@claudiolabs/claudin@1.1.19: Suspicious npm security report

Loading npm security reports…

@claudiolabs/claudin@1.1.19: Suspicious npm security report | LPM Firewall

Source & flagged code

28 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.19",

36 "@claudiolabs/claudin-darwin-arm64": "1.1.19",

37 "@claudiolabs/claudin-win32-x64": "1.1.19",

38 "@claudiolabs/claudin-darwin-x64": "1.1.19",

39 "@claudiolabs/claudin-linux-x64": "1.1.19",

40 "@claudiolabs/claudin-linux-arm64": "1.1.19",

41 "@claudiolabs/claudin-win32-arm64": "1.1.19",

42 "@claudiolabs/claudin-linux-arm64-musl": "1.1.19"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/openaiShim-1.1.19-njr80kze.mjsView file

Lines 1-15javascript

1import{Li as QZ,Mi as W0,Ni as WZ}from"./cli-1.1.19-nqznsj8y.mjs";import{Qi as l$,Si as J1}from"./cli-1.1.19-a32dnq28.mjs";import{$r as EZ,Aj as R$,Dq as Z0,Dr as

dist/chunks/node-1.1.19-nj9qe6mk.mjsView file

Lines 1-13javascript

1import{$ra as vQ,Zra as y,_ra as D,asa as O,hsa as e,isa as QQ,jsa as RQ,ksa as NQ,lsa as W,msa as r,nsa as n,osa as fQ,rsa as kQ}from"./cli-1.1.19-hph7gbkv.mjs"

dist/chunks/cli-1.1.19-dt84yfk2.mjsView file

Lines 1-21javascript

1import{Eha as Y6,Iha as QB}from"./cli-1.1.19-nb1256fg.mjs";import{Qha as fq,Rha as Z6,Sha as jk}from"./cli-1.1.19-89n0ppp5.mjs";import{aia as s1,mia as Iq}from"./cli-1.1.19-x6xnsxay.mjs"

dist/chunks/cli-1.1.19-ybe27dz9.mjsView file

Lines 1-21javascript

1import{Kla as ag,Vla as l4}from"./cli-1.1.19-5eb8a4wn.mjs";import{jta as ir,kta as N,lta as Cg}from"./cli-1.1.19-cc266ybe.mjs";function fg(r){let i

dist/chunks/cli-1.1.19-n5xxe310.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-55ayan24.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 32 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-n5xxe310.mjsView on unpkg

18${Q}`,color:"permission",onCancel:()=>J?.("cancel"),isCancelActive:!0,inputGuide:(R)=>R.pending?E(O,{children:["Press ",R.keyName," again to exit"]}):E(GJ,{children:[D(KJ,{action:"... L19: ${Q}`,color:"permission",onCancel:()=>Z("cancel"),isCancelActive:!0,inputGuide:(A)=>A.pending?E(O,{children:["Press ",A.keyName," again to exit"]}):E(GJ,{children:[D(KJ,{action:"co... L20: `),k=_.length>q,S=k?_.slice(0,q):_,C=Math.min(z??0,q),T=Math.max(0,C-S.length-(k?1:0)),v=T>0?[...S,...Array(T).fill("")]:S,h=Math.max(W,...v.map(MC)),c=Math.min(h+4,B),$=c-4,p;if(Z...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/cli-1.1.19-n5xxe310.mjsView on unpkg · L18

dist/chunks/cli-1.1.19-hqbspnvc.mjsView file

614L615: REMEMBER: You can ONLY explore and plan. You CANNOT and MUST NOT write, edit, or modify any files. You do NOT have access to file editing tools.`}var jj;var jC=P(()=>{J6();A4();j6(... L616: Resume this session with: ... L618: `)),GL0=!0}catch{}}function So(Z){if(TC!==void 0)clearTimeout(TC),TC=void 0;try{sN.get(process.stdout)?.drainStdin()}catch{}try{process.exit(Z)}catch(J){process.kill(process.pid,"S... L619: `)}catch{}So(Z)}var GL0=!1,Wu9,fo=!1,TC,Co,Gu9,_L0;var wj=P(()=>{N5();a8();Xu9();E0();NL0();Ku9();qu9();IL0();WL0();Vu9();x0();xJ();G0();tY();C0();gZ();D7();Yu9();Wu9=e0(()=>{if($L... L620: `),Q=J.length-1;for(;Q>=0&&zQ.blankLine.test(J[Q]);)Q--;return J.length-Q<=2?Z:J.slice(0,Q+1).join(`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.19-hqbspnvc.mjsView on unpkg · L614

