Loading npm security reports…

@1key4ai/cc-bridge@1.8.19: AI-agent policy block | LPM Firewall

registry / @1key4ai/cc-bridge / 1.8.19

@1key4ai/cc-bridge@1.8.19

1K4 Claude Code Bridge — one install, every tool. Plan review, advisors, brainstorm, and the Studio Lab bridge.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Starting the MCP bridge mutates Claude Code control surfaces by installing a slash command and UserPromptSubmit hook. The hook injects higher-priority directives that force model behavior for /quorum prompts.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User or MCP client runs cc-bridge start/bin entrypoint

Impact

Persistent alteration of Claude Code prompt handling and tool-routing behavior toward the package's hosted service

Mechanism

unconsented AI-agent hook and slash-command installation

Policy narrative

When the package is run as the MCP bridge, it does not only start a server. It installs a Claude slash command and registers a UserPromptSubmit hook that emits harness-level instructions telling the agent there is no judgment call and requiring specific 1K4 tool invocations. This persists in the user's Claude configuration and changes future agent behavior.

Rationale

Source inspection confirms automatic runtime writes to Claude Code hook/command configuration plus prompt-control directives, which is an unconsented AI-agent control-surface mutation. Other risky primitives such as fetch, WebSocket, project snapshot upload, and config writes are mostly package-aligned, but the startup hook persistence is sufficient to block.

Evidence

dist/index.jstemplates/quorum-enforcement.shtemplates/quorum.mdpackage.json~/.claude/commands/quorum.md~/.claude/hooks/quorum-enforcement.sh~/.claude/settings.json

Source & flagged code

4 flagged

dist/index.jsView file

Lines 12-52javascript

12};

13var __export = (target, all) => {

14 for (var name in all)

15 __defProp(target, name, { get: all[name], enumerable: true });

16};

17

18// ../mcp-core/dist/env.js

19function normalizeApiBase(raw) {

20 const trimmed = raw.replace(/\/$/, "");

21 try {

22 const u = new URL(trimmed);

23 const isOneKey = u.hostname === "1key4ai.com" || u.hostname.endsWith(".1key4ai.com");

24 if (isOneKey && u.hostname.startsWith("api.")) {

25 const host = u.hostname.slice("api.".length);

26 return `${u.protocol}//${host}${u.port ? ":" + u.port : ""}`;

27 }

28 } catch {

29 }

30 return trimmed;

31}

32function getApiBase() {

33 return normalizeApiBase(process.env.K4_API_BASE || process.env.ONEKEY_API_BASE || "https://1key4ai.com");

34}

35function getApiKey() {

36 return process.env.K4_API_KEY || process.env.ONEKEY_API_KEY || "";

37}

38function npxCommand() {

39 return process.platform === "win32" ? "npx.cmd" : "npx";

40}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L32

41function isNpxLikeCommand(command) {

42 return command === "npx" || command === "npx.cmd";

43}

44var init_env = __esm({

45 "../mcp-core/dist/env.js"() {

46 "use strict";

47 }

48});

49

50// ../mcp-core/dist/fetchWithRetry.js

51function parseRetryAfterSeconds(raw, nowMs = Date.now()) {

52 if (!raw)

Lines 1065-1105javascript

1065 const initial = resolve(startDir || process.cwd());

1066 let dir = initial;

1067 while (true) {

1068 if (existsSync(

•matchType = previous_version_dangerous_delta matchedPackage = @1key4ai/cc-bridge@1.9.0 matchedIdentity = npm:QDFrZXk0YWkvY2MtYnJpZGdl:1.9.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

templates/quorum-enforcement.shView file

•path = templates/quorum-enforcement.sh kind = build_helper sizeBytes = 7455 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/quorum-enforcement.shView on unpkg