registry / Data exfiltration / deskbuddy

deskbuddy

把 Claude Code、Codex 等 AI 编码智能体每个会话窗口的状态，实时同步到桌面硬件屏幕

This report shows the evidence for deskbuddy@0.2.0. 1 of 4 known versions is blocked or flagged. The newest version, 0.2.2, is allowed. See all versions.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The bound-device daemon sends transcript content by default, while the package documentation explicitly promises that prompts and replies are not uploaded. This undisclosed transfer supports blocking publication.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs the CLI install flow, binds the device, and enables agent integration; the active daemon then polls transcript sources.

Impact

Private prompts and assistant replies are disclosed to the package’s service despite documentation promising they are not sent.

Mechanism

The daemon extracts transcript messages, applies clipping and redaction, and posts them through the API gateway to the transcript service unless an opt-out is set.

Attack narrative

After `deskbuddy install` binds a device and agent integration is active, the daemon periodically reads local transcript sources. It places redacted and clipped user and assistant text in the messages it posts through the transcript service. Sync is enabled by default unless the user later opts out. The README and installation guide promise that prompts and replies are not uploaded, contradicting the source behavior.

AI rationale

Evidence

dist/cli.jsdist/chunk-HHAIK3XT.jsREADME.mddocs/INSTALL.md

Network endpoints1

api.shifengintelli.com/gateway

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The daemon uploads session messages by default for a bound device unless a later setting or environment flag disables transcript sync.
The source reads local transcript files and retains user and assistant text in the messages sent upstream.
Those messages go to the product’s transcript service through its default API host.
The CLI install flow integrates detected agents, and their settings receive DeskBuddy hook commands.
The README and installation guide say prompts and replies are not uploaded, contrary to the implemented transfer.

Evidence against

Uploads require account binding and active agent integration; the source also clips and redacts content and provides an opt-out.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

15 flagged

dist/deskbuddy-dsh.mjsView file

Lines 1-35javascript

1// DeskBuddy 的 DeepSeek Harness（dsh）原生插件（spec 2026-10-03-deskbuddy-deepseek-harness-design）。

2// `deskbuddy enable deepseek_harness` 往 $DSH_HOME/cordis.patch.yml 追加一条 insert，name 是本文件的绝对路径；

3// 本文件随 hook.cjs / gate.cjs 一起同步到 ~/.deskbuddy/，CLI 升级即生效。

4//

5// 做的事和 opencode.mjs 一样只有翻译：dsh 的 Cordis 事件 → cc-hook 同构输入，喂同目录的 hook.cjs（状态）和 gate.cjs（设备确认）。

6//

7// 实测依据（dsh 0.2.0-rc.2，10-03 spike）：

8// - CC hooks 兼容插件在 `dsh web` 下静默不加载，只能走原生插件

9// - approval/request、user-questions/request 是串行瀑布：不调 next() 就挡住了原生界面。

10// 抢答做法：把 req.signal 换成 AbortSignal.any([原 signal, 自己的])，再 next() 让原生界面照常弹，同时推设备，谁先回用谁；

11// 设备先答就 abort 自己那个 —— web 的卡片立即消失（next() 随之 reject，要接住）。原生先答就结束 gate 子进程，daemon 撤设备卡片

12// - 审批请求不带工具参数，靠 callId 从先到的 tool/call 事件里补

13//

14// 🔴 窗口兜底方向：任何失败都交给原生界面（只调 next()），绝不替用户表态。

16import { spawn } from 'node:child_process'

17import { randomUUID } from 'node:crypto'

High

Child Process

Package source references child process execution.

dist/deskbuddy-dsh.mjsView on unpkg · L15

18import { appendFileSync, chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs'

19import { homedir } from 'node:os'

20import { dirname, join } from 'node:path'

21import { fileURLToPath } from 'node:url'

23const HERE = dirname(fileURLToPath(import.meta.url))

24const HOOK = join(HERE, 'hook.cjs')

25const GATE = join(HERE, 'gate.cjs')

26export const TOOL = 'deepseek_harness'

