linkshell-cli@0.10.78
Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone
AI Security Review
scanned 7d ago · by lpm-firewall-aiPassword login forwards the user's password to a fixed vendor proxy by default, with no explicit proxy consent in the login flow. That is credential exfiltration to an additional host, even though the user initiated sign-in.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user selects password login in the desktop or CLI flow.
Impact
The proxy receives the user's account password, exposing a credential belonging to the authentication service to an additional host without explicit proxy opt-in.
Mechanism
The email and password are placed in an authentication grant and POSTed to the fixed itool.tech endpoint unless the user has set LINKSHELL_TOKEN_PROXY=off.
Attack narrative
When a user chooses password login, the package builds a grant containing the email and password. It sends that grant to the fixed itool.tech authentication proxy by default; the opt-out requires a separate environment setting. This exposes the user's authentication credential to an additional host beyond the account's authentication service.
AI rationale
Password login forwards the user's password to a fixed vendor proxy by default, with no explicit proxy consent in the login flow. That is credential exfiltration to an additional host, even though the user initiated sign-in.
Evidence
dist/cli/src/commands/sign-in.jsdist/cli/src/commands/desktop.js
Network endpoints1
itool.tech/api/linkshell/auth
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- Password login places the user's email and password in a grant passed to the exchange routine.
- The exchange routine POSTs the grant to the fixed itool.tech authentication proxy.
- The proxy is used by default; only setting LINKSHELL_TOKEN_PROXY=off skips it.
Evidence against
- The login flow is triggered by a user choosing password login.
- The postinstall hook only adjusts node-pty helper permissions locally; it does not contact a network host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/host/src/ports.jsView file
1import { execFile } from "node:child_process";
L2: import { readlink } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/host/src/ports.jsView on unpkg · L1Findings
1 Critical7 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/host/src/drivers/claude/driver.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/host/src/ports.js
HighShell
HighCommand Output Exfiltrationdist/cli/src/commands/upgrade.js
HighSandbox Evasion Gated Capabilitydist/cli/src/commands/upgrade.js
HighTrigger Reachable Command Output Exfiltrationdist/cli/src/commands/upgrade.js
HighSemantic Analysis Limiteddist/cli/src/commands/host.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cli/src/index.js
MediumNetwork
Affected versions and remediation
This report applies to linkshell-cli@0.10.78.
See all versions of linkshell-cli for other recorded verdicts.
- Avoid installing linkshell-cli@0.10.78. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.