registry / grok-telegram-bot / 2.2.2

grok-telegram-bot@2.2.2

Control the official Grok Build CLI from Telegram over the Agent Client Protocol (ACP). Sign in with your xAI account, switch projects, resume sessions, stream responses with diffs, queue follow-ups, manage multiple sign-ins, and run 24/7 as a cross-platf

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 99 file(s), 462 KB of source, external domains: accounts.x.ai, api.telegram.org, auth.x.ai, registry.npmjs.org, www.apple.com

Source & flagged code

2 flagged

src/service/linux.tsView file

Lines 1-34typescript

1/**

2 * Linux service controller — installs a systemd *user* service so no sudo is

3 * required. `loginctl enable-linger` is attempted so the bot runs at boot even

4 * before you log in.

5 */

6import { mkdirSync, rmSync, writeFileSync } from "node:fs";

7import { homedir, userInfo } from "node:os";

8import { join } from "node:path";

9import { runSafe } from "./platform.js";

10import type { LaunchSpec, ServiceController, ServiceResult } from "./types.js";

12const UNIT = "grok-telegram-bot.service";

14function unitPath(): string {

15 return join(homedir(), ".config", "systemd", "user", UNIT);

16}

18export const linuxController: ServiceController = {

19 platform: "linux",

21 async install(spec) {

22 mkdirSync(join(homedir(), ".config", "systemd", "user"), { recursive: true });

23 mkdirSync(spec.logsDir, { recursive: true });

24 writeFileSync(unitPath(), unitFile(spec), "utf-8");

26 runSafe("systemctl", ["--user", "daemon-reload"]);

27 const en = runSafe("systemctl", ["--user", "enable", "--now", UNIT]);

28 if (!en.ok) return fail(`systemctl enable failed: ${en.out}`);

29 const linger = runSafe("loginctl", ["enable-linger", userInfo().username]);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service/linux.tsView on unpkg · L14

30 const note = linger.ok ? " Boot-without-login enabled (linger)." : " (run `loginctl enable-linger` for boot-without-login)";

31 return ok(`Installed and started systemd user service "${UNIT}".${note}`);

32 },

34 async uninstall() {

src/app/updater.tsView file

Lines 1-34typescript

1/**

2 * Auto-updater — once an hour, asks npm for the latest published version with a

3 * single lightweight request. When a newer version exists AND the bot is fully

4 * idle (no in-flight prompt, no other active Grok session on the PC), it

5 * announces in chat, runs `npm install -g grok-telegram-bot@<latest>`, and

6 * restarts to apply. After the restart it posts the new version's CHANGELOG

7 * (tagged #update) so every release is easy to find in the conversation.

8 *

9 * Safety:

10 * • only ever updates when idle — never interrupts a running turn/task;

11 * • only for a global npm install (a cloned/source checkout is left alone);

Source & flagged code

2 flagged · loading source

src/service/linux.tsView file

14function unitPath(): string { L15: return join(homedir(), ".config", "systemd", "user", UNIT); L16: } ... L27: const en = runSafe("systemctl", ["--user", "enable", "--now", UNIT]); L28: if (!en.ok) return fail(`systemctl enable failed: ${en.out}`); L29: const linger = runSafe("loginctl", ["enable-linger", userInfo().username]);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service/linux.tsView on unpkg · L14

src/app/updater.tsView file

14*/ L15: import { spawn } from "node:child_process"; L16: import { get } from "node:https"; L17: import { readFileSync } from "node:fs"; ... L48: export class Updater { L49: private timer: NodeJS.Timeout | undefined; L50: private readonly state: JsonStore<PendingUpdate | null>; ... L150: // instance). On Windows / foreground there is no supervisor, so re-exec. L151: if (process.env.GROK_TG_SUPERVISED === "1") { L152: log.info("exiting for supervisor to relaunch the updated bot"); ... L187: try { L188: return (JSON.parse(readFileSync(join(projectRoot, "package.json"), "utf-8")) as { version?: string }).version ?? "0.0.0";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/app/updater.tsView on unpkg · L14

Findings

1 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitysrc/app/updater.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/service/linux.ts

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/service/linux.tsView file

Lines 1-34typescript

1/**

2 * Linux service controller — installs a systemd *user* service so no sudo is

3 * required. `loginctl enable-linger` is attempted so the bot runs at boot even

4 * before you log in.

5 */

6import { mkdirSync, rmSync, writeFileSync } from "node:fs";

7import { homedir, userInfo } from "node:os";

8import { join } from "node:path";

9import { runSafe } from "./platform.js";

10import type { LaunchSpec, ServiceController, ServiceResult } from "./types.js";

12const UNIT = "grok-telegram-bot.service";

14function unitPath(): string {

15 return join(homedir(), ".config", "systemd", "user", UNIT);

16}

18export const linuxController: ServiceController = {

19 platform: "linux",

21 async install(spec) {

22 mkdirSync(join(homedir(), ".config", "systemd", "user"), { recursive: true });

23 mkdirSync(spec.logsDir, { recursive: true });

24 writeFileSync(unitPath(), unitFile(spec), "utf-8");

26 runSafe("systemctl", ["--user", "daemon-reload"]);

27 const en = runSafe("systemctl", ["--user", "enable", "--now", UNIT]);

28 if (!en.ok) return fail(`systemctl enable failed: ${en.out}`);

29 const linger = runSafe("loginctl", ["enable-linger", userInfo().username]);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service/linux.tsView on unpkg · L14

30 const note = linger.ok ? " Boot-without-login enabled (linger)." : " (run `loginctl enable-linger` for boot-without-login)";

31 return ok(`Installed and started systemd user service "${UNIT}".${note}`);

32 },

34 async uninstall() {

src/app/updater.tsView file

Lines 1-34typescript

1/**

2 * Auto-updater — once an hour, asks npm for the latest published version with a

3 * single lightweight request. When a newer version exists AND the bot is fully

4 * idle (no in-flight prompt, no other active Grok session on the PC), it

5 * announces in chat, runs `npm install -g grok-telegram-bot@<latest>`, and

6 * restarts to apply. After the restart it posts the new version's CHANGELOG

7 * (tagged #update) so every release is easy to find in the conversation.

8 *

9 * Safety:

10 * • only ever updates when idle — never interrupts a running turn/task;

11 * • only for a global npm install (a cloned/source checkout is left alone);