Malicious code in @aster110/cc2wechat (npm)

The @aster110/cc2wechat npm package contains intentionally malicious code designed to create a remote command execution vector. The package runs a daemon that continuously polls Tencent's iLink Bot API (ilinkai.weixin.qq.com) for incoming WeChat messages directed at a linked account.\n\nIncoming message text is forwarded directly into locally-hosted AI agent CLIs—either Claude or Codex—that are explicitly configured with safety and sandbox restrictions disabled (--dangerously-skip-permissions and --dangerously-bypass-approvals-and-sandbox). The messages are injected via tmux session manipulation using load-buffer, paste-buffer, and send-keys commands.\n\nBecause these AI CLIs are configured to auto-execute shell commands and filesystem operations without user prompts when safety flags are disabled, any party able to send a WeChat message to the linked account can drive arbitrary shell and file operations on the host machine. The malicious surface materializes when the operator launches the daemon via the cc2wechat start CLI command, not during package installation or require().\n\nThe package documentation acknowledges the full-host access risk and recommends running it only in a disposable VM. The incident was identified by the OpenSSF malicious-packages project.