deskbuddy@0.2.1

把 Claude Code、Codex 等 AI 编码智能体每个会话窗口的状态，实时同步到桌面硬件屏幕

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The source shows conditional, automatic agent hook setup after DeskBuddy account binding, which warrants a warning for package-owned agent integration. It does not establish concrete malicious behavior or an npm install-time attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The daemon runs with an account binding present; its first scan occurs after about ten seconds and repeats hourly.

Impact

Agent events may invoke DeskBuddy hooks after automatic configuration changes; no separate malicious effect was confirmed.

Mechanism

It detects installed agent clients, excludes already enabled or disabled clients, and invokes the installer to add hooks to each remaining client's configuration.

AI rationale

Evidence

dist/cli.jsdist/chunk-QFAGVCHM.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json exposes a CLI; its only lifecycle script is prepublishOnly, which runs checks and builds.
The daemon starts an automatic integration scan after about ten seconds and repeats it hourly.
After account binding, the scan detects installed agent clients and passes new candidates to the installer in automatic mode; disabled clients are skipped.
The installer writes hooks to each detected client's configuration path, and the Claude Code adapter adds command hooks to its settings.
The indicated agent configuration locations resolve to settings-path, protected-directory, and history-reading helpers; they do not establish a separate attack.

Evidence against

No npm install lifecycle hook was found; automatic integration requires the running daemon and an existing account binding.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Source & flagged code

19 flagged

dist/deskbuddy-dsh.mjsView file

Lines 1-35javascript

1// DeskBuddy 的 DeepSeek Harness（dsh）原生插件（spec 2026-10-03-deskbuddy-deepseek-harness-design）。

2// `deskbuddy enable deepseek_harness` 往 $DSH_HOME/cordis.patch.yml 追加一条 insert，name 是本文件的绝对路径；

3// 本文件随 hook.cjs / gate.cjs 一起同步到 ~/.deskbuddy/，CLI 升级即生效。

4//

5// 做的事和 opencode.mjs 一样只有翻译：dsh 的 Cordis 事件 → cc-hook 同构输入，喂同目录的 hook.cjs（状态）和 gate.cjs（设备确认）。

6//

7// 实测依据（dsh 0.2.0-rc.2，10-03 spike）：

8// - CC hooks 兼容插件在 `dsh web` 下静默不加载，只能走原生插件

9// - approval/request、user-questions/request 是串行瀑布：不调 next() 就挡住了原生界面。

10// 抢答做法：把 req.signal 换成 AbortSignal.any([原 signal, 自己的])，再 next() 让原生界面照常弹，同时推设备，谁先回用谁；

11// 设备先答就 abort 自己那个 —— web 的卡片立即消失（next() 随之 reject，要接住）。原生先答就结束 gate 子进程，daemon 撤设备卡片

12// - 审批请求不带工具参数，靠 callId 从先到的 tool/call 事件里补

13//

14// 🔴 窗口兜底方向：任何失败都交给原生界面（只调 next()），绝不替用户表态。

16import { spawn } from 'node:child_process'

17import { randomUUID } from 'node:crypto'

High

Child Process

Package source references child process execution.

dist/deskbuddy-dsh.mjsView on unpkg · L15

18import { appendFileSync, chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs'

19import { homedir } from 'node:os'

20import { dirname, join } from 'node:path'

21import { fileURLToPath } from 'node:url'

23const HERE = dirname(fileURLToPath(import.meta.url))

24const HOOK = join(HERE, 'hook.cjs')

25const GATE = join(HERE, 'gate.cjs')

26export const TOOL = 'deepseek_harness'

27/** 会话标题事后变了的伪事件名（与 hook.cjs / src/core/title.ts 的 TITLE_EVENT 一致）：只改标题、补报 */

28export const TITLE_EVENT = 'DeskBuddyTitle'

30/** hook.cjs 自己有 2 秒上报超时，这里再兜一层：一次卡死不能堵住后面所有状态 */

31const HOOK_KILL_MS = 10 * 1000

32/** 工具调用参数缓存时长：tool/call 记下，随后的审批请求靠它显示真实命令 */

33const CALL_TTL_MS = 10 * 60 * 1000

35/** 下发信箱：心跳间隔、轮询间隔（与 src/core/dshMailbox.ts 的约定一致：心跳 5 秒内算新鲜、≤1 秒取信） */

dist/chunk-QFAGVCHM.jsView file

6740contains invisible/control Unicode U+202A (left-to-right embedding) if (/[\u0000-\u001f\u007f-\u009f<U+200B>-<U+200F><U+202A>-<U+202E><U+2066>-<U+2069><U+FEFF>]/.test(x)) return null;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-QFAGVCHM.jsView on unpkg · L6740

•Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/chunk-QFAGVCHM.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-QFAGVCHM.jsView on unpkg

12Cross-file remote execution chain: dist/chunk-QFAGVCHM.js spawns dist/cli.js; helper contains network access plus dynamic code execution. L12: var MAX_FOCUS_IDLE_SECONDS = 600; L13: function defaultRemoteCwd(home = homedir()) { L14: return process.env.DESKBUDDY_DEFAULT_REMOTE_CWD || join(home, "DeskBuddy"); L15: } ... L26: function ensureDefaultRemoteCwd(cwd) { L27: if (!cwd || !samePath(cwd, defaultRemoteCwd(), process.platform)) return; L28: try { ... L55: } L56: var PROD_API_BASE = "https://api.shifengintelli.com"; L57: var TEST_API_BASE = "https://test-api.shifengintelli.com"; ... L69: try { L70: fileValue = JSON.parse(readFileSync(configPath(), "utf8")).apiBase;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cbchannel.cjsView file

