registry / Remote code execution / lilibtc

lilibtc

Lilibtc 币安广场自动发布工具 - 自动同步内容到 Binance Square，提升个人品牌影响力

This report shows the evidence for lilibtc@1.0.4, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package contains executable, unverified remote code replacement plus a server-controlled shell-injection primitive. These exceed the intended publishing function and create a concrete RCE chain.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs lilibtc start.

Impact

Remote code execution under the invoking user's account and persistent replacement of the installed agent.

Mechanism

Unverified remote self-update and shell execution of server-supplied URL data.

Attack narrative

On explicit start, agent.mjs checks a vendor endpoint and writes its response directly over its own source with no signature or hash validation. It also polls the same service for posts; a task-controlled image URL is placed inside an execSync curl shell command, allowing command injection if the task source is malicious or compromised. This creates a concrete vendor-controlled remote-code path.

AI rationale

The package contains executable, unverified remote code replacement plus a server-controlled shell-injection primitive. These exceed the intended publishing function and create a concrete RCE chain.

Evidence

agent.mjscli.mjspackage.json~/.cryptoqclaw/binance-api-key~/.cryptoqclaw/publisher.lock

Network endpoints3

api.cryptoqclaw.aiwww.binance.com/bapi/composite/v1/public/pgc/openApiwww.binance.com/bapi/composite/v2/public/pgc/openApi

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

agent.mjs downloads /download/agent and overwrites itself without integrity verification.
agent.mjs runs curl through execSync with server-provided imageUrl interpolated into a shell command.
cli.mjs also downloads and replaces its executable from api.cryptoqclaw.ai without a signature/hash.
The agent polls the vendor API for tasks and runs persistently when started.

Evidence against

package.json has no install lifecycle hooks.
Execution requires an explicit lilibtc start command.
Binance OpenAPI key is read locally and used only for Binance API requests in inspected code.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 67.5 KB of source, external domains: 127.0.0.1, api.cryptoqclaw.ai, www.binance.com

Source & flagged code

8 flagged

agent.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * CryptoQClaw Agent — 跨平台纯 API 发布器

4 *

5 * 不再依赖 Chrome/AppleScript/CDP。通过币安广场 OpenAPI 直接发帖

6 * （文本 + 图片 + 长文）。支持 Linux / Windows(WSL) / macOS。

7 *

8 * 版本号统一由同目录 package.json 的 version 字段维护（CLI 工具与

9 * publisher 引擎共用一个版本，避免历史遗留的双版本号困惑）。

10 */

12import { execSync } from 'child_process';

13import { writeFileSync, readFileSync, existsSync, mkdirSync, appendFileSync, unlinkSync } from 'fs';

High

Child Process

Package source references child process execution.

agent.mjsView on unpkg · L11

14import { hostname, homedir } from 'os';

15import { join } from 'path';

16import { checkPublishLimit, generateWaitMs, DAILY_LIMITS } from './humanize.mjs';

17// Proxy: Node 原生 fetch 不读 HTTPS_PROXY 环境变量（长期 known issue），必须显式注入 undici

18// ProxyAgent。用动态 import 避免无 proxy 时加载 undici（undici 8.x 需要 Node 22+）。

19const PROXY_URL = process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY;

20if (PROXY_URL) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

agent.mjsView on unpkg · L11

21 try {

22 const { ProxyAgent, setGlobalDispatcher } = await import('undici');

23 setGlobalDispatcher(new ProxyAgent(PROXY_URL));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

agent.mjsView on unpkg · L21

24 console.log(`🔗 HTTPS_PROXY set (${PROXY_URL}). undici ProxyAgent injected as global dispatcher.`);

25 } catch (e) {

26 console.warn(`⚠️ HTTPS_PROXY=${PROXY_URL} 但 undici 代理注入失败: ${e.message}. 原生 fetch 将直连，可能失败。`);

27 }

28}

30// ============ 配置 ============

31const SERVER_URL = process.env.SERVER_URL || 'https://api.cryptoqclaw.ai';

