@claudiolabs/claudin@1.1.14: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@claudiolabs/claudin@1.1.14: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/cli-1.1.14-ba8qj93n.mjsView file

1patternName = generic_password severity = medium line = 1 matchedText = import{u...tml>

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/cli-1.1.14-ba8qj93n.mjsView on unpkg · L1

dist/chunks/watchLoop-1.1.14-r19ed4xt.mjsView file

1import{g as A,m as j}from"./cli-1.1.14-rcw8bj2x.mjs";import{pga as $,xga as C}from"./cli-1.1.14-q1kc6b8n.mjs";import"./cli-1.1.14-byr5dy4k.mjs";import"./cli-1.1.14-0e209hdd.mjs";im... L2: ${X}`)}`;Z.push({id:G,title:W||U(X),body:X||W})}return Z}function N(q){return typeof q==="object"&&q!==null&&!Array.isArray(q)}function J(q){return typeof q==="string"&&q.trim()?q....

High

Child Process

Package source references child process execution.

dist/chunks/watchLoop-1.1.14-r19ed4xt.mjsView on unpkg · L1

1import{g as A,m as j}from"./cli-1.1.14-rcw8bj2x.mjs";import{pga as $,xga as C}from"./cli-1.1.14-q1kc6b8n.mjs";import"./cli-1.1.14-byr5dy4k.mjs";import"./cli-1.1.14-0e209hdd.mjs";im... L2: ${X}`)}`;Z.push({id:G,title:W||U(X),body:X||W})}return Z}function N(q){return typeof q==="object"&&q!==null&&!Array.isArray(q)}function J(q){return typeof q==="string"&&q.trim()?q....

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/watchLoop-1.1.14-r19ed4xt.mjsView on unpkg · L1

dist/chunks/cli-1.1.14-8fx5qjh6.mjsView file

806L807: 5. **Synthesize one report.** Merge duplicate findings across angles, resolve or surface disagreements, and write a single structured answer. Rank or tag claims by confidence (e.g.... L808: ... L813: L814: You run in an isolated context: the parent sees only your final report, not your workers' intermediate output. Make the report self-contained.`}var ih9="WebResearcherManager",nh9,I... L815: Resume this session with:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.14-8fx5qjh6.mjsView on unpkg · L806

61- Otherwise, emit the Reads as parallel tool_use blocks in the same assistant message. Same-turn parallel Reads are first-class. L62: A serial loop of Read → short comment → Read → short comment is the wrong shape.`}var U9="Read",S$="File unchanged since last read. The content from the earlier Read tool_result in... L63: - Allows Claude to search the web and use the results to inform responses ... L77: Sources: L78: - [Source Title 1](https://example.com/1) L79: - [Source Title 2](https://example.com/2) ... L137: - Use this tool when you need to find files by name patterns, including what \`find\` is reached for: depth, directories, exclusions L138: - When you are doing an open ended search that may require multiple rounds of globbing and grepping, use the Agent tool instead`;var N7=(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.14-8fx5qjh6.mjsView on unpkg · L61

dist/chunks/index-1.1.14-ae1277p4.mjsView file

1import{wsa as u,zsa as k}from"./cli-1.1.14-prtez07m.mjs";import{Esa as f,Fsa as y}from"./cli-1.1.14-r930b2z3.mjs";function j(z){return new Promise((G,U)=>{let K=g.request({method:"... L2: For more information, please visit: `+Xz);let Q=z.originalExpiration??z.expiration;return{...z,...Q?{originalExpiration:Q}:{},expiration:K}},Zz=(z,G={})=>{let U=G?.logger||console,...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.14-ae1277p4.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.14-ks4wsswq.mjsView file

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/REPL-DPOsR0Mc.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 0.846 shingleOverlap = 33 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.14-ks4wsswq.mjsView on unpkg

dist/chunks/openaiShim-1.1.14-63qfbmm4.mjsView file

11patternName = generic_password severity = medium line = 11 matchedText = [Content...in(`

