@claudiolabs/claudin@1.1.15: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@claudiolabs/claudin@1.1.15: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/openaiShim-1.1.15-dq3fghyq.mjsView file

11patternName = generic_password severity = medium line = 11 matchedText = [Content...in(`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/openaiShim-1.1.15-dq3fghyq.mjsView on unpkg · L11

cli-wrapper.cjsView file

14L15: const { spawnSync } = require('child_process') L16: const { arch, constants } = require('os')

High

Child Process

Package source references child process execution.

cli-wrapper.cjsView on unpkg · L14

14L15: const { spawnSync } = require('child_process') L16: const { arch, constants } = require('os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli-wrapper.cjsView on unpkg · L14

dist/chunks/index-1.1.15-58q8vth9.mjsView file

20contains invisible/control Unicode U+200B (zero width space) \v\f\r\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.15-58q8vth9.mjsView on unpkg · L20

dist/chunks/cli-1.1.15-b16e0ajk.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.14 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.14 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/cli-1.1.15-b16e0ajk.mjsView on unpkg

61Cross-file remote execution chain: dist/chunks/cli-1.1.15-b16e0ajk.mjs spawns dist/chunks/cli-1.1.15-wbqj4f48.mjs; helper contains network access plus dynamic code execution. L61: - Otherwise, emit the Reads as parallel tool_use blocks in the same assistant message. Same-turn parallel Reads are first-class. L62: A serial loop of Read → short comment → Read → short comment is the wrong shape.`}var U9="Read",S$="File unchanged since last read. The content from the earlier Read tool_result in... L63: - Allows Claude to search the web and use the results to inform responses ... L77: Sources: L78: - [Source Title 1](https://example.com/1) L79: - [Source Title 2](https://example.com/2) ... L137: - Use this tool when you need to find files by name patterns, including what \`find\` is reached for:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/cli-1.1.15-b16e0ajk.mjsView on unpkg · L61

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/loadAgentsDir-Dt65bOMO.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.15-ewmcb0r7.mjsView file

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/REPL-DPOsR0Mc.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 0.846 shingleOverlap = 33 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.15-ewmcb0r7.mjsView on unpkg

dist/chunks/cli-1.1.15-gw258rrk.mjsView file

1patternName = generic_password severity = medium line = 1 matchedText = import{u...tml>

Medium

Secret Pattern

Hardcoded password in dist/chunks/cli-1.1.15-gw258rrk.mjs

dist/chunks/cli-1.1.15-gw258rrk.mjsView on unpkg · L1

Source & flagged code

11 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.15",

36 "@claudiolabs/claudin-darwin-arm64": "1.1.15",

37 "@claudiolabs/claudin-win32-x64": "1.1.15",

38 "@claudiolabs/claudin-darwin-x64": "1.1.15",

39 "@claudiolabs/claudin-linux-x64": "1.1.15",

40 "@claudiolabs/claudin-linux-arm64": "1.1.15",

41 "@claudiolabs/claudin-win32-arm64": "1.1.15",

42 "@claudiolabs/claudin-linux-arm64-musl": "1.1.15"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

52

dist/chunks/openaiShim-1.1.15-dq3fghyq.mjsView file

Lines 1-15javascript

1import{Ai as WZ,yi as QZ,zi as W0}from"./cli-1.1.15-a6p2wwtc.mjs";import{Di as l$,Fi as J1}from"./cli-1.1.15-xmm250at.mjs";import{$Q as gZ,$q as D0,Bk as _$,Ck as e0,Hr as

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/index-1.1.15-58q8vth9.mjsView file

Lines 1-31javascript

1import{Csa as A,Fsa as v}from"./cli-1.1.15-bwy6nhdk.mjs";var D8=A((i)=>{var B1=i&&i.__assign||function(){

dist/chunks/cli-1.1.15-b16e0ajk.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.14 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.14 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/cli-1.1.15-b16e0ajk.mjsView on unpkg

61Cross-file remote execution chain: dist/chunks/cli-1.1.15-b16e0ajk.mjs spawns dist/chunks/cli-1.1.15-wbqj4f48.mjs; helper contains network access plus dynamic code execution. L61: - Otherwise, emit the Reads as parallel tool_use blocks in the same assistant message. Same-turn parallel Reads are first-class. L62: A serial loop of Read → short comment → Read → short comment is the wrong shape.`}var U9="Read",S$="File unchanged since last read. The content from the earlier Read tool_result in... L63: - Allows Claude to search the web and use the results to inform responses ... L77: Sources: L78: - [Source Title 1](https://example.com/1) L79: - [Source Title 2](https://example.com/2) ... L137: - Use this tool when you need to find files by name patterns, including what \`find\` is reached for:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/cli-1.1.15-b16e0ajk.mjsView on unpkg · L61

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/loadAgentsDir-Dt65bOMO.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.15-ewmcb0r7.mjsView file

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/REPL-DPOsR0Mc.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 0.846 shingleOverlap = 33 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.15-ewmcb0r7.mjsView on unpkg

dist/chunks/cli-1.1.15-gw258rrk.mjsView file

Lines 1-21javascript

1import{uc as y2,vc as iq}from"./cli-1.1.15-pg56x579.mjs";import{Bc as aq,wc as h4,xc as i0,yc as h0,zc as X2}from"./cli-1.1.15-emegjc48.mjs";import{Cc as _0,Fc