{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/v5/deliveries/tmux/tmux-delivery.js",
              "sha256": "0331b83d5b309e526802c58dccf9a56547f0e91ce37b1369da967f95fd043ae0",
              "tlsh": "871221582ab7c2305273d0b2473b510067b590373125cdecf7be87a8af5dd298aa1ea4"
            },
            {
              "path": "dist/v5/backends/codex.js",
              "sha256": "3ad0ca3d916926a3bc88e5d59ed93f542b7a9829fc22ed4064cfc2c6f8a9d20f",
              "tlsh": "f0e1b64d08ffa9a41656a8fd2f0b5012323ba003b088dd50fedddf605f4953855a2fd6"
            }
          ],
          "package_integrity": [
            {
              "filename": "cc2wechat-5.1.0.tgz",
              "hashes": {
                "sha1": "7783bfd3ba23068adbbbc18958d6a6c036b82042",
                "sha512_sri": "sha512-yxsCns85Up2aSi+rkVIEWrasyF4x0N99CyIR4BQ7eqNAoNobP34quWPumtMDDs3ru3azo4NUxZNHuZqOO+RWhg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@aster110/cc2wechat"
      },
      "versions": [
        "5.1.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017064",
        "import_time": "2026-08-07T12:51:24.62225872Z",
        "modified_time": "2026-08-07T12:43:35Z",
        "sha256": "a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac",
        "source": "amazon-inspector",
        "versions": [
          "5.1.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac)\nThe package runs a daemon that long-polls Tencent\u0027s iLink Bot API (ilinkai.weixin.qq.com) for incoming WeChat messages and forwards each message body into a locally hosted AI agent that is spawned with all approval and sandbox gates disabled. Specifically, TmuxDelivery.deliver writes the message text (`sendToSession(sessionName, \"[\u5fae\u4fe1...] \" + ctx.text)`) into a tmux session whose command line is `CC2WECHAT_CONTEXT=... claude --dangerously-skip-permissions`, using tmux `load-buffer` + `paste-buffer` + `send-keys Enter` to submit the input. An alternative backend spawns `codex exec --json --dangerously-bypass-approvals-and-sandbox` and feeds the same WeChat message stream into it. Because these AI CLIs are configured to auto-execute shell commands and filesystem operations without prompts when safety flags are disabled, any party able to send a WeChat message to the linked account can drive arbitrary shell and file operations on the machine running the daemon. The tool is documented in the README as full-host access requiring a disposable VM. The startup entry point is a `bin` CLI (`cc2wechat start`), so the remote-shell surface materializes when the operator launches the daemon rather than on `npm install` or `require()`.\n",
  "id": "MAL-2026-13520",
  "modified": "2026-08-07T12:43:35Z",
  "published": "2026-08-07T12:43:35Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@aster110/cc2wechat/v/5.1.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @aster110/cc2wechat (npm)"
}