registry / Credential exfiltration / linkshell-cli

linkshell-cli

Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone

This report shows the evidence for linkshell-cli@0.10.78. 1 of 86 known versions is blocked or flagged. The newest version, 0.10.93, is allowed. See all versions.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Password login forwards the user's password to a fixed vendor proxy by default, with no explicit proxy consent in the login flow. That is credential exfiltration to an additional host, even though the user initiated sign-in.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user selects password login in the desktop or CLI flow.

Impact

The proxy receives the user's account password, exposing a credential belonging to the authentication service to an additional host without explicit proxy opt-in.

Mechanism

The email and password are placed in an authentication grant and POSTed to the fixed itool.tech endpoint unless the user has set LINKSHELL_TOKEN_PROXY=off.

Attack narrative

When a user chooses password login, the package builds a grant containing the email and password. It sends that grant to the fixed itool.tech authentication proxy by default; the opt-out requires a separate environment setting. This exposes the user's authentication credential to an additional host beyond the account's authentication service.

AI rationale

Evidence

dist/cli/src/commands/sign-in.jsdist/cli/src/commands/desktop.js

Network endpoints1

itool.tech/api/linkshell/auth

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

Password login places the user's email and password in a grant passed to the exchange routine.
The exchange routine POSTs the grant to the fixed itool.tech authentication proxy.
The proxy is used by default; only setting LINKSHELL_TOKEN_PROXY=off skips it.

Evidence against

The login flow is triggered by a user choosing password login.
The postinstall hook only adjusts node-pty helper permissions locally; it does not contact a network host.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 159 file(s), 1.84 MB of source, external domains: 0.0.0.0, 127.0.0.1, dl.google.com, github.com, itool.tech, liutianjie.github.io, mkbeusztkzffnzjdwmqk.supabase.co, pay.ldxp.cn, push.itool.tech, registry.npmjs.org, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/host/src/ports.jsView file

1import { execFile } from "node:child_process"; L2: import { readlink } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/host/src/ports.jsView on unpkg · L1

dist/cli/src/index.jsView file

9import { createRequire } from "node:module"; L10: const require = createRequire(import.meta.url); L11: const pkg = require("../../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/src/index.jsView on unpkg · L9

dist/cli/src/commands/upgrade.jsView file

40if (process.platform === "win32") { L41: process.stderr.write(" Windows 桌面版请通过新版安装包一起更新 App、CLI 和 Host：\n https://github.[redacted]\n"); L42: return; L43: } L44: execFileSync("/usr/bin/open", ["-n", "-a", app, "--args", "--dashboard", "--check-updates", "--home", linkshellDir()]); L45: process.stderr.write(" 已打开 LinkShell 软件更新；App、内置 CLI 和 Host 将一起更新。\n");

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/src/commands/upgrade.jsView on unpkg · L40

1import { execFileSync } from "node:child_process"; L2: import { realpathSync } from "node:fs"; ... L26: try { L27: const res = await fetch("https://registry.npmjs.org/linkshell-cli/latest", { signal: AbortSignal.timeout(10_000) }); L28: if (!res.ok) L29: return null; L30: const body = (await res.json()); L31: return body.version ?? null; ... L39: if (app) { L40: if (process.platform === "win32") { L41: process.stderr.write(" Windows 桌面版请通过新版安装包一起更新 App、CLI 和 Host：\n https://github.[redacted]\n"); L42: return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/src/commands/upgrade.jsView on unpkg · L1

40Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli/src/index.js -> dist/cli/src/commands/upgrade.js L40: if (process.platform === "win32") { L41: process.stderr.write(" Windows 桌面版请通过新版安装包一起更新 App、CLI 和 Host：\n https://github.[redacted]\n"); L42: return; L43: } L44: execFileSync("/usr/bin/open", ["-n", "-a", app, "--args", "--dashboard", "--check-updates", "--home", linkshellDir()]); L45: process.stderr.write(" 已打开 LinkShell 软件更新；App、内置 CLI 和 Host 将一起更新。\n");

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli/src/commands/upgrade.jsView on unpkg · L40

dist/cli/src/commands/host.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/src/commands/host.js#virtual:normalized:round1View on unpkg

dist/host/src/drivers/claude/driver.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = linkshell-cli@0.10.76 matchedIdentity = npm:bGlua3NoZWxsLWNsaQ:0.10.76 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/host/src/drivers/claude/driver.jsView on unpkg

Findings

1 Critical7 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/host/src/drivers/claude/driver.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/host/src/ports.js

HighShell

HighCommand Output Exfiltrationdist/cli/src/commands/upgrade.js

HighSandbox Evasion Gated Capabilitydist/cli/src/commands/upgrade.js

HighTrigger Reachable Command Output Exfiltrationdist/cli/src/commands/upgrade.js

HighSemantic Analysis Limiteddist/cli/src/commands/host.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/cli/src/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to linkshell-cli@0.10.78.

The versions list below shows the verdict for each recorded version.

Avoid installing linkshell-cli@0.10.78. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-29 06:20:28.304Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

86 known versions

registry / Credential exfiltration / linkshell-cli

linkshell-cli

Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone

This report shows the evidence for linkshell-cli@0.10.78. 1 of 86 known versions is blocked or flagged. The newest version, 0.10.93, is allowed. See all versions.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user selects password login in the desktop or CLI flow.

Impact

The proxy receives the user's account password, exposing a credential belonging to the authentication service to an additional host without explicit proxy opt-in.

Mechanism

The email and password are placed in an authentication grant and POSTed to the fixed itool.tech endpoint unless the user has set LINKSHELL_TOKEN_PROXY=off.

Attack narrative

AI rationale

Evidence

dist/cli/src/commands/sign-in.jsdist/cli/src/commands/desktop.js

Network endpoints1

itool.tech/api/linkshell/auth

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

Password login places the user's email and password in a grant passed to the exchange routine.
The exchange routine POSTs the grant to the fixed itool.tech authentication proxy.
The proxy is used by default; only setting LINKSHELL_TOKEN_PROXY=off skips it.

Evidence against

The login flow is triggered by a user choosing password login.
The postinstall hook only adjusts node-pty helper permissions locally; it does not contact a network host.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/host/src/ports.jsView file

1import { execFile } from "node:child_process"; L2: import { readlink } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/host/src/ports.jsView on unpkg · L1

dist/cli/src/index.jsView file

9import { createRequire } from "node:module"; L10: const require = createRequire(import.meta.url); L11: const pkg = require("../../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/src/index.jsView on unpkg · L9

dist/cli/src/commands/upgrade.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/src/commands/upgrade.jsView on unpkg · L40

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/src/commands/upgrade.jsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli/src/commands/upgrade.jsView on unpkg · L40

dist/cli/src/commands/host.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/src/commands/host.js#virtual:normalized:round1View on unpkg

dist/host/src/drivers/claude/driver.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/host/src/drivers/claude/driver.jsView on unpkg

Findings

1 Critical7 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/host/src/drivers/claude/driver.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/host/src/ports.js

HighShell

HighCommand Output Exfiltrationdist/cli/src/commands/upgrade.js

HighSandbox Evasion Gated Capabilitydist/cli/src/commands/upgrade.js

HighTrigger Reachable Command Output Exfiltrationdist/cli/src/commands/upgrade.js

HighSemantic Analysis Limiteddist/cli/src/commands/host.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/cli/src/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to linkshell-cli@0.10.78.

The versions list below shows the verdict for each recorded version.

Avoid installing linkshell-cli@0.10.78. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-29 06:20:28.304Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

86 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Related packages

Other credential exfiltration packages