Loading npm security reports…

@ayorcodes/claudespace@0.9.0: Malicious npm security report | LPM Firewall

registry / @ayorcodes/claudespace / 0.9.0

@ayorcodes/claudespace@0.9.0

Open a Claude Code multi-pane terminal workspace with one command (macOS only)

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing globally runs an opaque native executable and automatically changes global Claude Code and AI configuration. It can overwrite command assets and leave a global Stop hook affecting every Claude Code session.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm global installation runs postinstall as a non-root user.

Impact

User-level AI-agent behavior and configuration can be changed without an explicit setup command; existing assets may be overwritten.

Mechanism

Postinstall executes a bundled binary to synchronize global agent assets and hooks.

Attack narrative

A global npm install invokes postinstall. That script executes the opaque bundled native binary for preflight and asset synchronization, which targets shared user agent directories. The package declares that it registers global Claude commands, overwrites existing copies, and installs a global Stop hook. This is an automatic mutation of a broad foreign AI-agent control surface rather than an explicit user-invoked setup step.

AI rationale

The automatic lifecycle hook executes an opaque binary that modifies shared AI-agent configuration and can overwrite user assets. This meets the install-hook abuse boundary even without evidence of network exfiltration.

Evidence

package.jsonscripts/postinstall.jsREADME.mdlibexec/claudespace.dist/claudespace-bin~/.claude~/.claude/commands~/.ai/prompts~/.config/claudespace

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

19L20: const { execFileSync, spawnSync } = require("child_process"); L21: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L19

scripts/postinstall.js#virtual:normalized:round1View file

10* Sync writes under `~/.claude`, `~/.ai` and `~/.config/claudespace`; under L11: * `sudo npm i -g` those either resolve to `/var/root` (silently the wrong L12: * place) or land in the real user"s directories owned by root, which breaks\n * every later user-level write. So the root case skips and falls back to the\n * per-version first-run... L13: // symlinked nvm/Homebrew prefix) so the containment check below compares

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L10

libexec/claudespace.dist/unicodedata.soView file

•path = libexec/claudespace.dist/unicodedata.so kind = native_binary sizeBytes = 751168 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

libexec/claudespace.dist/unicodedata.soView on unpkg

bin/claudespace-observe.shView file

•path = bin/claudespace-observe.sh kind = build_helper sizeBytes = 783 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/claudespace-observe.shView on unpkg

.claude/worktrees/wonderful-cohen-d0657a/bin/claudespace-observe.shView file

•path = .claude/worktrees/wonderful-cohen-d0657a/bin/claudespace-observe.sh kind = payload_in_excluded_dir sizeBytes = 783 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/worktrees/wonderful-cohen-d0657a/bin/claudespace-observe.shView on unpkg

bin/claudespace-ask.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claudespace-ask.shView on unpkg

libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @ayorcodes/claudespace@0.8.0 matchedIdentity = npm:QGF5b3Jjb2Rlcy9jbGF1ZGVzcGFjZQ:0.8.0 similarity = 0.953 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 9-33json

9 },

10 "homepage": "https://github.com/ayorcodes/claudespace",

11 "os": [

12 "darwin"

13 ],

14 "cpu": [

15 "arm64"

16 ],

17 "bin": {

18 "claudespace": "bin/claudespace.sh",

19 "claudespace-sync-assets": "bin/claudespace-sync-assets.sh",

20 "claudespace-handoff": "bin/claudespace-handoff.sh",

21 "claudespace-guard": "bin/claudespace-guard.sh",

22 "claudespace-observe": "bin/claudespace-observe.sh",

23 "claudespace-msg": "bin/claudespace-msg.sh",

24 "claudespace-ask": "bin/claudespace-ask.sh",

25 "claudespace-update": "bin/claudespace-update.sh",

26 "claudespace-tmux-persist": "bin/claudespace-tmux-persist.sh"

27 },

28 "scripts": {

29 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "prepublishOnly": "bash scripts/build-binary.sh"

31 }

32}

33

scripts/postinstall.jsView file

19L20: const { execFileSync, spawnSync } = require("child_process"); L21: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L19

scripts/postinstall.js#virtual:normalized:round1View file

10* Sync writes under `~/.claude`, `~/.ai` and `~/.config/claudespace`; under L11: * `sudo npm i -g` those either resolve to `/var/root` (silently the wrong L12: * place) or land in the real user"s directories owned by root, which breaks\n * every later user-level write. So the root case skips and falls back to the\n * per-version first-run... L13: // symlinked nvm/Homebrew prefix) so the containment check below compares

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L10

libexec/claudespace.dist/unicodedata.soView file

•path = libexec/claudespace.dist/unicodedata.so kind = native_binary sizeBytes = 751168 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

libexec/claudespace.dist/unicodedata.soView on unpkg

bin/claudespace-observe.shView file

•path = bin/claudespace-observe.sh kind = build_helper sizeBytes = 783 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/claudespace-observe.shView on unpkg

.claude/worktrees/wonderful-cohen-d0657a/bin/claudespace-observe.shView file

•path = .claude/worktrees/wonderful-cohen-d0657a/bin/claudespace-observe.sh kind = payload_in_excluded_dir sizeBytes = 783 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/worktrees/wonderful-cohen-d0657a/bin/claudespace-observe.shView on unpkg

bin/claudespace-ask.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claudespace-ask.shView on unpkg

libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @ayorcodes/claudespace@0.8.0 matchedIdentity = npm:QGF5b3Jjb2Rlcy9jbGF1ZGVzcGFjZQ:0.8.0 similarity = 0.953 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView on unpkg