registry  /  chatccc  /  0.2.203

chatccc@0.2.203

Feishu bot bridge for Claude Code

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The running bridge grants its agent/local RPC surface the ability to send selected absolute-path files to bound Feishu or WeChat chats. This is an intentional but high-impact data-transfer capability, not an install-time payload.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run the configured bot and invoke an agent skill or local RPC/helper with a session and file path.
Impact
A compromised local agent context or local process could exfiltrate allowed document/media files to an attached chat.
Mechanism
Agent-assisted local file upload to configured IM chats.
Rationale
Source does not support a malicious/install-time verdict: the lifecycle hook is a local `sharp` diagnostic. However, the package intentionally exposes powerful agent-mediated local-file upload and chat-triggered self-update capabilities, warranting a warning for dangerous capability risk.
Evidence
package.jsonscripts/postinstall-sharp-check.mjssrc/index.tssrc/orchestrator.tssrc/agent-file-rpc.tssrc/im-skills.tsim-skills/feishu-skill/send-file.mjsim-skills/wechat-file-skill/send-file.mjs~/.chatccc/state/ilink-auth.json
Network endpoints1
open.feishu.cn/open-apis

Decision evidence

public snapshot
AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • `src/agent-file-rpc.ts` accepts absolute paths and sends allowed local files to Feishu chats bound to a session.
  • `im-skills/wechat-file-skill/send-file.mjs` reads a user-supplied absolute file and uploads it through the configured iLink client.
  • `src/im-skills.ts` injects bundled file/image sending instructions into agent prompts.
  • `src/orchestrator.ts` implements chat-triggered global `npm update/install` and restart behavior.
Evidence against
  • `scripts/postinstall-sharp-check.mjs` only locally requires `sharp` and prints diagnostics; it has no network, write, or agent-control mutation.
  • `src/index.ts` binds the HTTP/RPC service to `127.0.0.1`.
  • No inspected source automatically harvests credentials or uploads files at install or import time.
  • CLI launchers only start packaged TypeScript entrypoints with inherited user arguments/environment.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 74 file(s), 834 KB of source, external domains: 127.0.0.1, api.deepseek.com, api2.cursor.sh, chatgpt.com, litellm.hypergryph.net, open.feishu.cn, open.larksuite.com, www.w3.org

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall-sharp-check.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
bin/chatccc.mjsView file
1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { createRequire } from "node:module";
High
Child Process

Package source references child process execution.

bin/chatccc.mjsView on unpkg · L1
src/git-command.tsView file
47* 在 `cwd` 目录下执行 `git <args>`。 L48: * - 通过 shell 执行（`shell: true`），允许用户使用引号、管道等 shell 语法 L49: * - stdout/stderr 各自最多采集 `maxBytes` 字节，超过则置 truncated=true 并丢弃后续片段
High
Shell

Package source references shell execution.

src/git-command.tsView on unpkg · L47
src/builtin/context.tsView file
50L51: export const DEFAULT_BUILTIN_CONTEXT_DIR = join(homedir(), ".chatccc", "builtin", "sessions"); L52: export const DEFAULT_COMPACT_AT_TOKENS = 48_000; ... L134: const raw = readFileSync(filePath, "utf8"); L135: const state = normalizeState(JSON.parse(raw), normalizedSessionId); L136: return { ... L221: L222: private readonly cwd?: string; L223: private state: BuiltinContextState;
Low
Weak Crypto

Package source references weak cryptographic algorithms.

src/builtin/context.tsView on unpkg · L50
src/orchestrator.tsView file
•matchType = previous_version_dangerous_delta matchedPackage = chatccc@0.2.191 matchedIdentity = npm:Y2hhdGNjYw:0.2.191 similarity = 0.813 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/orchestrator.tsView on unpkg
446try { L447: const out = execSync(`${npmCmd} update -g chatccc 2>&1`, { encoding: "utf8", timeout: 120000, windowsHide: true }); L448: const elapsed = Date.now() - t0; ... L458: updLog(`fallback: ${npmCmd} install -g chatccc@latest`); L459: appendStartupTrace("update: npm install fallback begin", { npmCmd }); L460: const t1 = Date.now();
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

src/orchestrator.tsView on unpkg · L446

Findings

1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltasrc/orchestrator.ts
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/chatccc.mjs
HighShellsrc/git-command.ts
HighRuntime Package Installsrc/orchestrator.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/builtin/context.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings