@claudiolabs/claudin@1.1.16: Suspicious npm security report

Loading npm security reports…

@claudiolabs/claudin@1.1.16: Suspicious npm security report | LPM Firewall

Source & flagged code

14 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.16",

36 "@claudiolabs/claudin-darwin-arm64": "1.1.16",

37 "@claudiolabs/claudin-win32-x64": "1.1.16",

38 "@claudiolabs/claudin-darwin-x64": "1.1.16",

39 "@claudiolabs/claudin-linux-x64": "1.1.16",

40 "@claudiolabs/claudin-linux-arm64": "1.1.16",

41 "@claudiolabs/claudin-win32-arm64": "1.1.16",

42 "@claudiolabs/claudin-linux-arm64-musl": "1.1.16"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.16-m68wgnx0.mjsView file

Lines 1-21javascript

1import{uc as y2,vc as iq}from"./cli-1.1.16-5bx6tpmw.mjs";import{Bc as aq,wc as h4,xc as i0,yc as h0,zc as X2}from"./cli-1.1.16-02ynr76s.mjs";import{Cc as _0,Fc

dist/chunks/cli-1.1.16-x1r7521q.mjsView file

18${Q}`,color:"permission",onCancel:()=>J?.("cancel"),isCancelActive:!0,inputGuide:(R)=>R.pending?E(O,{children:["Press ",R.keyName," again to exit"]}):E(QJ,{children:[D(vY,{action:"... L19: ${Q}`,color:"permission",onCancel:()=>Z("cancel"),isCancelActive:!0,inputGuide:(A)=>A.pending?E(O,{children:["Press ",A.keyName," again to exit"]}):E(QJ,{children:[D(vY,{action:"co... L20: `),k=_.length>B,S=k?_.slice(0,B):_,C=Math.min(z??0,B),T=Math.max(0,C-S.length-(k?1:0)),v=T>0?[...S,...Array(T).fill("")]:S,h=Math.max(W,...v.map(HC)),u=Math.min(h+4,q),$=u-4,p;if(Z...

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.16-x1r7521q.mjsView on unpkg · L18

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/REPL-DPOsR0Mc.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 0.778 shingleOverlap = 35 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.16-x1r7521q.mjsView on unpkg

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/hookChains-1.1.16-9h14zpb6.mjsView file

Lines 1-4javascript

dist/chunks/cli-1.1.16-49bqpfq6.mjsView file

Lines 1-17javascript

1import{a9 as P5,c9 as R7}from"./cli-1.1.16-cs3aeka5.mjs";import{e9 as A,f9 as r8}from"./cli-1.1.16-dtwt84pe.mjs";import{w9 as a2,y9 as D7}from"./cli-1.1.16-gyw71nnw.mjs";import

dist/chunks/index-1.1.16-2rsmxhr2.mjsView file

Lines 1-31javascript

1import{Qsa as A,Tsa as v}from"./cli-1.1.16-w5ns6t4b.mjs";var D8=A((i)=>{var B1=i&&i.__assign||function(){

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.15 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.15 similarity = 0.708 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.16-04vqwa21.mjs spawns dist/chunks/cli-1.1.16-z56ew2eh.mjs; helper contains network access plus dynamic code execution. L1: import{nb as yJ,ob as xz,pb as rz,qb as cz,rb as iz,sb as kJ}from"./cli-1.1.16-8efk3qjx.mjs";import{ub as Tz}from"./cli-1.1.16-5hfex73v.mjs";import{Cb as EJ,Db as TJ,Eb as xJ,Fb as... L2: `).filter((K)=>K.length>0)}function VJ(z){let J=z.write??(($)=>process.stdout.write($)),K=z.verbose,Y=0,O="idle",Z="Ready",R="",B="",U="",F="",L="",A=null,_=[],M=!1,y=null,P=0,x=0,... L3: `)){if(Vz.length===0){w++;continue}let _z=sz(Vz);w+=Math.max(1,Math.ceil(_z/G))}if($.endsWith(` ... L31: `),$)m(`${V.red($)} L32: `)},updateSessionStatus($,G,w,Vz){if(w.type==="tool_start")y=w.summary,P=Date.now();p()},clearStatus(){t(),a

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.16-hwr77b8n.mjsView file

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/loadAgentsDir-Dt65bOMO.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.16-hwr77b8n.mjsView on unpkg

dist/chunks/openaiShim-1.1.16-8gems3mz.mjsView file

11patternName = generic_password severity = medium line = 11 matchedText = [Content...in(`

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.16-8gems3mz.mjs

dist/chunks/openaiShim-1.1.16-8gems3mz.mjsView on unpkg · L11

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/cli-1.1.16-m68wgnx0.mjsView file

1patternName = generic_password severity = medium line = 1 matchedText = import{u...tml>

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/cli-1.1.16-m68wgnx0.mjsView on unpkg · L1

dist/chunks/cli-1.1.16-x1r7521q.mjsView file

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.16-x1r7521q.mjsView on unpkg · L18

