lilibtc@1.0.4: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

lilibtc@1.0.4: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

agent.mjsView file

11L12: import { execSync } from 'child_process'; L13: import { writeFileSync, readFileSync, existsSync, mkdirSync, appendFileSync, unlinkSync } from 'fs';

High

Child Process

Package source references child process execution.

agent.mjsView on unpkg · L11

11L12: import { execSync } from 'child_process'; L13: import { writeFileSync, readFileSync, existsSync, mkdirSync, appendFileSync, unlinkSync } from 'fs'; ... L16: import { checkPublishLimit, generateWaitMs, DAILY_LIMITS } from './humanize.mjs'; L17: // Proxy: Node 原生 fetch 不读 HTTPS_PROXY 环境变量（长期 known issue），必须显式注入 undici L18: // ProxyAgent。用动态 import 避免无 proxy 时加载 undici（undici 8.x 需要 Node 22+）。 L19: const PROXY_URL = process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY; L20: if (PROXY_URL) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

agent.mjsView on unpkg · L11

21package = lilibtc; repositoryIdentity = square-agent; dependency = undici L21: try { L22: const { ProxyAgent, setGlobalDispatcher } = await import('undici'); L23: setGlobalDispatcher(new ProxyAgent(PROXY_URL));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

agent.mjsView on unpkg · L21

cli.mjsView file

8Trigger-reachable persistence chain: manifest.bin -> cli.mjs L8: * cryptoqclaw start # 启动代理（前台，继承当前 shell env） L9: * HTTPS_PROXY=http://127.0.0.1:1081 \ L10: * cryptoqclaw start --daemon # 后台运行（必须显式带 HTTPS_PROXY， L11: * # daemon 不读 ~/.bashrc） L12: * cryptoqclaw status # 查看状态 ... L21: L22: import { execSync, spawn } from 'child_process'; L23: import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, unlinkSync, chmodSync, renameSync } from 'fs'; ... L35: // 兜底：若 import.meta.url 解析失败（极少见），退回历史路径并使用实际包名。 L36: const FALLBACK_PKG_DIR = join(homedir(), '.cryptoqclaw/npm-global/lib/node_modules/crypto-q-claw'); L37: const AGENT_DIR = existsSync(join(PKG_DIR, 'agent.mjs')) ? PKG_DIR : F

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

cli.mjsView on unpkg · L8

8* cryptoqclaw start # 启动代理（前台，继承当前 shell env） L9: * HTTPS_PROXY=http://127.0.0.1:1081 \ L10: * cryptoqclaw start --daemon # 后台运行（必须显式带 HTTPS_PROXY， L11: * # daemon 不读 ~/.bashrc） L12: * cryptoqclaw status # 查看状态 ... L21: L22: import { execSync, spawn } from 'child_process'; L23: import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, unlinkSync, chmodSync, renameSync } from 'fs'; ... L35: // 兜底：若 import.meta.url 解析失败（极少见），退回历史路径并使用实际包名。 L36: const FALLBACK_PKG_DIR = join(homedir(), '.cryptoqclaw/npm-global/lib/node_modules/crypto-q-claw'); L37: const AGENT_DIR = existsSync(join(PKG_DIR, 'agent.mjs')) ? PKG_DIR : FALLBACK_PKG_DIR; ... L77: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli.mjsView on unpkg · L8

lilibtc-1.0.4.tgzView file

•path = lilibtc-1.0.4.tgz kind = high_entropy_blob sizeBytes = 25115 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lilibtc-1.0.4.tgzView on unpkg

•path = lilibtc-1.0.4.tgz kind = compressed_blob sizeBytes = 25115 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lilibtc-1.0.4.tgzView on unpkg

•path = lilibtc-1.0.4.tgz kind = nested_archive_needs_inspection sizeBytes = 25115 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lilibtc-1.0.4.tgzView on unpkg

Source & flagged code

8 flagged

agent.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * CryptoQClaw Agent — 跨平台纯 API 发布器

