registry / AI-agent control-surface risk / claude-codex-wechat
claude-codex-wechat
`claude-codex-wechat` 是一个本地 bridge daemon。它把：
This report shows the evidence for claude-codex-wechat@0.1.33. 2 of 26 known versions are blocked or flagged. The newest version, 0.1.60, is flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package crosses the block boundary because a lifecycle hook silently registers a package-controlled MCP server into Codex, a foreign/broad AI-agent control surface. The planted tools are product-themed, but the install-time unconsented delivery is the blockable behavior under policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm install runs the postinstall lifecycle when `codex` is present
Impact
Foreign AI-agent control surface is modified at install time, granting the package persistent agent tools capable of file transmission via the local bridge.
Mechanism
unconsented global Codex MCP registration
Policy narrative
On npm install, the postinstall script checks for Codex and then runs `codex mcp add wechat-media ... node dist/mcp/mediaServer.js`, silently registering a package MCP server into Codex. The registered server exposes agent-callable tools to send arbitrary local file paths to the package's WeChat bridge and to execute a downloader helper from package or user skill locations. This is an unconsented lifecycle mutation of a broad AI-agent control surface.
AI rationale
The package crosses the block boundary because a lifecycle hook silently registers a package-controlled MCP server into Codex, a foreign/broad AI-agent control surface. The planted tools are product-themed, but the install-time unconsented delivery is the blockable behavior under policy.
Evidence
package.jsonscripts/postinstall-codex-mcp.mjsdist/mcp/mediaServer.jsdist/server/cli.js~/.agents/skills/douyin-download/scripts/douyin-download.mjs~/.claude/skills/douyin-download/scripts/douyin-download.mjs
Network endpoints3
localhost:8787ilinkai.weixin.qq.comwss://wechat.style520.com/agent
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json postinstall runs scripts/postinstall-codex-mcp.mjs on install
- postinstall executes `codex mcp remove/add wechat-media` without user confirmation
- postinstall registers dist/mcp/mediaServer.js into Codex with BRIDGE_API_URL=http://localhost:8787
- dist/mcp/mediaServer.js exposes MCP tools that send arbitrary file paths to the WeChat bridge
- dist/mcp/mediaServer.js can exec a douyin-download script from package/user skill locations
Evidence against
- No install-time network fetch or decoded remote code execution found in inspected postinstall source
- MCP endpoints are mostly localhost/package-aligned for a WeChat bridge
- Main CLI service and persistence are user-invoked commands, not import-time execution
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
NoLicenseWildcardDependency
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall-codex-mcp.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/server/cli.jsView file
22// src/channels/weixin-direct/loginClient.ts
L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";
L24: var WeixinDirectLoginClient = class {
...
L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`);
L62: const payload = await response.json();
L63: return payload.data ?? payload;
...
L71: function defaultConfigPath() {
L72: return join(homedir(), ".claude-codex-wechat", "config.json");
L73: }
L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) {
L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path);
...
L170: function isRetriableRenameError(error) {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/server/cli.jsView on unpkg · L22•Trigger-reachable chain: manifest.bin -> dist/server/cli.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/server/cli.jsView on unpkg2762// src/providers/claude-code/claudeStreamingRunner.ts
L2763: import { spawn as spawn3 } from "node:child_process";
L2764: import { randomUUID as randomUUID2 } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/server/cli.jsView on unpkg · L276222Detached bundled service listener: dist/server/cli.js launches a Node helper and exposes a broad-bound HTTP listener.
L22: // src/channels/weixin-direct/loginClient.ts
L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";
L24: var WeixinDirectLoginClient = class {
...
L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`);
L62: const payload = await response.json();
L63: return payload.data ?? payload;
...
L71: function defaultConfigPath() {
L72: return join(homedir(), ".claude-codex-wechat", "config.json");
L73: }
L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) {
L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path);
...
L170: function isRetriableRenameError(error) {
High
Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist/server/cli.jsView on unpkg · L22•matchType = normalized_sha256
matchedPackage = claude-codex-wechat@0.1.31
matchedPath = dist/server/cli.js
matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.31
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/cli.jsView on unpkg22// src/channels/weixin-direct/loginClient.ts
L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";
L24: var WeixinDirectLoginClient = class {
...
L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`);
L62: const payload = await response.json();
L63: return payload.data ?? payload;
...
L71: function defaultConfigPath() {
L72: return join(homedir(), ".claude-codex-wechat", "config.json");
L73: }
L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) {
L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path);
...
L170: function isRetriableRenameError(error) {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/server/cli.jsView on unpkg · L2222// src/channels/weixin-direct/loginClient.ts
L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";
L24: var WeixinDirectLoginClient = class {
...
