registry / chatccc / 0.2.204

chatccc@0.2.204

⚠ Under review

Feishu bot bridge for Claude Code

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 75 file(s), 844 KB of source, external domains: 127.0.0.1, api.deepseek.com, api2.cursor.sh, chatgpt.com, litellm.hypergryph.net, open.feishu.cn, open.larksuite.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 24-64json

24 "package.json",

25 "README.md",

26 "config.sample.json"

27 ],

28 "scripts": {

29 "dev": "tsx src/index.ts",

30 "chatccc": "tsx src/index.ts",

31 "start": "tsx src/index.ts",

32 "demo:bot-test": "tsx demo/bot_test.ts",

33 "demo:bot-test:local": "tsx demo/bot_test.ts --local",

34 "demo:create-group": "tsx src/index.ts",

35 "demo:create-group:local": "tsx src/index.ts --local",

36 "demo:permission-check": "tsx demo/permission_check.ts",

37 "demo:claude-hi": "tsx demo/claude_say_hi.ts",

38 "demo:codex-hi": "tsx demo/codex_say_hi.ts",

39 "demo:codex-app-server-approval": "tsx demo/codex-app-server-approval/approval_demo.ts",

40 "demo:ilink-echo": "tsx demo/ilink_echo_probe.ts",

41 "claude-proxy": "tsx src/litellm-proxy.ts",

42 "test": "vitest run",

43 "test:watch": "vitest",

44 "postinstall": "node scripts/postinstall-sharp-check.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

45 },

46 "dependencies": {

47 "@ai-sdk/openai-compatible": "^2.0.47",

48 "@anthropic-ai/claude-agent-sdk": "0.2.133",

49 "@larksuiteoapi/node-sdk": "^1.59.0",

50 "@openilink/openilink-sdk-node": "^0.6.0",

51 "ai": "^6.0.184",

52 "nodemailer": "^8.0.7",

53 "qrcode-terminal": "^0.12.0",

54 "sharp": "^0.34.5",

55 "tsx": "^4.0.0",

56 "ws": "^8.18.0"

57 },

58 "devDependencies": {

59 "@types/node": "^20.0.0",

60 "@types/qrcode-terminal": "^0.12.2",

61 "@types/ws": "^8.18.1",

62 "typescript": "^5.0.0",

63 "vitest": "^3.2.4"

64 },

bin/chatccc.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/chatccc.mjsView on unpkg · L1

4import { dirname, join } from "node:path";

6const require

src/startup-lifecycle.tsView file

Lines 56-96typescript

56 const platform = deps.platform ?? process.platform;

57 const env = deps.env ?? process.env;

58 const spawnImpl = deps.spawnImpl ?? spawn;

59 const onError = deps.onError ??

src/builtin/context.tsView file

Lines 30-70typescript

30 totalMessages: number;

31 compactedMessages: number;

32 hasSummary: boolean;

33 contextFilePath: string;

34}

36export interface BuiltinCompactionPlan {

37 previousSummary: string;

src/orchestrator.tsView file

Lines 427-467typescript

427}

428

429const UPDATE_LOG = join(homedir(), ".chatccc", "logs", "update-watcher.log");

430

431function updLog(msg: string): void {

432

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-sharp-check.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/chatccc.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/chatccc.mjsView on unpkg · L1

src/startup-lifecycle.tsView file

76// `start` 会把第一个带引号的参数当窗口标题，空字符串是必要占位符。 L77: child = spawnImpl("cmd.exe", ["/c", "start", "", url], { L78: detached: true,

High

Shell

Package source references shell execution.

