shine-worklog@1.7.0

Claude Code Hook -> 本地常驻 Daemon 的状态/持久化底座

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a real, high-impact agent-extension capability with persistence and silent runtime updates, but activation begins with an explicit installer rather than an npm install lifecycle hook. Source inspection found no default external data receiver or concrete malicious payload.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The user runs the install command, then starts or resumes a Claude Code session.

Impact

The package gains ongoing access to Claude session and tool-event data, executes its hook on future sessions, and exposes a token-gated service on the local network.

Mechanism

Claude plugin registration, hook-based collection, daemon persistence, and silent latest-version installation.

AI rationale

Evidence

src/install/main.tssrc/install/register.tssrc/hook/main.tssrc/shared/updater.tssrc/shared/config.tshooks/hooks.json

Network endpoints3

registry.npmjs.org/0.0.0.0:36666127.0.0.1:36666

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit install command deploys and enables a Claude Code plugin in the user configuration.
The plugin registers hooks for session and tool events, then stores captured event data locally.
The resident daemon silently fetches and installs the latest package release by default.
The daemon listens on all interfaces by default, exposing its local dashboard and health service to the LAN.

Evidence against

package.json has no npm preinstall, install, or postinstall hook.
No package-controlled data receiver is configured by default: reportUrl defaults to null and uploads return without a URL.
The observed network calls are to the npm registry, localhost, or a user-configured report or ZenTao server.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

15 flagged

bin/launcher.cjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。

3// Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。

4// 优先 spawn 同目录 bin/<plat>-<arch>/hook[.exe]（二进制模式，本机 build 产物）；

5// 不存在则 bun run src/hook/main.ts（源码模式）。源码模式需要 Bun——若没装，首次自动安装

6// （npm i -g bun → 失败回退官方脚本）。退出码恒 0——绝不影响 Claude Code 主进程。

7//

8// ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。

9// 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。

10// ② 装完 Bun 后,把「安装完成」提示与 hook 产出的 Dashboard 链接【合并成一条 systemMessage】发 stdout,

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。

12const { spawn, spawnSync } = require("node:child_process");

13const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

14const { existsSync, mkdirSync, appendFileSync } = require("node:fs");

15const { join } = require("node:path");

16const { homedir } = require("node:os");

18const here = __dirname; // .../bin/

19const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

20const arch = process.arch; // x64 | arm64

21const ext = process.platform === "win32" ? ".exe" : "";

22const hookBin = join(here, `${plat}-${arch}`, `hook${ext}`);

23const hookSrc = join(here, "..", "src", "hook", "main.ts"); // 源码模式入口

25const argv = process.argv.slice(2);

26const event = argv[0];

27const SHELL = process.platform === "win32";

29/** 找 bun：先 PATH，再常见安装位置（官方脚本装到 ~/.bun/bin，npm -g 装到全局 bin）。 */

30function findBun() {

31 // shell 模式用单字符串（避免 Node 的 "args + shell:true" 弃用警告污染 stderr）

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = bin/launcher.cjs matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/launcher.cjsView on unpkg

src/install/bun.tsView file

Lines 28-68typescript

28}

30function versionGte(v: string, min: number[]): boolean {

31 const parts =

src/shared/id.tsView file

Lines 1-20typescript

1// 稳定事件 id：基于事件内容派生（而非 hook 进程随机生成），用于幂等去重。

2// 同一语义事件即使被多个 hook 进程采集（如 settings.json + plugin 双注册，

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/shared/id.tsView on unpkg · L1

3// 或他人全局 hook 与本 plugin 并存），只要 sessionId/type/payload 相同，

4// 派生出的 eventId 就相同，store 的 PRIMARY KEY (session_id, event_id) 即可去重。

5// 不含 timestamp——两个采集进程的时间戳差几十 ms，跨秒边界会让派生值错开而漏去重。

6import { createHash } from "node:crypto";