L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`);
L62: const payload = await response.json();
L63: return payload.data ?? payload;
...
L71: function defaultConfigPath() {
L72: return join(homedir(), ".claude-codex-wechat", "config.json");
L73: }
L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) {
L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path);
...
L170: function isRetriableRenameError(error) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/server/cli.jsView on unpkg · L22dist/mcp/mediaServer.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = claude-codex-wechat@0.1.30
matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.30
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/mcp/mediaServer.jsView on unpkg94// src/mcp/tools/douyinDownload.ts
L95: import { execFile } from "node:child_process";
L96: import { existsSync } from "node:fs";
...
L100: import { z as z2 } from "zod";
L101: var BRIDGE_API_URL2 = process.env.BRIDGE_API_URL || "http://localhost:8787";
L102: function findDouyinScript() {
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp/mediaServer.jsView on unpkg · L94121return new Promise((resolve2, reject) => {
L122: execFile("node", [script, ...args], { timeout: 12e4 }, (err, stdout, stderr) => {
L123: if (err) reject(new Error(stderr || err.message));
...
L129: const fileName = basename2(filePath) || "video.mp4";
L130: const response = await fetch(`${BRIDGE_API_URL2}/api/channel/send-media`, {
L131: method: "POST",
L132: headers: { "content-type": "application/json" },
L133: body: JSON.stringify({ kind, filePath, fileName })
L134: });
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/mcp/mediaServer.jsView on unpkg · L121dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file
•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2
kind = high_entropy_blob
sizeBytes = 134044
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkgFindings
3 Critical8 High5 Medium7 Low
CriticalRemote Asset Decode Executedist/server/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js
CriticalPrevious Version Dangerous Deltadist/mcp/mediaServer.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/server/cli.js
HighShell
HighSame File Env Network Executiondist/mcp/mediaServer.js
HighCommand Output Exfiltrationdist/mcp/mediaServer.js
HighSpawned Bundled Service Listenerdist/server/cli.js
HighShips High Entropy Blobdist/web/assets/bootstrap-icons-mSm7cUeB.woff2
HighKnown Malware Source Similaritydist/server/cli.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/server/cli.js
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/server/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to claude-codex-wechat@0.1.33.
The versions list below shows the verdict for each recorded version.
- Avoid installing claude-codex-wechat@0.1.33. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
26 known versions0.1.60latestSuspicious—WarnPublishedOct 14, 2026, 2:49 PM0.1.59SuspiciousPersistenceWarnPublishedAug 14, 2026, 2:57 AM0.1.54SuspiciousAgent extension lifecycle riskWarnPublishedAug 13, 2026, 3:48 AM0.1.53SuspiciousAI-agent capability abuseWarnPublishedAug 13, 2026, 2:13 AM0.1.52SuspiciousAI-agent capability abuseWarnPublishedAug 13, 2026, 1:59 AM0.1.51SuspiciousAI-agent capability abuseWarnPublishedAug 13, 2026, 1:50 AM0.1.50Clean—AllowPublishedJul 12, 2026, 3:42 AM0.1.49SuspiciousAgent extension lifecycle riskWarnPublishedJul 12, 2026, 1:26 AM0.1.48SuspiciousAgent extension lifecycle riskWarnPublishedJul 10, 2026, 12:56 PM0.1.46SuspiciousAI-agent capability abuseWarnPublishedJul 10, 2026, 10:13 AM0.1.40SuspiciousAI-agent capability abuseWarnPublishedJul 5, 2026, 5:16 AM0.1.38SuspiciousAI-agent capability abuseWarnPublishedJul 4, 2026, 10:52 AM0.1.37SuspiciousAI-agent capability abuseWarnPublishedJul 4, 2026, 9:36 AM0.1.36SuspiciousAI-agent capability abuseWarnPublishedJul 3, 2026, 5:39 PM0.1.35SuspiciousAI-agent capability abuseWarnPublishedJul 3, 2026, 5:28 PM0.1.34SuspiciousAI-agent capability abuseWarnPublishedJul 3, 2026, 4:39 PM0.1.33shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 3, 2026, 4:29 PM0.1.31MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 3, 2026, 1:01 PM0.1.30SuspiciousAI-agent capability abuseWarnPublishedJul 3, 2026, 11:11 AM0.1.27SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 2, 2026, 4:21 PM0.1.25SuspiciousAI-agent capability abuseWarnPublishedJul 2, 2026, 2:14 PM0.1.24SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 2, 2026, 1:37 PM0.1.22Clean—AllowPublishedJul 2, 2026, 1:01 PM0.1.21SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 2, 2026, 12:50 PM0.1.19SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 1, 2026, 7:20 AM0.1.18SuspiciousRemote Code ExecutionWarnPublishedJul 1, 2026, 7:09 AM