registry / claude-codex-wechat / 0.1.36

claude-codex-wechat@0.1.36

`claude-codex-wechat` 是一个本地 bridge daemon。它把：

AI Security Review

scanned 6h ago · by lpm-firewall-ai

The package is a WeChat-to-Claude/Codex bridge with a persistent daemon and agent-facing MCP tools. Risk is real but activated by the CLI/service workflow, not by npm installation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User runs claude-codex-wechat start or uses the running bridge/MCP tools.

Impact

Can route WeChat messages into Claude/Codex, send local files selected by the agent to WeChat, and alter Claude/Codex resume metadata.

Mechanism

persistent AI bridge daemon with permission-skipping Claude invocation and file-send MCP tools

Attack narrative

When started, the CLI installs or starts a persistent local bridge daemon, writes a package-owned MCP config, and launches Claude with permission skipping plus WeChat media tools. Runtime code can modify Claude/Codex session metadata to improve resume behavior and lets the agent send local files through the WeChat bridge. This is dangerous agent-facing functionality but not install-time hijacking.

Rationale

Source inspection confirms dangerous AI-agent capabilities and persistence only through the documented CLI start path, with no npm install-time execution or confirmed remote payload execution. Because the package can bypass Claude permissions and mutate foreign agent state at runtime, warn rather than mark clean.

Evidence

package.jsondist/server/cli.jsdist/mcp/mediaServer.jsdist/mcp/scripts/douyin-download.mjsREADME.mdconfig.example.json~/.claude-codex-wechat/config.json~/.claude-codex-wechat/mcp-media.json~/Library/LaunchAgents/com.claude-codex-wechat.plist~/.config/systemd/user/claude-codex-wechat.service~/.claude/projects/*.jsonl~/.claude/history.jsonl~/.codex/session_index.jsonl~/.codex/state_5.sqlite~/Downloads/douyin_*.mp4

Network endpoints7

ilinkai.weixin.qq.comwss://wechat.style520.com/agentnovac2c.cdn.weixin.qq.com/c2cregistry.npmmirror.com/claude-codex-wechat/latestlocalhost:8787www.iesdouyin.com/share/video/aweme.snssdk.com/aweme/v1/play/

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

dist/server/cli.js user-invoked start installs a persistent launchd/systemd/background daemon.
dist/server/cli.js launches Claude with --dangerously-skip-permissions and package MCP config.
dist/server/cli.js can rewrite ~/.claude session/history metadata and insert permissionMode bypassPermissions for sdk-cli sessions.
dist/server/cli.js writes Codex session index/state metadata under ~/.codex.
dist/mcp/mediaServer.js exposes MCP tools that send arbitrary local file paths to WeChat via the local bridge.

Evidence against

package.json has no install/postinstall/prepare lifecycle hook; prepublishOnly is publish-time only.
Default writes are package-owned config/service paths or user-invoked runtime state, not npm install-time mutation.
No eval/vm/Function or remote decode-execute behavior confirmed in inspected source.
Network endpoints are aligned with WeChat bridge, relay, update check, and Douyin download functionality.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 4 file(s), 477 KB of source, external domains: 127.0.0.1, aweme.snssdk.com, ilinkai.weixin.qq.com, novac2c.cdn.weixin.qq.com, react.dev, registry.npmmirror.com, www.apple.com, www.douyin.com, www.iesdouyin.com, www.w3.org

Source & flagged code

12 flagged

dist/server/cli.jsView file

Lines 2-42javascript

2import { createRequire as __cjsCreateRequire } from 'node:module'; const require = __cjsCreateRequire(import.meta.url);

4// src/cli.ts

5import { existsSync as existsSync11, readFileSync as readFileSync10 } from "node:fs";

6import { dirname as dirname9, join as join14 } from "node:path";

7import { fileURLToPath as fileURLToPath3 } from "node:url";

9// src/daemon/bootstrap.ts

10import { networkInterfaces } from "node:os";

12// src/daemon/server.ts

13import { mkdtempSync, existsSync as existsSync9, writeFileSync as writeFileSync2 } from "node:fs";

14import { tmpdir as tmpdir2 } from "node:os";

15import { dirname as dirname7, join as join11 } from "node:path";

