
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
用微信控制 Claude Code。扫码即用,不需要 OpenClaw。
微信 → 腾讯 iLink API → MCP Server (long-poll) → Claude Code
← sendMessage ← reply tool
底层直接调用腾讯的 iLink Bot API,不依赖 OpenClaw。
npx cc-wechat@latest install
这会:
Claude Code 的 Channels 功能受服务端灰度控制,部分用户需要 patch 才能使用:
npx cc-channel-patch@latest
.patched 文件,按提示手动替换即可npx cc-channel-patch unpatchclaude --dangerously-load-development-channels server:wechat-channel
npm i -g cc-wechat
claude mcp add -s user wechat-channel node $(which cc-wechat-server)
npx cc-wechat login
claude --dangerously-load-development-channels server:wechat-channel
登录后,在微信里发消息,Claude Code 会实时收到并处理。Claude 通过 reply 工具回复,消息会出现在你的微信对话里。
支持发送图片、视频和文件(通过 reply 工具的 media 参数)。
npx cc-wechat login
如果已经在 Claude Code 中,直接用 login 工具扫码。
不需要微信 Channel,只想启用 Channels 功能(用于 Telegram/Discord 等其他 Channel 插件):
npx cc-channel-patch@latest
这是一个独立的 npm 包,零依赖,一行命令。补丁内容:
| 补丁点 | 说明 |
|---|---|
| tengu_harbor feature flag | 绕过 Anthropic 的灰度开关 |
| Channel gate auth | 跳过 accessToken 认证检查(代理用户需要) |
| UI notice | 消除 "Channels are not currently available" 提示 |
CC 更新后可能需要重新 patch。
直接调用腾讯的 iLink Bot API(7 个 HTTP 接口):
| API | 功能 |
|---|---|
| get_bot_qrcode | 获取登录二维码 |
| get_qrcode_status | 轮询扫码状态 |
| getupdates | 长轮询收消息(35s 超时) |
| sendmessage | 发送消息 |
| sendtyping | 打字状态指示 |
| getconfig | 获取 typing ticket |
| getuploadurl | 获取 CDN 上传签名(媒体发送) |
~/.claude/channels/wechat/
├── account.json # 登录凭证
└── sync-buf.txt # 消息同步游标
MIT
FAQs
WeChat channel for Claude Code via iLink Bot API
The npm package cc-wechat receives a total of 105 weekly downloads. As such, cc-wechat popularity was classified as not popular.
We found that cc-wechat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.