cn, open.larksuite.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 23-63json

23 "images/avatars/combinations/",

24 "package.json",

25 "README.md",

26 "config.sample.json"

27 ],

28 "scripts": {

29 "dev": "tsx src/index.ts",

30 "chatccc": "tsx src/index.ts",

31 "start": "tsx src/index.ts",

32 "demo:bot-test": "tsx demo/bot_test.ts",

33 "demo:bot-test:local": "tsx demo/bot_test.ts --local",

34 "demo:create-group": "tsx src/index.ts",

35 "demo:create-group:local": "tsx src/index.ts --local",

36 "demo:permission-check": "tsx demo/permission_check.ts",

37 "demo:claude-hi": "tsx demo/claude_say_hi.ts",

38 "demo:codex-hi": "tsx demo/codex_say_hi.ts",

39 "demo:ilink-echo": "tsx demo/ilink_echo_probe.ts",

40 "claude-proxy": "tsx src/litellm-proxy.ts",

41 "test": "vitest run",

42 "test:watch": "vitest",

43 "postinstall": "node scripts/postinstall-sharp-check.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

44 },

45 "dependencies": {

46 "@ai-sdk/openai-compatible": "^2.0.47",

47 "@anthropic-ai/claude-agent-sdk": "0.2.133",

48 "@larksuiteoapi/node-sdk": "^1.59.0",

49 "@openilink/openilink-sdk-node": "^0.6.0",

50 "ai": "^6.0.184",

51 "nodemailer": "^8.0.7",

52 "qrcode-terminal": "^0.12.0",

53 "sharp": "^0.34.5",

54 "tsx": "^4.0.0",

55 "ws": "^8.18.0"

56 },

57 "devDependencies": {

58 "@types/node": "^20.0.0",

59 "@types/qrcode-terminal": "^0.12.2",

60 "@types/ws": "^8.18.1",

61 "typescript": "^5.0.0",

62 "vitest": "^3.2.4"

63 },

bin/chatccc.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/chatccc.mjsView on unpkg · L1

4import { dirname, join } from "node:path";

6const require

src/git-command.tsView file

Lines 27-67typescript

27 /** 命令超过 timeoutMs 被强制终止 */

28 timedOut: boolean;

29 /** spawn 自身错误（如 git 不在 PATH）；正常退出（含非 0）时为 undefined */

30 spawnError?: string;

31}

33export interface RunGitOptions {

34 /** 命令最大允许执行毫秒数；超过则 SIGKILL，默认 60_000 */

35 timeoutMs?:

src/builtin/context.tsView file

Lines 30-70typescript

30 totalMessages: number;

31 compactedMessages: number;

32 hasSummary: boolean;

33 contextFilePath: string;

34}

36export interface BuiltinCompactionPlan {

37 previousSummary: string;

src/orchestrator.tsView file

Lines 458-498typescript

458}

459

460const UPDATE_LOG = join(homedir(), ".chatccc", "logs", "update-watcher.log");

461

462function updLog(msg: string): void {

463

src/config.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = chatccc@0.2.191 matchedIdentity = npm:Y2hhdGNjYw:0.2.191 similarity = 0.906 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/config.tsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-sharp-check.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/chatccc.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/chatccc.mjsView on unpkg · L1

src/git-command.tsView file

47* 在 `cwd` 目录下执行 `git <args>`。 L48: * - 通过 shell 执行（`shell: true`），允许用户使用引号、管道等 shell 语法 L49: * - stdout/stderr 各自最多采集 `maxBytes` 字节，超过则置 truncated=true 并丢弃后续片段

High

Shell

Package source references shell execution.

