Loading npm security reports…

claude-codex-wechat@0.1.49: Suspicious npm security report (Warn) | LPM Firewall

registry / claude-codex-wechat / 0.1.49

claude-codex-wechat@0.1.49

用微信，遥控你自己电脑上的 `Claude Code` 和 `Codex CLI`。

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit `claude-codex-wechat start` creates a first-party local daemon and an MCP configuration that exposes file-send and video-download tools to configured Claude/Codex sessions. Those tools can transfer selected local files to the active WeChat chat; this is an intentional but powerful agent-extension capability, not install-time malware.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `claude-codex-wechat start` and uses the configured Claude/Codex bridge.

Impact

A compromised or prompt-injected configured agent could use the installed MCP tools to send accessible files to the connected WeChat account.

Mechanism

User-invoked daemon persistence plus MCP-mediated local file transfer.

Rationale

The scanner's remote-decode-and-execute claim is unsupported by the shipped CLI: no dynamic code execution path was found. The package intentionally provisions a powerful first-party MCP extension and user daemon only through explicit runtime commands, so it warrants a warning rather than a malware block.

Evidence

package.jsondist/server/cli.jsdist/mcp/mediaServer.jsdist/mcp/scripts/douyin-download.mjsconfig.example.jsonREADME.md~/.claude-codex-wechat/config.json~/.claude-codex-wechat/mcp-media.json~/.claude-codex-wechat/media~/Library/LaunchAgents/com.claude-codex-wechat.bridge.plist~/.config/systemd/user/claude-codex-wechat.service

Source & flagged code

9 flagged · loading source

dist/server/cli.jsView file

22// src/channels/weixin-direct/loginClient.ts L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L24: var WeixinDirectLoginClient = class { ... L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`); L62: const payload = await response.json(); L63: return payload.data ?? payload; ... L71: function defaultConfigPath() { L72: return join(homedir(), ".claude-codex-wechat", "config.json"); L73: } L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) { L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path); ... L170: function isRetriableRenameError(error) {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L22

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

2838// src/providers/claude-code/claudeStreamingRunner.ts L2839: import { spawn as spawn3 } from "node:child_process"; L2840: import { randomUUID as randomUUID2 } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/server/cli.jsView on unpkg · L2838

22Detached bundled service listener: dist/server/cli.js launches a Node helper and exposes a broad-bound HTTP listener. L22: // src/channels/weixin-direct/loginClient.ts L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L24: var WeixinDirectLoginClient = class { ... L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`); L62: const payload = await response.json(); L63: return payload.data ?? payload; ... L71: function defaultConfigPath() { L72: return join(homedir(), ".claude-codex-wechat", "config.json"); L73: } L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) { L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path); ... L170: function isRetriableRenameError(error) {

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L22

22// src/channels/weixin-direct/loginClient.ts L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L24: var WeixinDirectLoginClient = class { ... L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`); L62: const payload = await response.json(); L63: return payload.data ?? payload; ... L71: function defaultConfigPath() { L72: return join(homedir(), ".claude-codex-wechat", "config.json"); L73: } L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) { L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path); ... L170: function isRetriableRenameError(error) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/cli.jsView on unpkg · L22

22// src/channels/weixin-direct/loginClient.ts L23: var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L24: var WeixinDirectLoginClient = class { ... L61: if (!response.ok) throw new Error(`weixin_login_request_failed:${response.status}`); L62: const payload = await response.json(); L63: return payload.data ?? payload; ... L71: function defaultConfigPath() { L72: return join(homedir(), ".claude-codex-wechat", "config.json"); L73: } L74: function loadBridgeConfig(path = process.env.BRIDGE_CONFIG ?? defaultConfigPath()) { L75: if (!existsSync(path)) return normalizeBridgeConfig({}, process.env, path); ... L170: function isRetriableRenameError(error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/cli.jsView on unpkg · L22

dist/mcp/mediaServer.jsView file

94// src/mcp/tools/douyinDownload.ts L95: import { execFile } from "node:child_process"; L96: import { existsSync } from "node:fs"; ... L100: import { z as z2 } from "zod"; L101: var BRIDGE_API_URL2 = process.env.BRIDGE_API_URL || "http://localhost:8787"; L102: function douyinScriptCandidates(baseDir) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp/mediaServer.jsView on unpkg · L94

