registry / claude-codex-wechat / 0.1.60

claude-codex-wechat@0.1.60

用微信，遥控你自己电脑上的 `Claude Code` 和 `Codex CLI`。

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The package has no install hook, but a user-started daemon binds to all interfaces and exposes management routes that disclose local state and directory names without handler-level authentication. This warrants a warning for network-exposed capability; the inspected source does not prove a block-eligible attack.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Run the CLI with no subcommand or with the start command, then access the daemon from a reachable network.

Impact

A reachable network client may inspect runtime state and directory names or make session requests; the source does not establish arbitrary code execution.

Mechanism

The daemon binds to 0.0.0.0 on its default port and serves directory-listing, state, and session routes.

AI rationale

Evidence

dist/server/cli.js

Network endpoints1

0.0.0.0:8787

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes the server CLI and defines publish-time scripts; running it without a subcommand starts the daemon.
The daemon defaults to listening on all network interfaces at port 8787.
The directory-listing route accepts a caller-supplied path and enumerates its directories without an authentication check in the handler.
The state route returns active-user and runtime configuration data, while session routes accept caller-supplied user and session identifiers.
On a Claude session-attach request, the runtime checks an idle background-session record and may delete its recorded path; this is user-requested session handling, not install-time activity.

Evidence against

The manifest has no install hook; the daemon is started by invoking the CLI.
The reported session cleanup is tied to a session-attach request, and the Douyin downloader is a separately invoked CLI script.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Source & flagged code

7 flagged

dist/server/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { createRequire as __cjsCreateRequire } from 'node:module'; const require = __cjsCreateRequire(import.meta.url);

4// src/cli.ts

5import { execFile as execFile2 } from "node:child_process";

6import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L4

High

Child Process

Package source references child process execution.

dist/server/cli.jsView on unpkg · L4

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/cli.jsView on unpkg · L4

7import { promisify as promisify2 } from "node:util";

8import { dirname as dirname10, join as join16 } from "node:path";

9import { fileURLToPath as fileURLToPath4 } from "node:url";

11// src/daemon/bootstrap.ts

12import { networkInterfaces } from "node:os";

14// src/daemon/server.ts

15import { mkdtempSync, existsSync as existsSync10, writeFileSync as writeFileSync2 } from "node:fs";

16import { tmpdir as tmpdir3 } from "node:os";

17import { dirname as dirname8, isAbsolute, join as join13 } from "node:path";

19// src/daemon/mcpConfig.ts

20import { createRequire } from "node:module";

22// src/shared/platform.ts

23import { access, constants } from "node:fs/promises";

24import { delimiter, join } from "node:path";

Lines 3169-3209javascript

3169 "- \u89C6\u9891 \u2192 send_video",

3170 "- \u97F3\u9891 \u2192 send_audio\uFF08\u4EE5\u6587\u4EF6\u9644\u4EF6\u5F62\u5F0F\u53D1\u9001\uFF09",

3171 "- \u5176\u4ED6\u6587\u4EF6\uFF08PDF/\u6587\u6863/\u4EE3\u7801/\u538B\u7F29\u5305\u7B49\uFF09\u2192 send_file",

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

dist/mcp/scripts/douyin-download.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-codex-wechat@0.1.59 matchedIdentity = npm:Y2xhdWRlLWNvZGV4LXdlY2hhdA:0.1.59 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp/scripts/douyin-download.mjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/server/cli.jsView file

4// src/cli.ts L5: import { execFile as execFile2 } from "node:child_process"; L6: import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs"; ... L26: import { spawn } from "node:child_process"; L27: var isWindows = process.platform === "win32"; L28: async function isExecutableFile(candidate) { ... L37: if (!isWindows) return [""]; L38: const pathext = process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD"; L39: return ["", ...pathext.split(";").filter(Boolean)]; ... L69: function terminateChild(child, signal = "SIGTERM") { L70: if (child.pid === void 0 || child.exitCode !== null || child.signalCode !== null) { L71: return;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/server/cli.jsView on unpkg · L4

•Trigger-reachable chain: manifest.bin -> dist/server/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg

4// src/cli.ts L5: import { execFile as execFile2 } from "node:child_process"; L6: import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";

Findings

3 Critical3 High4 Medium7 Low

CriticalRemote Asset Decode Executedist/server/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js

CriticalPrevious Version Dangerous Deltadist/mcp/scripts/douyin-download.mjs

HighChild Processdist/server/cli.js

HighShelldist/server/cli.js

HighSpawned Bundled Service Listenerdist/server/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/server/cli.js

LowFilesystem

Affected versions and remediation

This report applies to claude-codex-wechat@0.1.60.

See all versions of claude-codex-wechat for other recorded verdicts.

Review the evidence and your use of claude-codex-wechat@0.1.60 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 14:56:33.199Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.