src/git-command.tsView on unpkg · L47

src/builtin/context.tsView file

50L51: export const DEFAULT_BUILTIN_CONTEXT_DIR = join(homedir(), ".chatccc", "builtin", "sessions"); L52: export const DEFAULT_COMPACT_AT_TOKENS = 48_000; ... L134: const raw = readFileSync(filePath, "utf8"); L135: const state = normalizeState(JSON.parse(raw), normalizedSessionId); L136: return { ... L221: L222: private readonly cwd?: string; L223: private state: BuiltinContextState;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/builtin/context.tsView on unpkg · L50

src/orchestrator.tsView file

478try { L479: const out = execSync(`${npmCmd} update -g chatccc 2>&1`, { encoding: "utf8", timeout: 120000, windowsHide: true }); L480: const elapsed = Date.now() - t0; ... L490: updLog(`fallback: ${npmCmd} install -g chatccc@latest`); L491: appendStartupTrace("update: npm install fallback begin", { npmCmd }); L492: const t1 = Date.now();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/orchestrator.tsView on unpkg · L478

src/config.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/config.tsView on unpkg

Findings

1 Critical4 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltasrc/config.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/chatccc.mjs

HighShellsrc/git-command.ts

HighRuntime Package Installsrc/orchestrator.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/builtin/context.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 23-63json

23 "images/avatars/combinations/",

24 "package.json",

25 "README.md",

26 "config.sample.json"

27 ],

28 "scripts": {

29 "dev": "tsx src/index.ts",

30 "chatccc": "tsx src/index.ts",

31 "start": "tsx src/index.ts",

32 "demo:bot-test": "tsx demo/bot_test.ts",

33 "demo:bot-test:local": "tsx demo/bot_test.ts --local",

34 "demo:create-group": "tsx src/index.ts",

35 "demo:create-group:local": "tsx src/index.ts --local",

36 "demo:permission-check": "tsx demo/permission_check.ts",

37 "demo:claude-hi": "tsx demo/claude_say_hi.ts",

38 "demo:codex-hi": "tsx demo/codex_say_hi.ts",

39 "demo:ilink-echo": "tsx demo/ilink_echo_probe.ts",

40 "claude-proxy": "tsx src/litellm-proxy.ts",

41 "test": "vitest run",

42 "test:watch": "vitest",

43 "postinstall": "node scripts/postinstall-sharp-check.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

44 },

45 "dependencies": {

46 "@ai-sdk/openai-compatible": "^2.0.47",

47 "@anthropic-ai/claude-agent-sdk": "0.2.133",

48 "@larksuiteoapi/node-sdk": "^1.59.0",

49 "@openilink/openilink-sdk-node": "^0.6.0",

50 "ai": "^6.0.184",

51 "nodemailer": "^8.0.7",

52 "qrcode-terminal": "^0.12.0",

53 "sharp": "^0.34.5",

54 "tsx": "^4.0.0",

55 "ws": "^8.18.0"

56 },

57 "devDependencies": {

58 "@types/node": "^20.0.0",

59 "@types/qrcode-terminal": "^0.12.2",

60 "@types/ws": "^8.18.1",

61 "typescript": "^5.0.0",

62 "vitest": "^3.2.4"

63 },

bin/chatccc.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/chatccc.mjsView on unpkg · L1

4import { dirname, join } from "node:path";

6const require

src/git-command.tsView file

Lines 27-67typescript

27 /** 命令超过 timeoutMs 被强制终止 */

28 timedOut: boolean;

29 /** spawn 自身错误（如 git 不在 PATH）；正常退出（含非 0）时为 undefined */

30 spawnError?: string;

31}

33export interface RunGitOptions {

34 /** 命令最大允许执行毫秒数；超过则 SIGKILL，默认 60_000 */

35 timeoutMs?:

src/builtin/context.tsView file

Lines 30-70typescript

30 totalMessages: number;

31 compactedMessages: number;

32 hasSummary: boolean;

33 contextFilePath: string;

34}

36export interface BuiltinCompactionPlan {

37 previousSummary: string;

src/orchestrator.tsView file

Lines 458-498typescript

458}

459

460const UPDATE_LOG = join(homedir(), ".chatccc", "logs", "update-watcher.log");

461

462function updLog(msg: string): void {

463

src/config.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/config.tsView on unpkg