@aster110/cc2wechat

{"modified":"2026-08-07T12:43:35Z","published":"2026-08-07T12:43:35Z","schema_version":"1.7.4","id":"MAL-2026-13520","summary":"Malicious code in @aster110/cc2wechat (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac)\nThe package runs a daemon that long-polls Tencent's iLink Bot API (ilinkai.weixin.qq.com) for incoming WeChat messages and forwards each message body into a locally hosted AI agent that is spawned with all approval and sandbox gates disabled. Specifically, TmuxDelivery.deliver writes the message text (`sendToSession(sessionName, \"[微信...] \" + ctx.text)`) into a tmux session whose command line is `CC2WECHAT_CONTEXT=... claude --dangerously-skip-permissions`, using tmux `load-buffer` + `paste-buffer` + `send-keys Enter` to submit the input. An alternative backend spawns `codex exec --json --dangerously-bypass-approvals-and-sandbox` and feeds the same WeChat message stream into it. Because these AI CLIs are configured to auto-execute shell commands and filesystem operations without prompts when safety flags are disabled, any party able to send a WeChat message to the linked account can drive arbitrary shell and file operations on the machine running the daemon. The tool is documented in the README as full-host access requiring a disposable VM. The startup entry point is a `bin` CLI (`cc2wechat start`), so the remote-shell surface materializes when the operator launches the daemon rather than on `npm install` or `require()`.\n","affected":[{"package":{"ecosystem":"npm","name":"@aster110/cc2wechat"},"versions":["5.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/v5/deliveries/tmux/tmux-delivery.js","sha256":"0331b83d5b309e526802c58dccf9a56547f0e91ce37b1369da967f95fd043ae0","tlsh":"871221582ab7c2305273d0b2473b510067b590373125cdecf7be87a8af5dd298aa1ea4"},{"path":"dist/v5/backends/codex.js","sha256":"3ad0ca3d916926a3bc88e5d59ed93f542b7a9829fc22ed4064cfc2c6f8a9d20f","tlsh":"f0e1b64d08ffa9a41656a8fd2f0b5012323ba003b088dd50fedddf605f4953855a2fd6"}],"package_integrity":[{"filename":"cc2wechat-5.1.0.tgz","hashes":{"sha1":"7783bfd3ba23068adbbbc18958d6a6c036b82042","sha512_sri":"sha512-yxsCns85Up2aSi+rkVIEWrasyF4x0N99CyIR4BQ7eqNAoNobP34quWPumtMDDs3ru3azo4NUxZNHuZqOO+RWhg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@aster110/cc2wechat/v/5.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017064","import_time":"2026-08-07T12:51:24.62225872Z","modified_time":"2026-08-07T12:43:35Z","sha256":"a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac","source":"amazon-inspector","versions":["5.1.0"]}]}}