shine-worklog@1.5.0

Claude Code Hook -> 本地常驻 Daemon 的状态/持久化底座

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source confirms a user-invoked, first-party Claude extension with persistent hooks, local collection, silent self-update, and a LAN-bound service. These are risky capabilities but do not establish malicious install-time behavior or confirmed data theft.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User runs shine-worklog install; later Claude Code hook events and daemon update checks activate it.

Impact

Future registry content can be deployed without a new interactive install; captured worklog data may be exposed if its dashboard token leaks on the LAN.

Mechanism

Claude hook persistence, local event collection, and silent self-update.

AI rationale

Evidence

package.jsonhooks/hooks.jsonbin/launcher.cjssrc/install/main.tssrc/install/register.tssrc/hook/main.tssrc/shared/updater.tssrc/shared/config.ts

Network endpoints4

registry.npmjs.org/shine-worklog/latestregistry.npmjs.org/bun.sh/install127.0.0.1:36666

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

User-run installer deploys, registers, and enables a Claude Code plugin.
Enabled hooks collect Claude event stdin, spool it locally, and forward it to a daemon.
Daemon auto-update fetches npm metadata and silently invokes npx to install latest code.
Daemon listens on all interfaces by default, exposing its dashboard on the LAN.
Hook runtime bootstrap can run Bun's remote curl-to-shell installer.

Evidence against

package.json has no preinstall, install, or postinstall hook; its only lifecycle script is prepublishOnly.
Plugin configuration changes occur in the explicit install command.
Observed hook forwarding targets local 127.0.0.1, not a package-controlled collector.
No hard-coded third-party credential-exfiltration endpoint was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

16 flagged

bin/launcher.cjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。

3// Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。

4// 优先 spawn 同目录 bin/<plat>-<arch>/hook[.exe]（二进制模式，本机 build 产物）；

5// 不存在则 bun run src/hook/main.ts（源码模式）。源码模式需要 Bun——若没装，首次自动安装

6// （npm i -g bun → 失败回退官方脚本）。退出码恒 0——绝不影响 Claude Code 主进程。

7//

8// ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。

9// 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。

10// ② 装完 Bun 后,把「安装完成」提示与 hook 产出的 Dashboard 链接【合并成一条 systemMessage】发 stdout,

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。

12const { spawn, spawnSync } = require("node:child_process");

13const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/launcher.cjsView on unpkg · L11

14const { existsSync, mkdirSync, appendFileSync } = require("node:fs");

15const { join } = require("node:path");

16const { homedir } = require("node:os");

18const here = __dirname; // .../bin/

19const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

20const arch = process.arch; // x64 | arm64

21const ext = process.platform === "win32" ? ".exe" : "";

22const hookBin = join(here, `${plat}-${arch}`, `hook${ext}`);

23const hookSrc = join(here, "..", "src", "hook", "main.ts"); // 源码模式入口

25const argv = process.argv.slice(2);

26const event = argv[0];

27const SHELL = process.platform === "win32";

29/** 找 bun：先 PATH，再常见安装位置（官方脚本装到 ~/.bun/bin，npm -g 装到全局 bin）。 */

30function findBun() {

31 // shell 模式用单字符串（避免 Node 的 "args + shell:true" 弃用警告污染 stderr）

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = bin/launcher.cjs matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/launcher.cjsView on unpkg

src/install/bun.tsView file

Lines 28-68typescript

28}

30function versionGte(v: string, min: number[]): boolean {

31 const parts =

src/shared/id.tsView file

Lines 1-20typescript

1// 稳定事件 id：基于事件内容派生（而非 hook 进程随机生成），用于幂等去重。

2// 同一语义事件即使被多个 hook 进程采集（如 settings.json + plugin 双注册，

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/shared/id.tsView on unpkg · L1

3// 或他人全局 hook 与本 plugin 并存），只要 sessionId/type/payload 相同，

4// 派生出的 eventId 就相同，store 的 PRIMARY KEY (session_id, event_id) 即可去重。

5// 不含 timestamp——两个采集进程的时间戳差几十 ms，跨秒边界会让派生值错开而漏去重。

6import { createHash } from "node:crypto";

7import

dist/install.cjsView file

Lines 1-12javascript

1#!/usr/bin/env node

2var d=require("node:fs"),R1=require("node:path");var W1=require("node:fs"),J1=require("node:os"),t

ui/components/SettingsModule.tsxView file

•Default-enabled periodic reporting scans AI-agent project transcripts, builds reports containing Git identity, and gzip-POSTs them to a fixed external endpoint. ui/components/SettingsModule.tsx: reportUrl?: string | null; reportIntervalMin?: number | null; setUrl(s.reportUrl ?? ""); setIntervalStr(s.reportIntervalMin != null ? String(s.reportIntervalMin) : ""); reportUrl: url.trim() || null, reportIntervalMin: Number.isFinite(iv) && iv > 0 ? iv : null, setUrl(s.reportUrl ?? ""); setIntervalStr(s.reportIntervalMin != null ? String(s.reportIntervalMin) : ""); skills/report/scripts/zentao.ts: * config [--url U --account A --password P --projects 1,2] [--show] * check / projects [--limit N] / my-tasks [--projects 1,2] [--all-status] * executions [--projects 1,2] / create-task --execution

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

ui/components/SettingsModule.tsxView on unpkg

src/shared/updater.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/shared/updater.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/updater.tsView on unpkg

src/cli/main.test.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/cli/main.test.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli/main.test.tsView on unpkg

skills/report/scripts/lib/transcript.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = shine-worklog@1.4.11 matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.11 similarity = 0.981 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/report/scripts/lib/transcript.tsView on unpkg

Source & flagged code

16 flagged · loading source

bin/launcher.cjsView file

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

1#!/usr/bin/env node L2: // shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。 L3: // Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。 ... L7: // L8: // ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。 L9: // 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。 ... L11: // 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline"); ... L17: L18: const here = __dirname; // .../bin/ L19: const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

Findings

2 Critical12 High4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationui/components/SettingsModule.tsx

CriticalPrevious Version Dangerous Deltaskills/report/scripts/lib/transcript.ts

HighChild Processbin/launcher.cjs

HighShellsrc/install/bun.ts

HighSame File Env Network Executiondist/install.cjs

HighCommand Output Exfiltrationdist/install.cjs

HighSandbox Evasion Gated Capabilitybin/launcher.cjs

HighExternal Ai Agent Control Surface Mutationdist/install.cjs

HighTrigger Reachable Command Output Exfiltrationdist/install.cjs

HighRuntime Package Installdist/install.cjs

HighKnown Malware Source Similaritybin/launcher.cjs

Affected versions and remediation

This report applies to shine-worklog@1.5.0.

See all versions of shine-worklog for other recorded verdicts.

Review the evidence and your use of shine-worklog@1.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 13:19:55.343Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code