7import

dist/install.cjsView file

Lines 1-12javascript

1#!/usr/bin/env node

2var d=require("node:fs"),R1=require("node:path");var W1=require("node:fs"),J1=require("node:os"),t

src/daemon/ui-assets.tsView file

•Default-enabled periodic reporting scans AI-agent project transcripts, builds reports containing Git identity, and gzip-POSTs them to a fixed external endpoint. src/daemon/ui-assets.ts: export const APP_JS = "var oq0=Object.create;var{getPrototypeOf:nq0,defineProperty:wI,getOwnPropertyNames:tq0}=Object;var eq0=Object.prototype.hasOwnProperty;function JG0(J){return... [redacted].ts: import { existsSync, readFileSync, readdirSync } from "node:fs"; const pid = JSON.parse(readFileSync(path.join(DATA_DIR, "daemon.pid"), "utf8")); const t = readFileSync(path.join(DATA_DIR, "daemon.token"), "utf8").trim(); /** daemon ProjectSession → shine-worklog session(字段映射见合并方案 2.1)。 */ /** 解析 Claude transcript jsonl 成结构化信号(逐行 parse:user prompts + assistant texts + tool_use 的 files/行数/计数)。 * 定位 ~/.claude/pro

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/daemon/ui-assets.tsView on unpkg

src/shared/updater.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/shared/updater.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/shared/updater.tsView on unpkg

src/cli/main.test.tsView file

•matchType = normalized_sha256 matchedPackage = shine-worklog@1.4.1 matchedPath = src/cli/main.test.ts matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli/main.test.tsView on unpkg

skills/report/scripts/lib/transcript.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = shine-worklog@1.6.1 matchedIdentity = npm:c2hpbmUtd29ya2xvZw:1.6.1 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/report/scripts/lib/transcript.tsView on unpkg

Source & flagged code

15 flagged · loading source

bin/launcher.cjsView file

11// 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline");

High

Child Process

Package source references child process execution.

bin/launcher.cjsView on unpkg · L11

1#!/usr/bin/env node L2: // shine-worklog hook 平台分发器（.cjs 强制 CommonJS，兼容所有 node，不依赖 package.json）。 L3: // Claude Code 经 hooks.json 以 `node launcher.cjs <Event>` 调用（exec form，不经 shell）。 ... L7: // L8: // ⚠️ Claude Code 的 SessionStart hook 把 stdout 当【单个 JSON 对象】解析（提取 systemMessage 展示）。 L9: // 所以:① 进度/提示绝不能写 stdout(混入纯文本会让整个 stdout JSON 解析失败、链接也不显示)——走 stderr + 日志。 ... L11: // 确保交互式 claude 里一定能看到(systemMessage 字段已被验证会显示)。 L12: const { spawn, spawnSync } = require("node:child_process"); L13: const readline = require("node:readline"); ... L17: L18: const here = __dirname; // .../bin/ L19: const plat = process.platform === "win32" ? "windows" : process.platform; // darwin | linux | windows

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/launcher.cjsView on unpkg · L1

Findings

2 Critical12 High3 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationsrc/daemon/ui-assets.ts

CriticalPrevious Version Dangerous Deltaskills/report/scripts/lib/transcript.ts

HighChild Processbin/launcher.cjs

HighShellsrc/install/bun.ts

HighSame File Env Network Executiondist/install.cjs

HighCommand Output Exfiltrationdist/install.cjs

HighSandbox Evasion Gated Capabilitybin/launcher.cjs

HighExternal Ai Agent Control Surface Mutationdist/install.cjs

HighTrigger Reachable Command Output Exfiltrationdist/install.cjs

HighRuntime Package Installdist/install.cjs

HighKnown Malware Source Similaritybin/launcher.cjs

Affected versions and remediation

This report applies to shine-worklog@1.7.0.

See all versions of shine-worklog for other recorded verdicts.

Review the evidence and your use of shine-worklog@1.7.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 09:13:04.017Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code