
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@probelabs/afk
Advanced tools
Your code doesn't stop when you leave your desk. Get Telegram notifications for Claude Code actions and approve them from anywhere. No cloud dependencies, no third-party servers.
3 commands, 2 minutes, full mobile control:
# 1. Install and setup
npm install -g @probelabs/afk
afk setup # Creates your Telegram bot
# 2. Go remote
afk # Smart toggle: installs hooks and enables remote mode
That's it! Claude Code now sends approval requests to your phone. 📱
📱 Mobile Development Freedom
🔐 Privacy First
🚀 Smart Integration
afk # Smart toggle: install if needed, then toggle mode
afk on # Enable remote approvals
afk off # Disable remote approvals
afk status # Check current mode
afk setup # Interactive Telegram bot setup
afk install # Install Claude Code hooks
afk uninstall # Remove hooks
afk telegram test # Test Telegram connection
afk debug on # Enable debug logging
1. Hook Integration AFK hooks into Claude Code at key decision points:
2. Smart Permissions
Read and Grep3. Mobile Approval Flow
Claude wants to edit file.js
↓
AFK checks: Local or Remote mode?
↓
Sends Telegram notification with context
↓
You tap: [Approve] [Deny] [Allow All] [Ask Claude UI]
↓
Claude proceeds or stops based on your choice
4. Session Management
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ │ │ │ │ │
│ Claude Code │────────▶│ AFK Hooks │────────▶│ Telegram API │
│ │ │ │ │ │
│ • PreToolUse │ │ • Intercepts │ │ • Distributed │
│ • SessionStart │ │ • Routes msgs │ │ polling │
│ • Stop events │◀────────│ • Manages state │◀────────│ • Button handling│
│ • Notifications │ │ │ │ │
└──────────────────┘ └──────────────────┘ └──────────────────┘
▲ │
│ │
│ ▼
│ ┌──────────────────┐
│ │ │
└────────────────────│ Local State │
│ │
│ • ~/.afk │
│ • Mode (on/off) │
│ • Session map │
│ • Approvals │
└──────────────────┘
PreToolUse Hook - Gates tool execution:
SessionStart Hook - New session notifications:
Stop Hook - Task completion handling:
Run afk setup for interactive configuration. The wizard:
~/.afk/config.jsonConfig file:
{
"telegram_bot_token": "YOUR_BOT_TOKEN",
"telegram_chat_id": "YOUR_CHAT_ID",
"timeout_seconds": 3600,
"intercept_matcher": "Bash|Edit|Write|MultiEdit|WebFetch|mcp__.*",
"auto_approve_tools": ["Read"]
}
| Option | Description | Default | Options |
|---|---|---|---|
timeout_seconds | Approval timeout | 3600 (1 hour) | Any positive number, 0 for infinite |
intercept_matcher | Tools to intercept | "Bash|Edit|Write|MultiEdit|WebFetch|mcp__.*" | Regex pattern |
auto_approve_tools | Always allow these | ["Read"] | Array of tool names |
Note: Additional options like timeout_action and respect_claude_permissions can be added manually to the config file if needed.
export TELEGRAM_BOT_TOKEN="your_token" # Alternative to config file
export TELEGRAM_CHAT_ID="your_chat_id" # Alternative to config file
export CC_REMOTE_STOP_TIMEOUT=21600 # Stop event timeout (6 hours)
Permission Flow:
Smart Patterns: When you tap [Allow All], AFK creates permanent rules like:
Bash(npm test:*) - Allow all npm test commandsEdit(/src/*) - Allow edits to source filesWebFetch(domain:api.github.com) - Allow GitHub API callsPatterns are automatically generated based on context:
// Bash commands → command prefix patterns
"Bash(npm run:*)" // All npm run scripts
"Bash(git:*)" // All git commands
"Bash(curl:*)" // All curl requests
// Web requests → domain patterns
"WebFetch(domain:api.example.com)" // Specific API
"WebFetch(domain:*.example.com)" // Subdomains
// File operations → path patterns
"Edit(/src/*)" // All files in src/
"Write(/tests/*)" // All test files
"MultiEdit(/config/*)" // Multi-file edits in config/
Each Telegram message includes:
Example message:
[my-project] [sess-a1b2]
Claude requests: Edit server.js
[Approve] [Deny] [Allow All] [Ask Claude UI]
No Telegram messages?
afk status # Check if remote mode is enabled
afk telegram test # Test connection
Buttons not working?
Control what happens when approvals timeout:
{
"timeout_seconds": 3600, // 1 hour
"timeout_action": "deny" // Auto-deny on timeout
}
Timeout Actions:
"deny": Safe default, blocks operation"allow": Convenient but less secure"wait": Never timeout, wait indefinitelyEnable interactive follow-ups after Claude finishes:
# In your Stop hook configuration, AFK automatically waits for user input
# Users can then reply with follow-up instructions or tap [Continue]
# Global (all projects)
afk install --scope user
# Project-specific
afk install --scope project
# Local development
afk install --scope local
Requirements: Node.js ≥ 18, Claude Code, Telegram account
npm install -g @probelabs/afk
git clone https://github.com/probelabs/afk.git
cd afk
npm link # Creates global symlink
MIT License - Part of the Probe Labs ecosystem
📖 Documentation • 🐛 Issues • 💬 Discussions
FAQs
Remote control and approval system for Claude Code via Telegram
We found that @probelabs/afk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.