src/startup-lifecycle.tsView on unpkg · L76

src/builtin/context.tsView file

50L51: export const DEFAULT_BUILTIN_CONTEXT_DIR = join(homedir(), ".chatccc", "builtin", "sessions"); L52: export const DEFAULT_COMPACT_AT_TOKENS = 48_000; ... L134: const raw = readFileSync(filePath, "utf8"); L135: const state = normalizeState(JSON.parse(raw), normalizedSessionId); L136: return { ... L221: L222: private readonly cwd?: string; L223: private state: BuiltinContextState;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/builtin/context.tsView on unpkg · L50

src/orchestrator.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = chatccc@0.2.203 matchedIdentity = npm:Y2hhdGNjYw:0.2.203 similarity = 0.946 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/orchestrator.tsView on unpkg

447try { L448: const out = execSync(`${npmCmd} update -g chatccc 2>&1`, { encoding: "utf8", timeout: 120000, windowsHide: true }); L449: const elapsed = Date.now() - t0; ... L459: updLog(`fallback: ${npmCmd} install -g chatccc@latest`); L460: appendStartupTrace("update: npm install fallback begin", { npmCmd }); L461: const t1 = Date.now();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/orchestrator.tsView on unpkg · L447

Findings

1 Critical4 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltasrc/orchestrator.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/chatccc.mjs

HighShellsrc/startup-lifecycle.ts

HighRuntime Package Installsrc/orchestrator.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/builtin/context.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 24-64json

24 "package.json",

25 "README.md",

26 "config.sample.json"

27 ],

28 "scripts": {

29 "dev": "tsx src/index.ts",

30 "chatccc": "tsx src/index.ts",

31 "start": "tsx src/index.ts",

32 "demo:bot-test": "tsx demo/bot_test.ts",

33 "demo:bot-test:local": "tsx demo/bot_test.ts --local",

34 "demo:create-group": "tsx src/index.ts",

35 "demo:create-group:local": "tsx src/index.ts --local",

36 "demo:permission-check": "tsx demo/permission_check.ts",

37 "demo:claude-hi": "tsx demo/claude_say_hi.ts",

38 "demo:codex-hi": "tsx demo/codex_say_hi.ts",

39 "demo:codex-app-server-approval": "tsx demo/codex-app-server-approval/approval_demo.ts",

40 "demo:ilink-echo": "tsx demo/ilink_echo_probe.ts",

41 "claude-proxy": "tsx src/litellm-proxy.ts",

42 "test": "vitest run",

43 "test:watch": "vitest",

44 "postinstall": "node scripts/postinstall-sharp-check.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

45 },

46 "dependencies": {

47 "@ai-sdk/openai-compatible": "^2.0.47",

48 "@anthropic-ai/claude-agent-sdk": "0.2.133",

49 "@larksuiteoapi/node-sdk": "^1.59.0",

50 "@openilink/openilink-sdk-node": "^0.6.0",

51 "ai": "^6.0.184",

52 "nodemailer": "^8.0.7",

53 "qrcode-terminal": "^0.12.0",

54 "sharp": "^0.34.5",

55 "tsx": "^4.0.0",

56 "ws": "^8.18.0"

57 },

58 "devDependencies": {

59 "@types/node": "^20.0.0",

60 "@types/qrcode-terminal": "^0.12.2",

61 "@types/ws": "^8.18.1",

62 "typescript": "^5.0.0",

63 "vitest": "^3.2.4"

64 },

bin/chatccc.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

bin/chatccc.mjsView on unpkg · L1

4import { dirname, join } from "node:path";

6const require

src/startup-lifecycle.tsView file

Lines 56-96typescript

56 const platform = deps.platform ?? process.platform;

57 const env = deps.env ?? process.env;

58 const spawnImpl = deps.spawnImpl ?? spawn;

59 const onError = deps.onError ??

src/builtin/context.tsView file

Lines 30-70typescript

30 totalMessages: number;

31 compactedMessages: number;

32 hasSummary: boolean;

33 contextFilePath: string;

34}

36export interface BuiltinCompactionPlan {

37 previousSummary: string;

src/orchestrator.tsView file

Lines 427-467typescript

427}

428

429const UPDATE_LOG = join(homedir(), ".chatccc", "logs", "update-watcher.log");

430

431function updLog(msg: string): void {

432