•matchType = normalized_sha256 matchedPackage = deskbuddy@0.2.0 matchedPath = dist/cbchannel.cjs matchedIdentity = npm:ZGVza2J1ZGR5:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cbchannel.cjsView on unpkg

15// 只 require Node 内置模块（同 hook.cjs）。 L16: const fs = require('node:fs') L17: const os = require('node:os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cbchannel.cjsView on unpkg · L15

dist/opencode.mjsView file

22L23: import { spawn } from 'node:child_process' L24: import { createHash, randomBytes } from 'node:crypto' ... L144: L145: export function ocMailboxHome(env = process.env) { L146: return (env && env.DESKBUDDY_HOME) || HERE ... L180: const log = opts.log || (() => {}) L181: const directory = opts.directory || process.cwd() L182: const token = randomBytes(4).toString('hex') ... L273: const r = await withTimeout( L274: client.session.promptAsync({ path: { id: sid }, query: { directory: d }, body: { parts: [{ type: 'text', text }] } }), L275: Math.min(OC_PROMPT_WAIT_MS, left() - 500)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/opencode.mjsView on unpkg · L22

hook/hook.cjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2'use strict'

3// 🔴 这个文件在用户【每次工具调用】时都会被执行一次。三条铁律：

4// ① 只 require Node 内置模块 —— 它不进 bundler，构建时原样 cp 成 dist/hook.cjs，

5// 再由 deskbuddy enable 复制到 ~/.deskbuddy/hook.cjs。

6// 扩展名必须是 .cjs：本包是 "type": "module"，叫 .js 会被当成 ESM 直接崩。

7// require 任何 npm 包都会拖慢用户的 agent。

8// ② 永不阻塞 —— 上报 2 秒超时、fire-and-forget，失败就丢，下次跃迁自然补上。

9// ③ 任何异常都吞掉并 exit(0) —— hook 报错会直接打断用户的 AI 会话。

10//

11// ⚠️ 本文件与 src/core/{config,state,process,snapshot,registry,title}.ts 是【同一套逻辑的两份实现】：

dist/cli.jsView file

24555cleanup(); L24556: process.stderr.write(`deskbuddy: \u542F\u52A8 ${real2.file} \u5931\u8D25\uFF1A${e.message} L24557: `); ... L24568: // src/wrap/codexLaunch.ts L24569: import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process"; L24570: import { closeSync as closeSync13, mkdirSync as mkdirSync16, openSync as openSync13, readdirSync as readdirSync17, readFileSync as readFileSync23, rmSync as rmSync16, statSync as s... L24571: import { request as request2 } from "http"; L24572: import { createServer as createServer5 } from "net";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L24555

24555Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.js L24555: cleanup(); L24556: process.stderr.write(`deskbuddy: \u542F\u52A8 ${real2.file} \u5931\u8D25\uFF1A${e.message} L24557: `); ... L24568: // src/wrap/codexLaunch.ts L24569: import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process"; L24570: import { closeSync as closeSync13, mkdirSync as mkdirSync16, openSync as openSync13, readdirSync as readdirSync17, readFileSync as readFileSync23, rmSync as rmSync16, statSync as s... L24571: import { request as request2 } from "http"; L24572: import { createServer as createServer5 } from "net";

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L24555

vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/wake.cjsView file

•matchType = normalized_sha256 matchedPackage = deskbuddy@0.2.0 matchedPath = dist/wake.cjs matchedIdentity = npm:ZGVza2J1ZGR5:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/wake.cjsView on unpkg

hook/wake.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hook/wake.cjsView on unpkg

vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = deskbuddy@0.2.0 matchedPath = vendor/node-pty/lib/unixTerminal.js matchedIdentity = npm:ZGVza2J1ZGR5:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/node-pty/lib/unixTerminal.jsView on unpkg

vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = deskbuddy@0.2.0 matchedPath = vendor/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:ZGVza2J1ZGR5:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg

hook/cbchannel.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hook/cbchannel.cjsView on unpkg

Source & flagged code

19 flagged · loading source

dist/deskbuddy-dsh.mjsView file

15L16: import { spawn } from 'node:child_process' L17: import { randomUUID } from 'node:crypto'

High

Child Process

Package source references child process execution.

dist/deskbuddy-dsh.mjsView on unpkg · L15

dist/chunk-QFAGVCHM.jsView file

6740contains invisible/control Unicode U+202A (left-to-right embedding) if (/[\u0000-\u001f\u007f-\u009f<U+200B>-<U+200F><U+202A>-<U+202E><U+2066>-<U+2069><U+FEFF>]/.test(x)) return null;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-QFAGVCHM.jsView on unpkg · L6740

•Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/chunk-QFAGVCHM.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

2 Critical12 High6 Medium8 Low

CriticalTrojan Source Unicodedist/chunk-QFAGVCHM.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunk-QFAGVCHM.js

HighChild Processdist/deskbuddy-dsh.mjs

HighSame File Env Network Executionhook/hook.cjs

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextdist/chunk-QFAGVCHM.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

HighTrigger Reachable Persistencedist/chunk-QFAGVCHM.js

HighKnown Malware Source Similaritydist/wake.cjs

HighKnown Malware Source Similarityhook/wake.cjs

HighKnown Malware Source Similarityvendor/node-pty/lib/unixTerminal.js

Affected versions and remediation

This report applies to deskbuddy@0.2.1.

See all versions of deskbuddy for other recorded verdicts.

Review the evidence and your use of deskbuddy@0.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 12:59:42.213Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.