16import { fileURLToPath as fileURLToPath2 } from "node:url";

17import Fastify from "fastify";

19// src/channels/platforms.ts

20var PRIMARY_WEIXIN_PLATFORM = "weixin";

22// src/channels/weixin-direct/loginClient.ts

23var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";

24var WeixinDirectLoginClient = class {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L22

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L22

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/cli.jsView on unpkg · L22

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/cli.jsView on unpkg · L22

25 baseUrl;

26 fetchImpl;

27 pollIntervalMs;

28 constructor(input = {}) {

29 this.baseUrl = (input.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");

30 this.fetchImpl = input.fetchImpl ?? fetch;

31 this.pollIntervalMs = input.pollIntervalMs ?? 2e3;

32 }

33 async fetchQrCode() {

34 const data = await this.getJson("ilink/bot/get_bot_qrcode?bot_type=3");

35 const ticket = data.qrcode?.trim();

36 const qrcodeData = data.qrcode_img_content?.trim();

37 if (!ticket || !qrcodeData) throw new Error("weixin_qrcode_missing_fields");

38 return { ticket, qrcodeData };

39 }

40 async pollQrCodeStatus(ticket) {

41 const data = await this.getJson(`ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(ticket)}`);

42 const status = data.status?.trim().toLowerCase() ?? "wait";

Lines 2742-2782javascript

2742 const isLastSlot = quota.remaining === 1;

2743 const hasMore = pending.length > 1;

2744 if (isLastSlot && hasMore) {

2745 await this.options.send(chatId, appendHintIfText(next));

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-codex-wechat@0.1.34 matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.34 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = claude-codex-wechat@0.1.33 matchedPath = dist/server/cli.js matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.33 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/cli.jsView on unpkg

dist/mcp/mediaServer.jsView file

Lines 74-141javascript

74 server2.registerTool(

75 "send_file",

76 {

77 description: '\u5C06\u6587\u4EF6\u53D1\u9001\u5230\u7528\u6237\u5FAE\u4FE1\u3002\u7528\u6237\u8BF4"\u628A\u6587\u4EF6\u53D1\u7ED9\u6211""\u6587\u6863\u53D1\u51FA\u6765""\u628AXX\u4F20\u7ED9\u6211"\u65F6\u8C03\u7528\u3002\u652F\u6301 PDF\u3001\u6587\u6863\u3001\u4EE3\u7801\u3001\u538B\u7F29\u5305\u7B49\u6240\u6709\u7C7B\u578B\u3002',

78 inputSchema: {

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file

•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkg

Source & flagged code

12 flagged · loading source

dist/server/cli.jsView file

22// src/channels/weixin-direct/loginClient.ts L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L24: var WeixinDirectLoginClient = class { ... L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`); L62: const payload = await response.json(); L63: return payload.data ?? payload; ... L71: function defaultConfigPath() { L72: return join(homedir(), ".claude-codex-wechat", "config.json"); L73: } L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) { L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path); ... L170: function isRetriableRenameError(error) {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L22

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/cli.jsView on unpkg

2762// src/providers/claude-code/claudeStreamingRunner.ts L2763: import { spawn as spawn3 } from "node:child_process"; L2764: import { randomUUID as randomUUID2 } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/server/cli.jsView on unpkg · L2762

22Detached bundled service listener: dist/server/cli.js launches a Node helper and exposes a broad-bound HTTP listener. L22: // src/channels/weixin-direct/loginClient.ts L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L24: var WeixinDirectLoginClient = class { ... L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`); L62: const payload = await response.json(); L63: return payload.data ?? payload; ... L71: function defaultConfigPath() { L72: return join(homedir(), ".claude-codex-wechat", "config.json"); L73: } L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) { L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path); ... L170: function isRetriableRenameError(error) {

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L22

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/cli.jsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/cli.jsView on unpkg · L22

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/cli.jsView on unpkg · L22

dist/mcp/mediaServer.jsView file

94// src/mcp/tools/douyinDownload.ts L95: import { execFile } from "node:child_process"; L96: import { existsSync } from "node:fs"; ... L100: import { z as z2 } from "zod"; L101: var BRIDGE_API_URL2 = process.env.BRIDGE_API_URL || "http://localhost:8787"; L102: function findDouyinScript() {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp/mediaServer.jsView on unpkg · L94

