shine-worklog@1.4.9

Claude Code Hook -> 本地常驻 Daemon 的状态/持久化底座

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a concrete automatic agent-extension update and configuration-mutation path. It is not a registry install lifecycle hook or confirmed credential theft, so the evidence supports a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Daemon startup or a subsequent enabled update check discovers a newer registry version.

Impact

A newer registry release can replace the active agent extension without a fresh user command, expanding the impact of a compromised future release.

Mechanism

The updater spawns detached npx with shine-worklog@latest and the install command; installation deploys the release and writes Claude plugin registration settings.

AI rationale

Evidence

src/shared/updater.tssrc/daemon/server.tssrc/install/main.tssrc/install/register.ts

Network endpoints1

registry.npmjs.org/

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The daemon checks for updates at startup and every minute, with automatic updates enabled unless a setting disables them.
When an update is found, it silently launches npx to obtain the latest shine-worklog release and run its install command.
The install command registers and enables the package as a user-scoped Claude plugin by modifying plugin configuration files.

Evidence against

package.json has only a prepublishOnly script, so registry installation does not automatically run a lifecycle hook.
Report uploads require a configured report URL; the default URL is empty.
The inspected network update endpoint is the npm registry for this package.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

17 flagged

bin/launcher.cjsView file

Lines 1-52javascript

1#!/usr/bin/env node

2// shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。

3// Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。

4// 优先 spawn 同目录 bin/<plat>-<arch>/hook[.exe]（二进制模式，本机 build 产物）；

5// 不存在则 bun run src/hook/main.ts（源码模式）。源码模式需要 Bun——若没装，首次自动安装

6// （npm i -g bun → 失败回退官方脚本）。退出码恒 0——绝不影响 Claude Code 主进程。

7//

8// ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。

9// 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。

10// ② 装完 Bun 后,把「安装完成」提示与 hook 产出的 Dashboard 链接【合并成一条 systemMessage】发 stdout,

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。

12const { spawn, spawnSync } = require("node:child_process");

13const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

14const { existsSync, mkdirSync, appendFileSync } = require("node:fs");

15const { join } = require("node:path");

16const { homedir } = require("node:os");

18const here = __dirname; // .../bin/

19const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

20const arch = process.arch; // x64 | arm64

21const ext = process.platform === "win32" ? ".exe" : "";

22const hookBin = join(here, `${plat}-${arch}`, `hook${ext}`);

23const hookSrc = join(here, "..", "src", "hook", "main.ts"); // 源码模式入口

25const argv = process.argv.slice(2);

26const event = argv[0];

27const SHELL = process.platform === "win32";

29/** 找 bun：先 PATH，再常见安装位置（官方脚本装到 ~/.bun/bin，npm -g 装到全局 bin）。 */

30function findBun() {

31 // shell 模式用单字符串（避免 Node 的 "args + shell:true" 弃用警告污染 stderr）

32 const r = SHELL

33 ? spawnSync("bun --version", { shell: true, encoding: "utf8" })

34 : spawnSync("bun", ["--version"], { encoding: "utf8" });

High

Shell

Package source references shell execution.

bin/launcher.cjsView on unpkg · L32

35 if (r.status === 0 && (r.stdout || "").trim()) return "bun";

36 const home = homedir();

37 const cands = process.platform === "win32"

38 ? [join(home, ".bun", "bin", "bun.exe"), join(home, ".bun", "bin", "bun")]

39 : [join(home, ".bun", "bin", "bun"), "/usr/local/bin/bun", "/opt/homebrew/bin/bun"];

40 for (const c of cands) if (existsSync(c)) return c;

41 return null;

42}

44/** 日志文件路径（创建目录）。安装过程逐行写这里，可 `tail -f` 看实时进度。 */

45function logFile() {

46 // 对齐 src/shared/paths.ts 的 DATA_DIR：Win=%LOCALAPPDATA%/shine-worklog，mac/linux=~/.local/share/shine-worklog

47 const base = process.platform === "win32"

48 ? join(process.env.LOCALAPPDATA || homedir(), "shine-worklog")

49 : join(homedir(), ".local", "share", "shine-worklog");

50 const dir = join(base, "log");

