MAL-2026-13520

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@aster110/cc2wechat/MAL-2026-13520.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13520
Published
2026-08-07T12:43:35Z
Modified
2026-08-07T13:20:11.004024128Z
Summary
Malicious code in @aster110/cc2wechat (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac)

The package runs a daemon that long-polls Tencent's iLink Bot API (ilinkai.weixin.qq.com) for incoming WeChat messages and forwards each message body into a locally hosted AI agent that is spawned with all approval and sandbox gates disabled. Specifically, TmuxDelivery.deliver writes the message text (sendToSession(sessionName, "[微信...] " + ctx.text)) into a tmux session whose command line is CC2WECHAT_CONTEXT=... claude --dangerously-skip-permissions, using tmux load-buffer + paste-buffer + send-keys Enter to submit the input. An alternative backend spawns codex exec --json --dangerously-bypass-approvals-and-sandbox and feeds the same WeChat message stream into it. Because these AI CLIs are configured to auto-execute shell commands and filesystem operations without prompts when safety flags are disabled, any party able to send a WeChat message to the linked account can drive arbitrary shell and file operations on the machine running the daemon. The tool is documented in the README as full-host access requiring a disposable VM. The startup entry point is a bin CLI (cc2wechat start), so the remote-shell surface materializes when the operator launches the daemon rather than on npm install or require().

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017064",
            "import_time": "2026-08-07T12:51:24.62225872Z",
            "sha256": "a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac",
            "modified_time": "2026-08-07T12:43:35Z",
            "versions": [
                "5.1.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @aster110/cc2wechat

Package

Name
@aster110/cc2wechat
View open source insights on deps.dev
Purl
pkg:npm/%40aster110/cc2wechat

Affected ranges

Affected versions

5.*
5.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-yxsCns85Up2aSi+rkVIEWrasyF4x0N99CyIR4BQ7eqNAoNobP34quWPumtMDDs3ru3azo4NUxZNHuZqOO+RWhg==",
                "sha1": "7783bfd3ba23068adbbbc18958d6a6c036b82042"
            },
            "filename": "cc2wechat-5.1.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/v5/deliveries/tmux/tmux-delivery.js",
            "sha256": "0331b83d5b309e526802c58dccf9a56547f0e91ce37b1369da967f95fd043ae0",
            "tlsh": "871221582ab7c2305273d0b2473b510067b590373125cdecf7be87a8af5dd298aa1ea4"
        },
        {
            "sha256": "3ad0ca3d916926a3bc88e5d59ed93f542b7a9829fc22ed4064cfc2c6f8a9d20f",
            "path": "dist/v5/backends/codex.js",
            "tlsh": "f0e1b64d08ffa9a41656a8fd2f0b5012323ba003b088dd50fedddf605f4953855a2fd6"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@aster110/cc2wechat/MAL-2026-13520.json"