registry / Data exfiltration / shine-code-submit
shine-code-submit
Claude Code Hook -> 本地常驻 Daemon 的状态/持久化底座
This report shows the evidence for shine-code-submit@1.1.4. 1 of 10 known versions is blocked or flagged. The newest version, 1.1.6, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete, default-enabled data exfiltration to a package-controlled external endpoint, not merely local dashboard functionality. The absence of an npm lifecycle hook reduces install-time scope but does not remove the reporting behavior after the advertised install command.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs shine-code-submit install; subsequent Claude Code hook activity starts the daemon.
Impact
Exfiltrates project paths, Git identity/remotes, session identifiers/titles, activity, token-use, and code-change metadata; it also silently updates itself.
Mechanism
automatic Claude-session metadata harvesting and remote reporting
Attack narrative
The explicit installer enables Claude hooks and a daemon. The daemon scans all Claude project transcripts to build reports containing project and session metadata, then automatically POSTs the report every 10 minutes to the hard-coded public HTTP endpoint whenever a Git username is found. It additionally checks npm and silently installs newer package versions in the background.
AI rationale
This is concrete, default-enabled data exfiltration to a package-controlled external endpoint, not merely local dashboard functionality. The absence of an npm lifecycle hook reduces install-time scope but does not remove the reporting behavior after the advertised install command.
Evidence
src/daemon/settings.tssrc/daemon/server.tssrc/daemon/claude-scan.tssrc/shared/types.tssrc/install/register.tssrc/shared/updater.tshooks/hooks.json~/.claude/projects~/.claude/settings.json
Network endpoints3
47.98.221.20:36667/api/reportregistry.npmjs.org/shine-code-submit/latestregistry.npmjs.org/
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- src/daemon/settings.ts defaults reporting to http://47.98.221.20:36667/api/report every 10 minutes.
- src/daemon/server.ts automatically gzip-POSTs a full report when git user.name is available.
- src/daemon/claude-scan.ts scans all ~/.claude/projects JSONL sessions, not only package events.
- src/shared/types.ts report data includes project cwd, git user, git remote, session IDs, titles, activity, token and code-change statistics.
- src/install/register.ts enables Claude hooks; hooks/hooks.json invokes the launcher for seven Claude events.
- src/shared/updater.ts silently runs detached npx install of @latest after registry checks.
Evidence against
- package.json has no install/postinstall lifecycle hook.
- Installation and Claude-plugin registration begin from the user-invoked bin install command.
- No source evidence of uploading complete transcript contents or credentials.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
7 flagged · loading sourcebin/launcher.cjsView file
11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。
L12: const { spawn, spawnSync } = require("node:child_process");
L13: const readline = require("node:readline");
High
1#!/usr/bin/env node
L2: // shine-code-submit hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。
L3: // Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。
...
L7: //
L8: // ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。
L9: // 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。
...
L11: // 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。
L12: const { spawn, spawnSync } = require("node:child_process");
L13: const readline = require("node:readline");
...
L17:
L18: const here = __dirname; // .../bin/
L19: const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/launcher.cjsView on unpkg · L1src/install/bun.tsView file
Findings
1 Critical5 High3 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/install.cjs
HighChild Processbin/launcher.cjs
HighShellsrc/install/bun.ts
HighSame File Env Network Executiondist/install.cjs
HighSandbox Evasion Gated Capabilitybin/launcher.cjs
HighRuntime Package Installdist/install.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/shared/id.ts
LowFilesystem
LowObfuscated
Low
Affected versions and remediation
This report applies to shine-code-submit@1.1.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing shine-code-submit@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.