@aster110/cc2wechat @5.1.0

Summary

The package runs a daemon that long-polls Tencent's iLink Bot API (ilinkai.weixin.qq.com) for incoming WeChat messages and forwards each message body into a locally hosted AI agent that is spawned with all approval and sandbox gates disabled. Specifically, TmuxDelivery.deliver writes the message text ( sendToSession(sessionName, "[微信...] " + ctx.text) ) into a tmux session whose command line is CC2WECHAT_CONTEXT=... claude --dangerously-skip-permissions , using tmux load-buffer + paste-buffer + send-keys Enter to submit the input. An alternative backend spawns codex exec --json --dangerously-bypass-approvals-and-sandbox and feeds the same WeChat message stream into it. Because these AI CLIs are configured to auto-execute shell commands and filesystem operations without prompts when safety flags are disabled, any party able to send a WeChat message to the linked account can drive arbitrary shell and file operations on the machine running the daemon. The tool is documented in the README as full-host access requiring a disposable VM. The startup entry point is a bin CLI ( cc2wechat start ), so the remote-shell surface materializes when the operator launches the daemon rather than on npm install or require() .

Source: amazon-inspector (a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac)