claude-codex-wechat@0.1.59: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

claude-codex-wechat@0.1.59: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/server/cli.jsView file

4// src/cli.ts L5: import { execFile as execFile2 } from "node:child_process"; L6: import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs"; ... L26: import { spawn } from "node:child_process"; L27: var isWindows = process.platform === "win32"; L28: async function isExecutableFile(candidate) { ... L37: if (!isWindows) return [""]; L38: const pathext = process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD"; L39: return ["", ...pathext.split(";").filter(Boolean)]; ... L69: function terminateChild(child, signal = "SIGTERM") { L70: if (child.pid === void 0 || child.exitCode !== null || child.signalCode !== null) { L71: return;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L4

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

4// src/cli.ts L5: import { execFile as execFile2 } from "node:child_process"; L6: import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/server/cli.jsView on unpkg · L4

3163const curl = isWindows2 ? "curl.exe" : "curl"; L3164: const shellTag = isWindows2 ? "powershell" : "bash"; L3165: const tmpDir = input.tmpDir ?? (isWindows2 ? "%TEMP%" : "/tmp");

High

Shell

Package source references shell execution.

dist/server/cli.jsView on unpkg · L3163

4Detached bundled service listener: dist/server/cli.js launches a Node helper and exposes a broad-bound HTTP listener. L4: // src/cli.ts L5: import { execFile as execFile2 } from "node:child_process"; L6: import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs"; ... L26: import { spawn } from "node:child_process"; L27: var isWindows = process.platform === "win32"; L28: async function isExecutableFile(candidate) { ... L37: if (!isWindows) return [""]; L38: const pathext = process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD"; L39: return ["", ...pathext.split(";").filter(Boolean)]; ... L69: function terminateChild(child, signal = "SIGTERM") { L70: if (child.pid === void 0 || child.exitCode !== null || child.signalCode !== null) { L71: return;

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L4

4// src/cli.ts L5: import { execFile as execFile2 } from "node:child_process"; L6: import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs"; ... L26: import { spawn } from "node:child_process"; L27: var isWindows = process.platform === "win32"; L28: async function isExecutableFile(candidate) { ... L37: if (!isWindows) return [""]; L38: const pathext = process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD"; L39: return ["", ...pathext.split(";").filter(Boolean)]; ... L69: function terminateChild(child, signal = "SIGTERM") { L70: if (child.pid === void 0 || child.exitCode !== null || child.signalCode !== null) { L71: return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/cli.jsView on unpkg · L4

dist/mcp/mediaServer.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-codex-wechat@0.1.54 matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.54 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp/mediaServer.jsView on unpkg

Source & flagged code

7 flagged

dist/server/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { createRequire as __cjsCreateRequire } from 'node:module'; const require = __cjsCreateRequire(import.meta.url);

3

4// src/cli.ts

5import { execFile as execFile2 } from "node:child_process";

6import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L4

High

Child Process

Package source references child process execution.

dist/server/cli.jsView on unpkg · L4

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/cli.jsView on unpkg · L4

7import { promisify as promisify2 } from "node:util";

8import { dirname as dirname10, join as join16 } from "node:path";

9import { fileURLToPath as fileURLToPath4 } from "node:url";

10

11// src/daemon/bootstrap.ts

12import { networkInterfaces } from "node:os";

13

14// src/daemon/server.ts

15import { mkdtempSync, existsSync as existsSync10, writeFileSync as writeFileSync2 } from "node:fs";

16import { tmpdir as tmpdir3 } from "node:os";

17import { dirname as dirname8, isAbsolute, join as join13 } from "node:path";

18

19// src/daemon/mcpConfig.ts

20import { createRequire } from "node:module";

21

22// src/shared/platform.ts

23import { access, constants } from "node:fs/promises";

24import { delimiter, join } from "node:path";

Lines 3143-3183javascript

3143 "- \u89C6\u9891 \u2192 send_video",

3144 "- \u97F3\u9891 \u2192 send_audio\uFF08\u4EE5\u6587\u4EF6\u9644\u4EF6\u5F62\u5F0F\u53D1\u9001\uFF09",

3145 "- \u5176\u4ED6\u6587\u4EF6\uFF08PDF/\u6587\u6863/\u4EE3\u7801/\u538B\u7F29\u5305\u7B49\uFF09\u2192 send_file",

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

dist/mcp/mediaServer.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-codex-wechat@0.1.54 matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.54 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp/mediaServer.jsView on unpkg