28/** hook.cjs 自己有 2 秒上报超时，这里再兜一层：一次卡死不能堵住后面所有状态 */

29const HOOK_KILL_MS = 10 * 1000

30/** 工具调用参数缓存时长：tool/call 记下，随后的审批请求靠它显示真实命令 */

31const CALL_TTL_MS = 10 * 60 * 1000

33/** 下发信箱：心跳间隔、轮询间隔（与 src/core/dshMailbox.ts 的约定一致：心跳 5 秒内算新鲜、≤1 秒取信） */

34const HEARTBEAT_MS = 1000

35const INBOX_POLL_MS = 500

dist/chunk-HHAIK3XT.jsView file

3053contains invisible/control Unicode U+202A (left-to-right embedding) if (/[\u0000-\u001f\u007f-\u009f<U+200B>-<U+200F><U+202A>-<U+202E><U+2066>-<U+2069><U+FEFF>]/.test(x)) return null;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-HHAIK3XT.jsView on unpkg · L3053

•Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/chunk-HHAIK3XT.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-HHAIK3XT.jsView on unpkg

12Cross-file remote execution chain: dist/chunk-HHAIK3XT.js spawns dist/cli.js; helper contains network access plus dynamic code execution. L12: var MAX_FOCUS_IDLE_SECONDS = 600; L13: function defaultRemoteCwd(home = homedir()) { L14: return process.env.DESKBUDDY_DEFAULT_REMOTE_CWD || join(home, "DeskBuddy"); L15: } ... L26: function ensureDefaultRemoteCwd(cwd) { L27: if (!cwd || !samePath(cwd, defaultRemoteCwd(), process.platform)) return; L28: try { ... L55: } L56: var PROD_API_BASE = "https://api.shifengintelli.com"; L57: var TEST_API_BASE = "https://test-api.shifengintelli.com"; ... L69: try { L70: fileValue = JSON.parse(readFileSync(configPath(), "utf8")).apiBase;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cbchannel.cjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2'use strict'

3// CodeBuddy Code（WorkBuddy 的命令行）终端会话的「设备授权中继」（spec 2026-10-09 terminal-approvals §2）。

4//

5// 装法：deskbuddy enable workbuddy 时写进 ~/.codebuddy/.mcp.json（用户级 MCP），CodeBuddy 每个进程起一份本脚本（stdio MCP）。

6// 原理：CodeBuddy 2.161.1 认 MCP 服务声明的 experimental 能力 `claude/channel` + `claude/channel/permission`，

7// 交互窗口弹授权框时把同一个请求广播给声明了权限中继的服务（notifications/claude/channel/permission_request），

8// 与本地框【竞速】：哪边先答算哪边（源码 HandleInterruptions：Promise.race([本地, channel])）。

9// 不需要 --channels 参数（没给就不设白名单），微信 / 企微桥用的就是这条路。

10// 本脚本只做转发：请求 → daemon（/gate，挂着等设备）→ 设备答了 → notifications/claude/channel/permission 回 CodeBuddy。

dist/opencode.mjsView file

Lines 2-42javascript

2// `deskbuddy enable opencode` 在 opencode 的插件目录放一个入口文件 import 本文件；

3// 本文件随 hook.cjs / gate.cjs 一起同步到 ~/.deskbuddy/，CLI 升级即生效。

4//

5// 做的事只有翻译：把 opencode 的事件翻成 cc-hook 同构的输入，喂给同目录的 hook.cjs（状态上报）

6// 和 gate.cjs（授权关卡）。状态机、关卡、和设备打交道全在它们和 daemon 里，这里不重复。

7//

8// 实测依据（opencode 1.18.32；1.4.3 远程关卡与窗口确认同样实测通过，spec 2026-09-27-DeskBuddy二期 §P9 O1–O8）：

9// - 插件的 `permission.ask` 钩子不会被调用；授权只能从事件流的 permission.asked / permission.replied 拿

10// - `tool.execute.before` 在权限判断之前触发、可以 await 任意久、抛错 = 这次调用失败

11// - `opencode run` 遇到 ask 立即自动拒绝

hook/hook.cjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2'use strict'