126return new Promise((resolve2, reject) => { L127: execFile("node", [script, ...args], { timeout: 12e4 }, (err, stdout, stderr) => { L128: if (err) reject(new Error(stderr || err.message)); ... L134: const fileName = basename2(filePath) || "video.mp4"; L135: const response = await fetch(`${BRIDGE_API_URL2}/api/channel/send-media`, { L136: method: "POST", L137: headers: { "content-type": "application/json" }, L138: body: JSON.stringify({ kind, filePath, fileName }) L139: });

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp/mediaServer.jsView on unpkg · L126

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file

•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkg

Source & flagged code

9 flagged

dist/server/cli.jsView file

Lines 2-42javascript

2import { createRequire as __cjsCreateRequire } from 'node:module'; const require = __cjsCreateRequire(import.meta.url);

3

4// src/cli.ts

5import { existsSync as existsSync11, readFileSync as readFileSync10 } from "node:fs";

6import { dirname as dirname9, join as join14 } from "node:path";

7import { fileURLToPath as fileURLToPath3 } from "node:url";

8

9// src/daemon/bootstrap.ts

10import { networkInterfaces } from "node:os";

11

12// src/daemon/server.ts

13import { mkdtempSync, existsSync as existsSync9, writeFileSync as writeFileSync2 } from "node:fs";

14import { tmpdir as tmpdir2 } from "node:os";

15import { dirname as dirname7, join as join11 } from "node:path";

16import { fileURLToPath as fileURLToPath2 } from "node:url";

17import Fastify from "fastify";

18

19// src/channels/platforms.ts

20var PRIMARY_WEIXIN_PLATFORM = "weixin";

21

22// src/channels/weixin-direct/loginClient.ts

23var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";

24var WeixinDirectLoginClient = class {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L22

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L22

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/cli.jsView on unpkg · L22

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/cli.jsView on unpkg · L22

25 baseUrl;

26 fetchImpl;

27 pollIntervalMs;

28 constructor(input = {}) {

29 this.baseUrl = (input.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");

30 this.fetchImpl = input.fetchImpl ?? fetch;

31 this.pollIntervalMs = input.pollIntervalMs ?? 2e3;

32 }

33 async fetchQrCode() {

34 const data = await this.getJson("ilink/bot/get_bot_qrcode?bot_type=3");

35 const ticket = data.qrcode?.trim();

36 const qrcodeData = data.qrcode_img_content?.trim();

37 if (!ticket || !qrcodeData) throw new Error("weixin_qrcode_missing_fields");

38 return { ticket, qrcodeData };

39 }

40 async pollQrCodeStatus(ticket) {

41 const data = await this.getJson(`ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(ticket)}`);

42 const status = data.status?.trim().toLowerCase() ?? "wait";

Lines 2818-2858javascript

2818 const isLastSlot = quota.remaining === 1;

2819 const hasMore = pending.length > 1;

2820 if (isLastSlot && hasMore) {

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

dist/mcp/mediaServer.jsView file

Lines 74-146javascript

74 server2.registerTool(

75 "send_file",

76 {

77 description: '\u5C06\u6587\u4EF6\u53D1\u9001\u5230\u7528\u6237\u5FAE\u4FE1\u3002\u7528\u6237\u8BF4"\u628A\u6587\u4EF6\u53D1\u7ED9\u6211""\u6587\u6863\u53D1\u51FA\u6765""\u628AXX\u4F20\u7ED9\u6211"\u65F6\u8C03\u7528\u3002\u652F\u6301 PDF\u3001\u6587\u6863\u3001\u4EE3\u7801\u3001\u538B\u7F29\u5305\u7B49\u6240\u6709\u7C7B\u578B\u3002

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View file

•path = dist/web/assets/bootstrap-icons-mSm7cUeB.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/assets/bootstrap-icons-mSm7cUeB.woff2View on unpkg