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.14-63qfbmm4.mjs

dist/chunks/openaiShim-1.1.14-63qfbmm4.mjsView on unpkg · L11

Source & flagged code

17 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.14",

36 "@claudiolabs/claudin-darwin-arm64": "1.1.14",

37 "@claudiolabs/claudin-win32-x64": "1.1.14",

38 "@claudiolabs/claudin-darwin-x64": "1.1.14",

39 "@claudiolabs/claudin-linux-x64": "1.1.14",

40 "@claudiolabs/claudin-linux-arm64": "1.1.14",

41 "@claudiolabs/claudin-win32-arm64": "1.1.14",

42 "@claudiolabs/claudin-linux-arm64-musl": "1.1.14"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

52

dist/chunks/cli-1.1.14-ba8qj93n.mjsView file

Lines 1-21javascript

1import{uc as y2,vc as iq}from"./cli-1.1.14-qyywt37p.mjs";import{Bc as aq,wc as h4,xc as i0,yc as h0,zc as X2}from"./cli-1.1.14-f2g608st.mjs";import{Cc as _0,Fc

dist/chunks/watchLoop-1.1.14-r19ed4xt.mjsView file

Lines 1-14javascript

1import{g as A,m as j}from"./cli-1.1.14-rcw8bj2x.mjs";import{pga as $,xga as C}from"./cli-1.1.14-q1kc6b8n.mjs";import"./cli-1.1.14-byr5dy4k.mjs";import"./cli-1.1.14-0e209hdd.mjs";import"./cli-1.1.14-947tpwm7.mjs";

dist/chunks/cli-1.1.14-8fx5qjh6.mjsView file

806L807: 5. **Synthesize one report.** Merge duplicate findings across angles, resolve or surface disagreements, and write a single structured answer. Rank or tag claims by confidence (e.g.... L808: ... L813: L814: You run in an isolated context: the parent sees only your final report, not your workers' intermediate output. Make the report self-contained.`}var ih9="WebResearcherManager",nh9,I... L815: Resume this session with:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.14-8fx5qjh6.mjsView on unpkg · L806

61- Otherwise, emit the Reads as parallel tool_use blocks in the same assistant message. Same-turn parallel Reads are first-class. L62: A serial loop of Read → short comment → Read → short comment is the wrong shape.`}var U9="Read",S$="File unchanged since last read. The content from the earlier Read tool_result in... L63: - Allows Claude to search the web and use the results to inform responses ... L77: Sources: L78: - [Source Title 1](https://example.com/1) L79: - [Source Title 2](https://example.com/2) ... L137: - Use this tool when you need to find files by name patterns, including what \`find\` is reached for: depth, directories, exclusions L138: - When you are doing an open ended search that may require multiple rounds of globbing and grepping, use the Agent tool instead`;var N7=(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.14-8fx5qjh6.mjsView on unpkg · L61

dist/chunks/index-1.1.14-ae1277p4.mjsView file

1import{wsa as u,zsa as k}from"./cli-1.1.14-prtez07m.mjs";import{Esa as f,Fsa as y}from"./cli-1.1.14-r930b2z3.mjs";function j(z){return new Promise((G,U)=>{let K=g.request({method:"... L2: For more information, please visit: `+Xz);let Q=z.originalExpiration??z.expiration;return{...z,...Q?{originalExpiration:Q}:{},expiration:K}},Zz=(z,G={})=>{let U=G?.logger||console,...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.14-ae1277p4.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.14-ks4wsswq.mjsView file

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/REPL-DPOsR0Mc.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 0.846 shingleOverlap = 33 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.14-ks4wsswq.mjsView on unpkg

dist/chunks/openaiShim-1.1.14-63qfbmm4.mjsView file

11patternName = generic_password severity = medium line = 11 matchedText = [Content...in(`

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.14-63qfbmm4.mjs

dist/chunks/openaiShim-1.1.14-63qfbmm4.mjsView on unpkg · L11