3// 🔴 这个文件在用户【每次工具调用】时都会被执行一次。三条铁律：

4// ① 只 require Node 内置模块 —— 它不进 bundler，构建时原样 cp 成 dist/hook.cjs，

5// 再由 deskbuddy enable 复制到 ~/.deskbuddy/hook.cjs。

6// 扩展名必须是 .cjs：本包是 "type": "module"，叫 .js 会被当成 ESM 直接崩。

7// require 任何 npm 包都会拖慢用户的 agent。

8// ② 永不阻塞 —— 上报 2 秒超时、fire-and-forget，失败就丢，下次跃迁自然补上。

9// ③ 任何异常都吞掉并 exit(0) —— hook 报错会直接打断用户的 AI 会话。

10//

11// ⚠️ 本文件与 src/core/{config,state,process,snapshot,registry,title}.ts 是【同一套逻辑的两份实现】：

dist/cli.jsView file

22907cleanup(); L22908: process.stderr.write(`deskbuddy: \u542F\u52A8 ${real2.file} \u5931\u8D25\uFF1A${e.message} L22909: `); ... L22920: // src/wrap/codexLaunch.ts L22921: import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process"; L22922: import { closeSync as closeSync12, mkdirSync as mkdirSync15, openSync as openSync12, readdirSync as readdirSync14, readFileSync as readFileSync19, rmSync as rmSync15, statSync as s... L22923: import { request as request2 } from "http"; L22924: import { createServer as createServer5 } from "net";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L22907

22907Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.js L22907: cleanup(); L22908: process.stderr.write(`deskbuddy: \u542F\u52A8 ${real2.file} \u5931\u8D25\uFF1A${e.message} L22909: `); ... L22920: // src/wrap/codexLaunch.ts L22921: import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process"; L22922: import { closeSync as closeSync12, mkdirSync as mkdirSync15, openSync as openSync12, readdirSync as readdirSync14, readFileSync as readFileSync19, rmSync as rmSync15, statSync as s... L22923: import { request as request2 } from "http"; L22924: import { createServer as createServer5 } from "net";

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L22907

vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/unixTerminal.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/node-pty/lib/unixTerminal.jsView on unpkg

vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg

Source & flagged code

15 flagged · loading source

dist/deskbuddy-dsh.mjsView file

15L16: import { spawn } from 'node:child_process' L17: import { randomUUID } from 'node:crypto'

High

Child Process

Package source references child process execution.

dist/deskbuddy-dsh.mjsView on unpkg · L15

dist/chunk-HHAIK3XT.jsView file

3053contains invisible/control Unicode U+202A (left-to-right embedding) if (/[\u0000-\u001f\u007f-\u009f<U+200B>-<U+200F><U+202A>-<U+202E><U+2066>-<U+2069><U+FEFF>]/.test(x)) return null;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-HHAIK3XT.jsView on unpkg · L3053

•Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/chunk-HHAIK3XT.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

2 Critical8 High6 Medium8 Low

CriticalTrojan Source Unicodedist/chunk-HHAIK3XT.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-HHAIK3XT.js

HighChild Processdist/deskbuddy-dsh.mjs

HighSame File Env Network Executionhook/hook.cjs

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextdist/chunk-HHAIK3XT.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

HighTrigger Reachable Persistencedist/chunk-HHAIK3XT.js

HighKnown Malware Source Similarityvendor/node-pty/lib/unixTerminal.js

HighKnown Malware Source Similarityvendor/node-pty/lib/windowsPtyAgent.js

MediumDynamic Require

Affected versions and remediation

This report applies to deskbuddy@0.2.0.

The versions list below shows the verdict for each recorded version.

Avoid installing deskbuddy@0.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-15 02:32:11.072Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.2.2latestClean—AllowPublishedOct 20, 2026, 4:17 AM 0.2.1SuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 4:49 PM 0.2.0shownMaliciousData ExfiltrationBlockPublishedOct 14, 2026, 2:47 PM 0.0.1Clean—AllowPublishedSep 8, 2026, 12:31 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code