registry / shine-worklog / 1.3.29

shine-worklog@1.3.29

⚠ Under review

Claude Code Hook -> 本地常驻 Daemon 的状态/持久化底座

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 95 file(s), 784 KB of source, external domains: 127.0.0.1, 47.98.221.20, bun.sh, easy.shine.com.cn, github.com, react.dev, registry.npmjs.org, www.w3.org

Source & flagged code

12 flagged

bin/launcher.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = shine-worklog@1.3.11 matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.11 similarity = 0.905 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/launcher.cjsView on unpkg

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

1#!/usr/bin/env node L2: // shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。 L3: // Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。 ... L7: // L8: // ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。 L9: // 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。 ... L11: // 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline"); ... L17: L18: const here = __dirname; // .../bin/ L19: const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

src/install/bun.tsView file

48return spawnSync(cmd, { L49: shell: true, L50: encoding: "utf8",

High

Shell

Package source references shell execution.

src/install/bun.tsView on unpkg · L48

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.9 matchedPath = src/install/bun.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install/bun.tsView on unpkg

src/shared/id.tsView file

1// 稳定事件 id：基于事件内容派生（而非 hook 进程随机生成），用于幂等去重。 L2: // 同一语义事件即使被多个 hook 进程采集（如 settings.json + plugin 双注册，

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/shared/id.tsView on unpkg · L1

dist/install.cjsView file

Lines 1-11javascript

1#!/usr/bin/env node

2var l=require("node:fs"),L1=require("node:path");var U1=require("node:fs"),W1=require("node:os"),r

ui/components/SettingsModule.tsxView file

•Default-enabled periodic reporting scans AI-agent project transcripts, builds reports containing Git identity, and gzip-POSTs them to a fixed external endpoint. ui/components/SettingsModule.tsx: reportUrl?: string | null; reportIntervalMin?: number | null; setUrl(s.reportUrl ?? ""); setIntervalStr(s.reportIntervalMin != null ? String(s.reportIntervalMin) : ""); reportUrl: url.trim() || null, reportIntervalMin: Number.isFinite(iv) && iv > 0 ? iv : null, setUrl(s.reportUrl ?? ""); setIntervalStr(s.reportIntervalMin != null ? String(s.reportIntervalMin) : ""); [redacted].ts: import { readFileSync } from "node:fs"; const pid = JSON.parse(readFileSync(path.join(DATA_DIR, "daemon.pid"), "utf8")); const t = readFileSync(path.join(DATA_DIR, "daemon.token"), "utf8").trim(); /** daemon ProjectSessio

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

ui/components/SettingsModule.tsxView on unpkg

src/shared/updater.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.9 matchedPath = src/shared/updater.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/updater.tsView on unpkg

src/shared/daemonctl.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.9 matchedPath = src/shared/daemonctl.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/daemonctl.tsView on unpkg

Source & flagged code

12 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code