32const API_KEY = process.env.API_KEY || ''; // §2.1 不硬编码；production 由 EnvironmentFile(.env) 提供

33const POLL_INTERVAL = parseInt(process.env.POLL_INTERVAL || '30000');

34const AGENT_TOKEN = process.env.CRYPTOQCLAW_AGENT_TOKEN || process.env.AGENT_TOKEN;

36if (!AGENT_TOKEN) {

37 console.error('❌ 请设置 CRYPTOQCLAW_AGENT_TOKEN（兼容旧 AGENT_TOKEN）');

38 console.error(' 运行: CRYPTOQCLAW_AGENT_TOKEN=bsq_xxxxx node agent.mjs');

39 process.exit(1);

40}

cli.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * CryptoQClaw CLI - 币安广场自动发布代理 (v1.0.3)

4 *

5 * 用法:

6 * cryptoqclaw login --key bsq_xxx # 绑定 API Key（sk-xxxxx 或 bsq_xxxxx）

7 * cryptoqclaw set-binance-key <key> # 设置币安广场发帖 OpenAPI Key（仅本地）

8 * cryptoqclaw start # 启动代理（前台，继承当前 shell env）

9 * HTTPS_PROXY=http://127.0.0.1:1081 \

10 * cryptoqclaw start --daemon # 后台运行（必须显式带 HTTPS_PROXY，

11 * # daemon 不读 ~/.bashrc）

lilibtc-1.0.4.tgzView file

•path = lilibtc-1.0.4.tgz kind = high_entropy_blob sizeBytes = 25115 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lilibtc-1.0.4.tgzView on unpkg

•path = lilibtc-1.0.4.tgz kind = compressed_blob sizeBytes = 25115 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lilibtc-1.0.4.tgzView on unpkg

•path = lilibtc-1.0.4.tgz kind = nested_archive_needs_inspection sizeBytes = 25115 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lilibtc-1.0.4.tgzView on unpkg

Source & flagged code

8 flagged · loading source

agent.mjsView file

11L12: import { execSync } from 'child_process'; L13: import { writeFileSync, readFileSync, existsSync, mkdirSync, appendFileSync, unlinkSync } from 'fs';

High

Child Process

Package source references child process execution.

agent.mjsView on unpkg · L11

11L12: import { execSync } from 'child_process'; L13: import { writeFileSync, readFileSync, existsSync, mkdirSync, appendFileSync, unlinkSync } from 'fs'; ... L16: import { checkPublishLimit, generateWaitMs, DAILY_LIMITS } from './humanize.mjs'; L17: // Proxy: Node 原生 fetch 不读 HTTPS_PROXY 环境变量（长期 known issue），必须显式注入 undici L18: // ProxyAgent。用动态 import 避免无 proxy 时加载 undici（undici 8.x 需要 Node 22+）。 L19: const PROXY_URL = process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY; L20: if (PROXY_URL) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

agent.mjsView on unpkg · L11

21package = lilibtc; repositoryIdentity = square-agent; dependency = undici L21: try { L22: const { ProxyAgent, setGlobalDispatcher } = await import('undici'); L23: setGlobalDispatcher(new ProxyAgent(PROXY_URL));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

Findings

6 High5 Medium4 Low

HighChild Processagent.mjs

HighShell

HighSame File Env Network Executionagent.mjs

HighCopied Package Dependency Bridgeagent.mjs

HighTrigger Reachable Persistencecli.mjs

HighShips High Entropy Bloblilibtc-1.0.4.tgz

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencecli.mjs

MediumShips Compressed Bloblilibtc-1.0.4.tgz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionlilibtc-1.0.4.tgz

Affected versions and remediation

This report applies to lilibtc@1.0.4.

The versions list below shows the verdict for each recorded version.

Avoid installing lilibtc@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-09 06:14:10.587Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.4latestshownMaliciousRemote Code ExecutionBlockPublishedAug 9, 2026, 2:51 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages