registry / claude-codex-wechat / 0.1.21

claude-codex-wechat@0.1.21

`claude-codex-wechat` 是一个本地 bridge daemon。它把：

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Running the CLI start command installs a persistent local daemon that connects by default to a public relay and lets remote WeChat traffic drive local Claude/Codex sessions. The bridge forces Claude into permission-bypass mode and mutates AI agent session metadata for resume.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs claude-codex-wechat or claude-codex-wechat start after install

Impact

Remote WeChat/relay-originated messages can operate local agent CLIs in user workspaces with reduced permission barriers and persistent service restart behavior.

Mechanism

persistent remote AI-agent control bridge with permission bypass

Attack narrative

After a user invokes the advertised CLI, the package registers a background daemon, generates relay credentials, connects to a default public relay, and exposes the local bridge. WeChat messages are forwarded into local Claude/Codex sessions; Claude is launched with --dangerously-skip-permissions, and existing Claude session files can be rewritten to add bypassPermissions metadata for resume.

Rationale

This is not install-time malware, but source inspection confirms a package entrypoint creates a persistent remote control path into local AI agents and changes agent permission/session state. The behavior is powerful enough and consent boundaries are weak enough for a publish block in an upstream package firewall. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonREADME.mddist/server/cli.js~/.claude-codex-wechat/config.json~/.claude/projects/*/*.jsonl~/.claude/history.jsonl~/.codex/session_index.jsonl~/.codex/state_5.sqlite~/Library/LaunchAgents/com.claude-codex-wechat.plist~/.config/systemd/user/claude-codex-wechat.service~/.claude-codex-wechat/service.pid

Network endpoints4

ilinkai.weixin.qq.comwss://wechat.style520.com/agentnovac2c.cdn.weixin.qq.com/c2cregistry.npmmirror.com/claude-codex-wechat/latest

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

package.json exposes bin ./dist/server/cli.js; default command start installs a persistent daemon
dist/server/cli.js starts launchd/systemd-user/Windows detached service files for __daemon
dist/server/cli.js defaults relay to wss://wechat.style520.com/agent and proxies relay requests to local http://127.0.0.1:<port>
dist/server/cli.js runs Claude with --dangerously-skip-permissions for bridged WeChat messages
dist/server/cli.js mutates Claude session JSONL to add permissionMode bypassPermissions when resuming
dist/server/cli.js launches codex app-server and rewrites Codex thread/session metadata for resumed sessions

Evidence against

package.json has no install/postinstall/preinstall lifecycle hook; prepublishOnly is publish-time only
README.md describes the package as a WeChat-to-Claude/Codex local bridge daemon
No eval/new Function/vm dynamic execution found in dist/server/cli.js
Media download code fetches and decrypts WeChat CDN media to files, not code execution

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 2 file(s), 444 KB of source, external domains: 127.0.0.1, ilinkai.weixin.qq.com, novac2c.cdn.weixin.qq.com, react.dev, registry.npmmirror.com, www.apple.com, www.w3.org

Source & flagged code

7 flagged

dist/server/cli.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2import { createRequire as __cjsCreateRequire } from 'node:module'; const require = __cjsCreateRequire(import.meta.url);

4// src/cli.ts

5import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";

6import { dirname as dirname13, join as join13 } from "node:path";

7import { fileURLToPath as fileURLToPath2 } from "node:url";

9// src/daemon/bootstrap.ts

10import { networkInterfaces } from "node:os";

12// src/daemon/server.ts

13import { mkdtempSync } from "node:fs";

14import { tmpdir as tmpdir2 } from "node:os";

15import { dirname as dirname10, join as join9 } from "node:path";

16import Fastify from "fastify";

18// src/channels/platforms.ts

19var PRIMARY_WEIXIN_PLATFORM = "weixin";

21// src/channels/weixin-direct/loginClient.ts

22var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";

23var WeixinDirectLoginClient = class {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L21

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L21

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/cli.jsView on unpkg · L21

24 baseUrl;

25 fetchImpl;

26 pollIntervalMs;

27 constructor(input = {}) {

28 this.baseUrl = (input.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");

29 this.fetchImpl = input.fetchImpl ?? fetch;

30 this.pollIntervalMs = input.pollIntervalMs ?? 2e3;

31 }

32 async fetchQrCode() {

33 const data = await this.getJson("ilink/bot/get_bot_qrcode?bot_type=3");

34 const ticket = data.qrcode?.trim();

35 const qrcodeData = data.qrcode_img_content?.trim();