4 *

5 * 不再依赖 Chrome/AppleScript/CDP。通过币安广场 OpenAPI 直接发帖

6 * （文本 + 图片 + 长文）。支持 Linux / Windows(WSL) / macOS。

7 *

8 * 版本号统一由同目录 package.json 的 version 字段维护（CLI 工具与

9 * publisher 引擎共用一个版本，避免历史遗留的双版本号困惑）。

10 */

11

12import { execSync } from 'child_process';

13import { writeFileSync, readFileSync, existsSync, mkdirSync, appendFileSync, unlinkSync } from 'fs';

High

Child Process

Package source references child process execution.

agent.mjsView on unpkg · L11

14import { hostname, homedir } from 'os';

15import { join } from 'path';

16import { checkPublishLimit, generateWaitMs, DAILY_LIMITS } from './humanize.mjs';

17// Proxy: Node 原生 fetch 不读 HTTPS_PROXY 环境变量（长期 known issue），必须显式注入 undici

18// ProxyAgent。用动态 import 避免无 proxy 时加载 undici（undici 8.x 需要 Node 22+）。

19const PROXY_URL = process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY;

20if (PROXY_URL) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

agent.mjsView on unpkg · L11

21 try {

22 const { ProxyAgent, setGlobalDispatcher } = await import('undici');

23 setGlobalDispatcher(new ProxyAgent(PROXY_URL));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

agent.mjsView on unpkg · L21

24 console.log(`🔗 HTTPS_PROXY set (${PROXY_URL}). undici ProxyAgent injected as global dispatcher.`);

25 } catch (e) {

26 console.warn(`⚠️ HTTPS_PROXY=${PROXY_URL} 但 undici 代理注入失败: ${e.message}. 原生 fetch 将直连，可能失败。`);

27 }

28}

29

30// ============ 配置 ============

31const SERVER_URL = process.env.SERVER_URL || 'https://api.cryptoqclaw.ai';

32const API_KEY = process.env.API_KEY || ''; // §2.1 不硬编码；production 由 EnvironmentFile(.env) 提供

33const POLL_INTERVAL = parseInt(process.env.POLL_INTERVAL || '30000');

34const AGENT_TOKEN = process.env.CRYPTOQCLAW_AGENT_TOKEN || process.env.AGENT_TOKEN;

35

36if (!AGENT_TOKEN) {

37 console.error('❌ 请设置 CRYPTOQCLAW_AGENT_TOKEN（兼容旧 AGENT_TOKEN）');

38 console.error(' 运行: CRYPTOQCLAW_AGENT_TOKEN=bsq_xxxxx node agent.mjs');

39 process.exit(1);

40}

41

cli.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * CryptoQClaw CLI - 币安广场自动发布代理 (v1.0.3)

4 *

5 * 用法:

6 * cryptoqclaw login --key bsq_xxx # 绑定 API Key（sk-xxxxx 或 bsq_xxxxx）

7 * cryptoqclaw set-binance-key <key> # 设置币安广场发帖 OpenAPI Key（仅本地）

8 * cryptoqclaw start # 启动代理（前台，继承当前 shell env）

9 * HTTPS_PROXY=http://127.0.0.1:1081 \

10 * cryptoqclaw start --daemon # 后台运行（必须显式带 HTTPS_PROXY，

11 * # daemon 不读 ~/.bashrc）

lilibtc-1.0.4.tgzView file

•path = lilibtc-1.0.4.tgz kind = high_entropy_blob sizeBytes = 25115 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lilibtc-1.0.4.tgzView on unpkg

•path = lilibtc-1.0.4.tgz kind = compressed_blob sizeBytes = 25115 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lilibtc-1.0.4.tgzView on unpkg

•path = lilibtc-1.0.4.tgz kind = nested_archive_needs_inspection sizeBytes = 25115 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lilibtc-1.0.4.tgzView on unpkg