shine-worklog@1.3.48

Claude Code Hook -> 本地常驻 Daemon 的状态/持久化底座

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a first-party Claude extension with meaningful lifecycle, persistence, and self-update risk, but the inspected source shows no npm install-time hook or concrete malicious exfiltration chain. Warn rather than block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the install command and enables/restarts Claude Code.

Impact

Expanded Claude-event and transcript access plus supply-chain update risk; no confirmed hardcoded data exfiltration.

Mechanism

Claude hook registration, daemon persistence, and silent package/runtime updates.

AI rationale

Evidence

package.jsonhooks/hooks.jsonbin/launcher.cjssrc/install/register.tssrc/shared/updater.tssrc/shared/config.tssrc/daemon/server.tsui/components/SettingsModule.tsx

Network endpoints2

registry.npmjs.org/bun.sh/install

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Claude plugin hooks invoke the package launcher for multiple Claude events.
Launcher silently installs Bun, including a curl-to-shell fallback, when invoked without Bun.
Installer writes and enables this package in Claude user plugin settings.
Daemon defaults to binding its dashboard on all network interfaces.
Daemon silently checks npm and detached-installs latest package releases.

Evidence against

package.json has no npm install/postinstall lifecycle hook.
Report upload requires a user-configured reportUrl.
No hardcoded non-package exfiltration receiver was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

14 flagged

bin/launcher.cjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。

3// Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。

4// 优先 spawn 同目录 bin/<plat>-<arch>/hook[.exe]（二进制模式，本机 build 产物）；

5// 不存在则 bun run src/hook/main.ts（源码模式）。源码模式需要 Bun——若没装，首次自动安装

6// （npm i -g bun → 失败回退官方脚本）。退出码恒 0——绝不影响 Claude Code 主进程。

7//

8// ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。

9// 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。

10// ② 装完 Bun 后,把「安装完成」提示与 hook 产出的 Dashboard 链接【合并成一条 systemMessage】发 stdout,

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。

12const { spawn, spawnSync } = require("node:child_process");

13const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/launcher.cjsView on unpkg · L11

14const { existsSync, mkdirSync, appendFileSync } = require("node:fs");

15const { join } = require("node:path");

16const { homedir } = require("node:os");

18const here = __dirname; // .../bin/

19const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

20const arch = process.arch; // x64 | arm64

21const ext = process.platform === "win32" ? ".exe" : "";

22const hookBin = join(here, `${plat}-${arch}`, `hook${ext}`);

23const hookSrc = join(here, "..", "src", "hook", "main.ts"); // 源码模式入口

25const argv = process.argv.slice(2);

26const event = argv[0];

27const SHELL = process.platform === "win32";

29/** 找 bun：先 PATH，再常见安装位置（官方脚本装到 ~/.bun/bin，npm -g 装到全局 bin）。 */

30function findBun() {

31 // shell 模式用单字符串（避免 Node 的 "args + shell:true" 弃用警告污染 stderr）

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.47 matchedPath = bin/launcher.cjs matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/launcher.cjsView on unpkg

src/install/bun.tsView file

Lines 28-68typescript

28}

30function versionGte(v: string, min: number[]): boolean {

31 const parts =

src/shared/id.tsView file

Lines 1-20typescript

1// 稳定事件 id：基于事件内容派生（而非 hook 进程随机生成），用于幂等去重。

2// 同一语义事件即使被多个 hook 进程采集（如 settings.json + plugin 双注册，

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/shared/id.tsView on unpkg · L1

3// 或他人全局 hook 与本 plugin 并存），只要 sessionId/type/payload 相同，

4// 派生出的 eventId 就相同，store 的 PRIMARY KEY (session_id, event_id) 即可去重。

5// 不含 timestamp——两个采集进程的时间戳差几十 ms，跨秒边界会让派生值错开而漏去重。

6import { createHash } from "node:crypto";

7import

dist/install.cjsView file

Lines 1-11javascript

1#!/usr/bin/env node

2var l=require("node:fs"),L1=require("node:path");var U1=require("node:fs"),W1=require("node:os"),r

ui/components/SettingsModule.tsxView file

•Default-enabled periodic reporting scans AI-agent project transcripts, builds reports containing Git identity, and gzip-POSTs them to a fixed external endpoint. ui/components/SettingsModule.tsx: reportUrl?: string | null; reportIntervalMin?: number | null; setUrl(s.reportUrl ?? ""); setIntervalStr(s.reportIntervalMin != null ? String(s.reportIntervalMin) : ""); reportUrl: url.trim() || null, reportIntervalMin: Number.isFinite(iv) && iv > 0 ? iv : null, setUrl(s.reportUrl ?? ""); setIntervalStr(s.reportIntervalMin != null ? String(s.reportIntervalMin) : ""); skills/report/scripts/zentao.ts: * config [--url U --account A --password P --projects 1,2] [--show] * check / projects [--limit N] / my-tasks [--projects 1,2] [--all-status] * executions [--projects 1,2] / create-task --execution

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

ui/components/SettingsModule.tsxView on unpkg

src/shared/updater.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.47 matchedPath = src/shared/updater.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/updater.tsView on unpkg

src/hook/main.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.3.47 matchedPath = src/hook/main.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.3.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hook/main.tsView on unpkg

Source & flagged code

14 flagged · loading source

bin/launcher.cjsView file

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

1#!/usr/bin/env node L2: // shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。 L3: // Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。 ... L7: // L8: // ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。 L9: // 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。 ... L11: // 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline"); ... L17: L18: const here = __dirname; // .../bin/ L19: const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

Findings

1 Critical11 High4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationui/components/SettingsModule.tsx

HighChild Processbin/launcher.cjs

HighShellsrc/install/bun.ts

HighSame File Env Network Executiondist/install.cjs

HighSandbox Evasion Gated Capabilitybin/launcher.cjs

HighExternal Ai Agent Control Surface Mutationdist/install.cjs

HighRuntime Package Installdist/install.cjs

HighKnown Malware Source Similaritybin/launcher.cjs

HighKnown Malware Source Similaritydist/install.cjs

HighKnown Malware Source Similaritysrc/shared/updater.ts

HighKnown Malware Source Similaritysrc/hook/main.ts

Affected versions and remediation

This report applies to shine-worklog@1.3.48.

See all versions of shine-worklog for other recorded verdicts.

Review the evidence and your use of shine-worklog@1.3.48 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-17 08:29:32.601Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code