121return new Promise((resolve2, reject) => { L122: execFile("node", [script, ...args], { timeout: 12e4 }, (err, stdout, stderr) => { L123: if (err) reject(new Error(stderr || err.message)); ... L129: const fileName = basename2(filePath) || "video.mp4"; L130: const response = await fetch(`${BRIDGE_API_URL2}/api/channel/send-media`, { L131: method: "POST", L132: headers: { "content-type": "application/json" }, L133: body: JSON.stringify({ kind, filePath, fileName }) L134: });

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp/mediaServer.jsView on unpkg · L121

•matchType = normalized_sha256 matchedPackage = claude-codex-wechat@0.1.33 matchedPath = dist/mcp/mediaServer.js matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.33 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/mediaServer.jsView on unpkg

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file

•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkg

Findings

3 Critical8 High5 Medium7 Low

CriticalRemote Asset Decode Executedist/server/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js

CriticalPrevious Version Dangerous Deltadist/server/cli.js

HighChild Processdist/server/cli.js

HighShell

HighSame File Env Network Executiondist/mcp/mediaServer.js

HighCommand Output Exfiltrationdist/mcp/mediaServer.js

HighSpawned Bundled Service Listenerdist/server/cli.js

HighShips High Entropy Blobdist/web/assets/bootstrap-icons-mSm7cUeB.woff2

HighKnown Malware Source Similaritydist/mcp/mediaServer.js

HighKnown Malware Source Similaritydist/server/cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/server/cli.js

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/server/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

12 flagged

dist/server/cli.jsView file

Lines 2-42javascript

2import { createRequire as __cjsCreateRequire } from 'node:module'; const require = __cjsCreateRequire(import.meta.url);

4// src/cli.ts

5import { existsSync as existsSync11, readFileSync as readFileSync10 } from "node:fs";

6import { dirname as dirname9, join as join14 } from "node:path";

7import { fileURLToPath as fileURLToPath3 } from "node:url";

9// src/daemon/bootstrap.ts

10import { networkInterfaces } from "node:os";

12// src/daemon/server.ts

13import { mkdtempSync, existsSync as existsSync9, writeFileSync as writeFileSync2 } from "node:fs";

14import { tmpdir as tmpdir2 } from "node:os";

15import { dirname as dirname7, join as join11 } from "node:path";

16import { fileURLToPath as fileURLToPath2 } from "node:url";

17import Fastify from "fastify";

19// src/channels/platforms.ts

20var PRIMARY_WEIXIN_PLATFORM = "weixin";

22// src/channels/weixin-direct/loginClient.ts

23var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";

24var WeixinDirectLoginClient = class {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L22

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L22

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/cli.jsView on unpkg · L22

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/cli.jsView on unpkg · L22

25 baseUrl;

26 fetchImpl;

27 pollIntervalMs;

28 constructor(input = {}) {

29 this.baseUrl = (input.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");

30 this.fetchImpl = input.fetchImpl ?? fetch;

31 this.pollIntervalMs = input.pollIntervalMs ?? 2e3;

32 }

33 async fetchQrCode() {

34 const data = await this.getJson("ilink/bot/get_bot_qrcode?bot_type=3");

35 const ticket = data.qrcode?.trim();

36 const qrcodeData = data.qrcode_img_content?.trim();

37 if (!ticket || !qrcodeData) throw new Error("weixin_qrcode_missing_fields");

38 return { ticket, qrcodeData };

39 }

40 async pollQrCodeStatus(ticket) {

41 const data = await this.getJson(`ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(ticket)}`);

42 const status = data.status?.trim().toLowerCase() ?? "wait";

Lines 2742-2782javascript

2742 const isLastSlot = quota.remaining === 1;

2743 const hasMore = pending.length > 1;

2744 if (isLastSlot && hasMore) {

2745 await this.options.send(chatId, appendHintIfText(next));

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/cli.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/cli.jsView on unpkg

dist/mcp/mediaServer.jsView file

Lines 74-141javascript

74 server2.registerTool(

75 "send_file",

76 {

78 inputSchema: {

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file

•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkg