@ayorcodes/claudespace@1.0.15: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@ayorcodes/claudespace@1.0.15: Suspicious npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

19L20: const { execFileSync, spawnSync } = require("child_process"); L21: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L19

scripts/postinstall.js#virtual:normalized:round1View file

10* Sync writes under `~/.claude`, `~/.ai` and `~/.config/claudespace`; under L11: * `sudo npm i -g` those either resolve to `/var/root` (silently the wrong L12: * place) or land in the real user"s directories owned by root, which breaks\n * every later user-level write. So the root case skips and falls back to the\n * per-version first-run... L13: // symlinked nvm/Homebrew prefix) so the containment check below compares

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L10

libexec/win32-arm64/claudespace.dist/claudespace-bin.exeView file

•path = libexec/win32-arm64/claudespace.dist/claudespace-bin.exe kind = native_binary sizeBytes = 39735808 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

libexec/win32-arm64/claudespace.dist/claudespace-bin.exeView on unpkg

bin/claudespace-observe.shView file

•path = bin/claudespace-observe.sh kind = build_helper sizeBytes = 1311 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/claudespace-observe.shView on unpkg

.claude/worktrees/agent-af47f7599efb1414f/bin/claudespace-observe.shView file

•path = .claude/worktrees/agent-[redacted]-observe.sh kind = payload_in_excluded_dir sizeBytes = 783 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/worktrees/agent-af47f7599efb1414f/bin/claudespace-observe.shView on unpkg

bin/claudespace-ask.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claudespace-ask.shView on unpkg

libexec/darwin-arm64/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView file

•matchType = normalized_sha256 matchedPackage = @ayorcodes/claudespace@1.0.11 matchedPath = libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.sh matchedIdentity = npm:QGF5b3Jjb2Rlcy9jbGF1ZGVzcGFjZQ:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

libexec/darwin-arm64/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView on unpkg

libexec/win32-arm64/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView file

•matchType = normalized_sha256 matchedPackage = @ayorcodes/claudespace@1.0.11 matchedPath = libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.sh matchedIdentity = npm:QGF5b3Jjb2Rlcy9jbGF1ZGVzcGFjZQ:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

libexec/win32-arm64/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView on unpkg

libexec/win32-x64/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView file

•matchType = normalized_sha256 matchedPackage = @ayorcodes/claudespace@1.0.11 matchedPath = libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.sh matchedIdentity = npm:QGF5b3Jjb2Rlcy9jbGF1ZGVzcGFjZQ:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

libexec/win32-x64/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.shView on unpkg