36 if (!ticket || !qrcodeData) throw new Error("weixin_qrcode_missing_fields");

37 return { ticket, qrcodeData };

38 }

39 async pollQrCodeStatus(ticket) {

40 const data = await this.getJson(`ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(ticket)}`);

41 const status = data.status?.trim().toLowerCase() ?? "wait";

Lines 2331-2371javascript

2331 while (store.hasPendingOutbound(chatId)) {

2332 const quota = store.getQuota(chatId);

2333 if (quota.expired || quota.remaining <= 0) break;

2334 const pending = store.peekOutbound(chatId);

2335 const

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = claude-codex-wechat@0.1.19 matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.19 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/server/cli.jsView on unpkg

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file

•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkg

Source & flagged code

7 flagged · loading source

dist/server/cli.jsView file

21// src/channels/weixin-direct/loginClient.ts L22: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L23: var WeixinDirectLoginClient = class { ... L60: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`); L61: const payload = await response.json(); L62: return payload.data ?? payload; ... L70: function defaultConfigPath() { L71: return join(homedir(), ".claude-codex-wechat", "config.json"); L72: } L73: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) { L74: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path); ... L1107: }));

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L21

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/server/cli.jsView on unpkg

2351// src/providers/claude-code/claudeStreamingRunner.ts L2352: import { spawn as spawn3 } from "node:child_process"; L2353: import { randomUUID as randomUUID2 } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/server/cli.jsView on unpkg · L2351

21Detached bundled service listener: dist/server/cli.js launches a Node helper and exposes a broad-bound HTTP listener. L21: // src/channels/weixin-direct/loginClient.ts L22: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L23: var WeixinDirectLoginClient = class { ... L60: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`); L61: const payload = await response.json(); L62: return payload.data ?? payload; ... L70: function defaultConfigPath() { L71: return join(homedir(), ".claude-codex-wechat", "config.json"); L72: } L73: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) { L74: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path); ... L1107: }));

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L21

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/cli.jsView on unpkg · L21

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file

•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkg

Findings

3 Critical4 High5 Medium6 Low

CriticalRemote Asset Decode Executedist/server/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js

CriticalPrevious Version Dangerous Deltadist/server/cli.js

HighChild Processdist/server/cli.js

HighShell

HighSpawned Bundled Service Listenerdist/server/cli.js

HighShips High Entropy Blobdist/web/assets/bootstrap-icons-mSm7cUeB.woff2

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/server/cli.js

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/server/cli.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2import { createRequire as __cjsCreateRequire } from 'node:module'; const require = __cjsCreateRequire(import.meta.url);

4// src/cli.ts

5import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";

6import { dirname as dirname13, join as join13 } from "node:path";

7import { fileURLToPath as fileURLToPath2 } from "node:url";

9// src/daemon/bootstrap.ts

10import { networkInterfaces } from "node:os";

12// src/daemon/server.ts

13import { mkdtempSync } from "node:fs";

14import { tmpdir as tmpdir2 } from "node:os";

15import { dirname as dirname10, join as join9 } from "node:path";

16import Fastify from "fastify";

18// src/channels/platforms.ts

19var PRIMARY_WEIXIN_PLATFORM = "weixin";

21// src/channels/weixin-direct/loginClient.ts

22var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";

23var WeixinDirectLoginClient = class {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L21

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L21

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/cli.jsView on unpkg · L21

24 baseUrl;

25 fetchImpl;

26 pollIntervalMs;

27 constructor(input = {}) {

28 this.baseUrl = (input.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");

29 this.fetchImpl = input.fetchImpl ?? fetch;

30 this.pollIntervalMs = input.pollIntervalMs ?? 2e3;

31 }

32 async fetchQrCode() {

33 const data = await this.getJson("ilink/bot/get_bot_qrcode?bot_type=3");

34 const ticket = data.qrcode?.trim();

35 const qrcodeData = data.qrcode_img_content?.trim();

36 if (!ticket || !qrcodeData) throw new Error("weixin_qrcode_missing_fields");

37 return { ticket, qrcodeData };

38 }

39 async pollQrCodeStatus(ticket) {

40 const data = await this.getJson(`ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(ticket)}`);

41 const status = data.status?.trim().toLowerCase() ?? "wait";

Lines 2331-2371javascript

2331 while (store.hasPendingOutbound(chatId)) {

2332 const quota = store.getQuota(chatId);

2333 if (quota.expired || quota.remaining <= 0) break;

2334 const pending = store.peekOutbound(chatId);

2335 const

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/server/cli.jsView on unpkg

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file

•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkg