@ayorcodes/claudespace@1.0.14: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@ayorcodes/claudespace@1.0.14: Suspicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

19L20: const { execFileSync, spawnSync } = require("child_process"); L21: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L19

scripts/postinstall.js#virtual:normalized:round1View file

10* Sync writes under `~/.claude`, `~/.ai` and `~/.config/claudespace`; under L11: * `sudo npm i -g` those either resolve to `/var/root` (silently the wrong L12: * place) or land in the real user"s directories owned by root, which breaks\n * every later user-level write. So the root case skips and falls back to the\n * per-version first-run... L13: // symlinked nvm/Homebrew prefix) so the containment check below compares

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L10

libexec/claudespace.dist/unicodedata.soView file

•path = libexec/claudespace.dist/unicodedata.so kind = native_binary sizeBytes = 751168 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

libexec/claudespace.dist/unicodedata.soView on unpkg

bin/claudespace-observe.shView file

•path = bin/claudespace-observe.sh kind = build_helper sizeBytes = 783 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/claudespace-observe.shView on unpkg

.claude/worktrees/agent-aa089066ec753a6c7/bin/claudespace-observe.shView file

•path = .claude/worktrees/agent-[redacted]-observe.sh kind = payload_in_excluded_dir sizeBytes = 783 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/worktrees/agent-aa089066ec753a6c7/bin/claudespace-observe.shView on unpkg

bin/claudespace-ask.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claudespace-ask.shView on unpkg

libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView file

•matchType = normalized_sha256 matchedPackage = @ayorcodes/claudespace@1.0.11 matchedPath = libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.sh matchedIdentity = npm:QGF5b3Jjb2Rlcy9jbGF1ZGVzcGFjZQ:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 9-34json

9 },

10 "homepage": "https://github.com/ayorcodes/claudespace",

11 "os": [

12 "darwin"

13 ],

14 "cpu": [

15 "arm64"

16 ],

17 "bin": {

18 "claudespace": "bin/claudespace.sh",

19 "claudespace-sync-assets": "bin/claudespace-sync-assets.sh",

20 "claudespace-handoff": "bin/claudespace-handoff.sh",

21 "claudespace-guard": "bin/claudespace-guard.sh",

22 "claudespace-observe": "bin/claudespace-observe.sh",

23 "claudespace-msg": "bin/claudespace-msg.sh",

24 "claudespace-ask": "bin/claudespace-ask.sh",

25 "claudespace-update": "bin/claudespace-update.sh",

26 "claudespace-tmux-persist": "bin/claudespace-tmux-persist.sh"

27 },

28 "scripts": {

29 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "prepublishOnly": "bash scripts/build-binary.sh",

31 "local-install": "bash scripts/build-binary.sh && npm pack --pack-destination /tmp && npm install -g $(ls -t /tmp/ayorcodes-claudespace-*.tgz | head -1)"

32 }

33}

34

scripts/postinstall.jsView file

19L20: const { execFileSync, spawnSync } = require("child_process"); L21: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L19

scripts/postinstall.js#virtual:normalized:round1View file

10* Sync writes under `~/.claude`, `~/.ai` and `~/.config/claudespace`; under L11: * `sudo npm i -g` those either resolve to `/var/root` (silently the wrong L12: * place) or land in the real user"s directories owned by root, which breaks\n * every later user-level write. So the root case skips and falls back to the\n * per-version first-run... L13: // symlinked nvm/Homebrew prefix) so the containment check below compares

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L10

libexec/claudespace.dist/unicodedata.soView file

•path = libexec/claudespace.dist/unicodedata.so kind = native_binary sizeBytes = 751168 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

libexec/claudespace.dist/unicodedata.soView on unpkg

bin/claudespace-observe.shView file

•path = bin/claudespace-observe.sh kind = build_helper sizeBytes = 783 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/claudespace-observe.shView on unpkg

.claude/worktrees/agent-aa089066ec753a6c7/bin/claudespace-observe.shView file

•path = .claude/worktrees/agent-[redacted]-observe.sh kind = payload_in_excluded_dir sizeBytes = 783 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/worktrees/agent-aa089066ec753a6c7/bin/claudespace-observe.shView on unpkg

bin/claudespace-ask.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claudespace-ask.shView on unpkg

libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView file

•matchType = normalized_sha256 matchedPackage = @ayorcodes/claudespace@1.0.11 matchedPath = libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.sh matchedIdentity = npm:QGF5b3Jjb2Rlcy9jbGF1ZGVzcGFjZQ:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView on unpkg