registry / Data exfiltration / shine-worklog

shine-worklog

Claude Code Hook -> 本地常驻 Daemon 的状态/持久化底座

This report shows the evidence for shine-worklog@1.4.1. 19 of 35 known versions are blocked or flagged. The newest version, 1.7.0, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete default-enabled data exfiltration to a hardcoded external endpoint, not merely local worklog functionality. The absence of an npm install hook does not remove the runtime privacy impact after activation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the installer or enables the Claude plugin; a later daemon interval performs the upload.

Impact

Exfiltration of project paths, Git identity/remotes, session titles, activity metadata, and worklog text.

Mechanism

Default periodic gzip POST of aggregated Claude and Git worklog data.

Attack narrative

The explicit installer registers a Claude plugin and starts a daemon. Defaults then enable a hardcoded IP-based reporting endpoint every 10 minutes. The daemon builds reports from Claude session and Git-derived records and POSTs them as gzip JSON without requiring the user to configure or approve the destination. It also enables silent package self-updates by default.

AI rationale

Evidence

src/daemon/settings.tssrc/daemon/server.tssrc/shared/types.tssrc/shared/updater.tssrc/install/register.ts~/.claude/projects/**/*.jsonl~/.local/share/shine-worklog/settings.json~/.local/share/shine-worklog/db/events.sqlite~/.claude/settings.json

Network endpoints2

47.98.221.20:36667/api/reportregistry.npmjs.org/

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

Default settings enable 10-minute reporting to a hardcoded external IP.
The daemon automatically uploads reports once the configured interval elapses.
Uploaded reports include project paths, git remotes, session titles, and worklog text.
Auto-update is enabled by default and silently installs the latest package.

Evidence against

package.json has no npm install/postinstall lifecycle hook.
Claude integration is installed through an explicit user command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 103 file(s), 874 KB of source, external domains: 127.0.0.1, 47.98.221.20, bun.sh, easy.shine.com.cn, github.com, react.dev, registry.npmjs.org, www.w3.org

Source & flagged code

14 flagged

bin/launcher.cjsView file

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

1#!/usr/bin/env node L2: // shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。 L3: // Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。 ... L7: // L8: // ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。 L9: // 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。 ... L11: // 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline"); ... L17: L18: const here = __dirname; // .../bin/ L19: const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.47 matchedPath = bin/launcher.cjs matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/launcher.cjsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/launcher.cjsView on unpkg · L11

src/install/bun.tsView file

48return spawnSync(cmd, { L49: shell: true, L50: encoding: "utf8",

High

Shell

Package source references shell execution.

src/install/bun.tsView on unpkg · L48

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.47 matchedPath = src/install/bun.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install/bun.tsView on unpkg

src/shared/id.tsView file

1// 稳定事件 id：基于事件内容派生（而非 hook 进程随机生成），用于幂等去重。 L2: // 同一语义事件即使被多个 hook 进程采集（如 settings.json + plugin 双注册，

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/shared/id.tsView on unpkg · L1

dist/install.cjsView file

Lines 1-11javascript

1#!/usr/bin/env node

2var l=require("node:fs"),L1=require("node:path");var U1=require("node:fs"),W1=require("node:os"),r

ui/components/SettingsModule.tsxView file

•Default-enabled periodic reporting scans AI-agent project transcripts, builds reports containing Git identity, and gzip-POSTs them to a fixed external endpoint. ui/components/SettingsModule.tsx: reportUrl?: string | null; reportIntervalMin?: number | null; setUrl(s.reportUrl ?? ""); setIntervalStr(s.reportIntervalMin != null ? String(s.reportIntervalMin) : ""); reportUrl: url.trim() || null, reportIntervalMin: Number.isFinite(iv) && iv > 0 ? iv : null, setUrl(s.reportUrl ?? ""); setIntervalStr(s.reportIntervalMin != null ? String(s.reportIntervalMin) : ""); skills/report/scripts/zentao.ts: * config [--url U --account A --password P --projects 1,2] [--show] * check / projects [--limit N] / my-tasks [--projects 1,2] [--all-status] * executions [--projects 1,2] / create-task --execution

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

ui/components/SettingsModule.tsxView on unpkg

src/shared/updater.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.47 matchedPath = src/shared/updater.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/updater.tsView on unpkg

src/hook/main.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.47 matchedPath = src/hook/main.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hook/main.tsView on unpkg

src/shared/daemonctl.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.47 matchedPath = src/shared/daemonctl.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/daemonctl.tsView on unpkg

Source & flagged code

14 flagged · loading source

bin/launcher.cjsView file

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

Findings

1 Critical11 High4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationui/components/SettingsModule.tsx

HighChild Processbin/launcher.cjs

HighShellsrc/install/bun.ts

HighSame File Env Network Executiondist/install.cjs

HighSandbox Evasion Gated Capabilitybin/launcher.cjs

HighExternal Ai Agent Control Surface Mutationdist/install.cjs

HighRuntime Package Installdist/install.cjs

HighKnown Malware Source Similaritybin/launcher.cjs

HighKnown Malware Source Similaritysrc/shared/updater.ts

HighKnown Malware Source Similaritysrc/hook/main.ts

HighKnown Malware Source Similaritysrc/install/bun.ts

Affected versions and remediation

This report applies to shine-worklog@1.4.1.

The versions list below shows the verdict for each recorded version.

Avoid installing shine-worklog@1.4.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-19 04:14:35.859Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

35 known versions

1.7.0latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 14, 2026, 9:08 AM 1.6.1SuspiciousAgent extension lifecycle riskWarnPublishedAug 30, 2026, 8:53 AM 1.5.0SuspiciousAgent extension lifecycle riskWarnPublishedAug 26, 2026, 8:10 AM 1.4.11SuspiciousAgent extension lifecycle riskWarnPublishedAug 23, 2026, 1:35 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code