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.16-x1r7521q.mjsView on unpkg

cli-wrapper.cjsView file

14L15: const { spawnSync } = require('child_process') L16: const { arch, constants } = require('os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli-wrapper.cjsView on unpkg · L14

dist/chunks/hookChains-1.1.16-9h14zpb6.mjsView file

1import{WA as M,XA as Cj,iw as t,qF as jj,wF as Kj,yw as kj}from"./cli-1.1.16-hwr77b8n.mjs";import"./cli-1.1.16-ejy0gvv1.mjs";import"./cli-1.1.16-acbajet0.mjs";import"./cli-1.1.16-0... L2: `)}function ej(j,q,G){let A=_(G.payload),F=U(A),J={EVENT_NAME:G.eventName,OUTCOME:G.outcome,RULE_ID:q.id,PAYLOAD_JSON:F,ERROR:Y(A,["error","reason"])??"",TASK_SUBJECT:Y(A,["task_su... L3: `);return{summary:O,body:P}}async function tj(j){let{action:q,rule:G,event:A,runtime:F}=j;if(F.signal?.aborted)return{status:"skipped",reason:"aborted"};if(!F.onSpawnFallbackAgent)...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/hookChains-1.1.16-9h14zpb6.mjsView on unpkg · L1

dist/chunks/cli-1.1.16-49bqpfq6.mjsView file

1import{a9 as P5,c9 as R7}from"./cli-1.1.16-cs3aeka5.mjs";import{e9 as A,f9 as r8}from"./cli-1.1.16-dtwt84pe.mjs";import{w9 as a2,y9 as D7}from"./cli-1.1.16-gyw71nnw.mjs";import{$ca... L2: `;await H0("security",["-i"],{input:X,reject:!1}),x("",{}),$=!0}catch(Q){k(Q),x("",{error:g(Q)}),x("",{})}else x("",{});let J=V5(Z);S((Q)=>{let Y=Q.customApiKeyResponses?.approved?...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/cli-1.1.16-49bqpfq6.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/cli-1.1.16-49bqpfq6.mjsView on unpkg · L1

dist/chunks/index-1.1.16-2rsmxhr2.mjsView file

20contains invisible/control Unicode U+200B (zero width space) \v\f\r\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.16-2rsmxhr2.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.16-hwr77b8n.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.16-hwr77b8n.mjsView on unpkg

dist/chunks/openaiShim-1.1.16-8gems3mz.mjsView file

11patternName = generic_password severity = medium line = 11 matchedText = [Content...in(`

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.16-8gems3mz.mjs

dist/chunks/openaiShim-1.1.16-8gems3mz.mjsView on unpkg · L11

Source & flagged code

14 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.16",

36 "@claudiolabs/claudin-darwin-arm64": "1.1.16",

37 "@claudiolabs/claudin-win32-x64": "1.1.16",

38 "@claudiolabs/claudin-darwin-x64": "1.1.16",

39 "@claudiolabs/claudin-linux-x64": "1.1.16",

40 "@claudiolabs/claudin-linux-arm64": "1.1.16",

41 "@claudiolabs/claudin-win32-arm64": "1.1.16",

42 "@claudiolabs/claudin-linux-arm64-musl": "1.1.16"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.16-m68wgnx0.mjsView file

Lines 1-21javascript

1import{uc as y2,vc as iq}from"./cli-1.1.16-5bx6tpmw.mjs";import{Bc as aq,wc as h4,xc as i0,yc as h0,zc as X2}from"./cli-1.1.16-02ynr76s.mjs";import{Cc as _0,Fc

dist/chunks/cli-1.1.16-x1r7521q.mjsView file

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.16-x1r7521q.mjsView on unpkg · L18

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.16-x1r7521q.mjsView on unpkg

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/hookChains-1.1.16-9h14zpb6.mjsView file

Lines 1-4javascript

dist/chunks/cli-1.1.16-49bqpfq6.mjsView file

Lines 1-17javascript

1import{a9 as P5,c9 as R7}from"./cli-1.1.16-cs3aeka5.mjs";import{e9 as A,f9 as r8}from"./cli-1.1.16-dtwt84pe.mjs";import{w9 as a2,y9 as D7}from"./cli-1.1.16-gyw71nnw.mjs";import

dist/chunks/index-1.1.16-2rsmxhr2.mjsView file

Lines 1-31javascript

1import{Qsa as A,Tsa as v}from"./cli-1.1.16-w5ns6t4b.mjs";var D8=A((i)=>{var B1=i&&i.__assign||function(){

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.16-04vqwa21.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.16-hwr77b8n.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.16-hwr77b8n.mjsView on unpkg

dist/chunks/openaiShim-1.1.16-8gems3mz.mjsView file

11patternName = generic_password severity = medium line = 11 matchedText = [Content...in(`

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.16-8gems3mz.mjs

dist/chunks/openaiShim-1.1.16-8gems3mz.mjsView on unpkg · L11

@claudiolabs/claudin@1.1.16

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code