51 try { mkdirSync(dir, { recursive: true }); } catch {}

52 return join(dir, "bun-install.log");

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = bin/launcher.cjs matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/launcher.cjsView on unpkg

src/shared/id.tsView file

Lines 1-20typescript

1// 稳定事件 id：基于事件内容派生（而非 hook 进程随机生成），用于幂等去重。

2// 同一语义事件即使被多个 hook 进程采集（如 settings.json + plugin 双注册，

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/shared/id.tsView on unpkg · L1

3// 或他人全局 hook 与本 plugin 并存），只要 sessionId/type/payload 相同，

4// 派生出的 eventId 就相同，store 的 PRIMARY KEY (session_id, event_id) 即可去重。

5// 不含 timestamp——两个采集进程的时间戳差几十 ms，跨秒边界会让派生值错开而漏去重。

6import { createHash } from "node:crypto";

7import

dist/install.cjsView file

Lines 1-11javascript

1#!/usr/bin/env node

2var c=require("node:fs"),L1=require("node:path");var U1=require("node:fs"),W1=require("node:os"),o

src/daemon/ui-assets.tsView file

•Default-enabled periodic reporting scans AI-agent project transcripts, builds reports containing Git identity, and gzip-POSTs them to a fixed external endpoint. src/daemon/ui-assets.ts: export const APP_JS = "var oq0=Object.create;var{getPrototypeOf:nq0,defineProperty:wI,getOwnPropertyNames:tq0}=Object;var eq0=Object.prototype.hasOwnProperty;function JG0(J){return... [redacted].ts: import { readFileSync } from "node:fs"; const pid = JSON.parse(readFileSync(path.join(DATA_DIR, "daemon.pid"), "utf8")); const t = readFileSync(path.join(DATA_DIR, "daemon.token"), "utf8").trim(); /** daemon ProjectSession → shine-worklog session(字段映射见合并方案 2.1)。 */ /** 解析 Claude transcript jsonl 成结构化信号(逐行 parse:user prompts + assistant texts + tool_use 的 files/行数/计数)。 * 定位 ~/.claude/projects/<encodeProject(cwd)

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/daemon/ui-assets.tsView on unpkg

src/shared/updater.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/shared/updater.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/updater.tsView on unpkg

src/hook/main.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/hook/main.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hook/main.tsView on unpkg

src/install/bun.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/install/bun.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install/bun.tsView on unpkg

src/shared/daemonctl.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/shared/daemonctl.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/daemonctl.tsView on unpkg

src/cli/main.test.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/cli/main.test.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli/main.test.tsView on unpkg

src/install/main.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/install/main.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install/main.tsView on unpkg

src/cli/main.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/cli/main.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli/main.tsView on unpkg

Source & flagged code

17 flagged · loading source

bin/launcher.cjsView file

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

32const r = SHELL L33: ? spawnSync("bun --version", { shell: true, encoding: "utf8" }) L34: : spawnSync("bun", ["--version"], { encoding: "utf8" });

High

Shell

Package source references shell execution.

bin/launcher.cjsView on unpkg · L32

1#!/usr/bin/env node L2: // shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。 L3: // Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。 ... L7: // L8: // ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。 L9: // 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。 ... L11: // 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline"); ... L17: L18: const here = __dirname; // .../bin/ L19: const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Findings

2 Critical14 High3 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationsrc/daemon/ui-assets.ts

CriticalPrevious Version Dangerous Deltadist/install.cjs

HighChild Processbin/launcher.cjs

HighShellbin/launcher.cjs

HighSame File Env Network Executiondist/install.cjs

HighSandbox Evasion Gated Capabilitybin/launcher.cjs

HighExternal Ai Agent Control Surface Mutationdist/install.cjs

HighRuntime Package Installdist/install.cjs

HighKnown Malware Source Similaritybin/launcher.cjs

HighKnown Malware Source Similaritysrc/shared/updater.ts

HighKnown Malware Source Similaritysrc/hook/main.ts

Affected versions and remediation

This report applies to shine-worklog@1.4.9.

See all versions of shine-worklog for other recorded verdicts.

Review the evidence and your use of shine-worklog@1.4.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 08:49:11.124Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code