61- Otherwise, emit the Reads as parallel tool_use blocks in the same assistant message. Same-turn parallel Reads are first-class. L62: A serial loop of Read → short comment → Read → short comment is the wrong shape.`}var R9="Read",T$="File unchanged since last read. The content from the earlier Read tool_result in... L63: - Allows Claude to search the web and use the results to inform responses ... L77: Sources: L78: - [Source Title 1](https://example.com/1) L79: - [Source Title 2](https://example.com/2) ... L137: - Use this tool when you need to find files by name patterns, including what \`find\` is reached for: depth, directories, exclusions L138: - When you are doing an open ended search that may require multiple rounds of globbing and grepping, use the Agent tool instead`;var g7=(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.19-hqbspnvc.mjs

dist/chunks/index-1.1.19-f53qyqj8.mjsView file

1import{cta as u,fta as k}from"./cli-1.1.19-e5k83shq.mjs";import{kta as f,lta as y}from"./cli-1.1.19-cc266ybe.mjs";function j(z){return new Promise((G,U)=>{let K=g.request({method:"... L2: For more information, please visit: `+Xz);let Q=z.originalExpiration??z.expiration;return{...z,...Q?{originalExpiration:Q}:{},expiration:K}},Zz=(z,G={})=>{let U=G?.logger||console,...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.19-f53qyqj8.mjsView on unpkg · L1

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.30 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.30 similarity = 0.533 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjs spawns dist/chunks/cli-1.1.19-awkva6qc.mjs; helper contains network access plus dynamic code execution. L1: import{sb as yJ,tb as xz,ub as rz,vb as cz,wb as iz,xb as kJ}from"./cli-1.1.19-vyqgdds6.mjs";import{zb as Tz}from"./cli-1.1.19-s3zhxkk4.mjs";import{Jb as EJ,Kb as TJ,Lb as xJ,Mb as... L2: `).filter((K)=>K.length>0)}function VJ(z){let J=z.write??(($)=>process.stdout.write($)),K=z.verbose,Y=0,O="idle",Z="Ready",R="",B="",U="",F="",L="",A=null,_=[],M=!1,y=null,P=0,x=0,... L3: `)){if(Vz.length===0){w++;continue}let _z=sz(Vz);w+=Math.max(1,Math.ceil(_z/G))}if($.endsWith(` ... L31: `),$)m(`${V.red($)} L32: `)},updateSessionStatus($,G,w,Vz){if(w.type==="tool_start")y=w.summary,P=Date.now();p()},clearStatus(){t(),a

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.19-w4a9xacm.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.19-w4a9xacm.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.19-7v3pjgvw.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-vypd5zf6.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-7v3pjgvw.mjsView on unpkg

dist/chunks/cli-1.1.19-m8w4as34.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-tgtv1jp3.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-m8w4as34.mjsView on unpkg

dist/chunks/cli-1.1.19-v619rbr5.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-nv2mgz6h.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-v619rbr5.mjsView on unpkg

dist/chunks/protocolHandler-1.1.19-6n3sh10m.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/protocolHandler-1.1.26-qfw93skn.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/protocolHandler-1.1.19-6n3sh10m.mjsView on unpkg

dist/chunks/cli-1.1.19-vpabfve5.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-01erqdx7.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-vpabfve5.mjsView on unpkg

dist/chunks/cli-1.1.19-kjhw0mpy.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-32vewh62.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-kjhw0mpy.mjsView on unpkg

dist/chunks/index-1.1.19-mppepmze.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/index-1.1.26-syyhrh9b.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.19-mppepmze.mjsView on unpkg

dist/chunks/processSlashCommand-1.1.19-gy6nfdzs.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/processSlashCommand-1.1.26-watbp07x.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/processSlashCommand-1.1.19-gy6nfdzs.mjsView on unpkg

Source & flagged code

28 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/openaiShim-1.1.19-njr80kze.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/openaiShim-1.1.19-njr80kze.mjsView on unpkg · L11

dist/chunks/node-1.1.19-nj9qe6mk.mjsView file

1import{$ra as vQ,Zra as y,_ra as D,asa as O,hsa as e,isa as QQ,jsa as RQ,ksa as NQ,lsa as W,msa as r,nsa as n,osa as fQ,rsa as kQ}from"./cli-1.1.19-hph7gbkv.mjs";import{kta as P}fr... L2: `);if(Q[Q.length-1]==="")Q.pop();return Q}function PQ($,Q){return/^[\x20-\x7E]+$/.test(Q)&&!/[\\^#]/.test(Q)&&!($==="unzip"&&Q.startsWith("-"))}function uQ($,Q,z){let q=s(Q),V=s(z)...

High

Child Process

Package source references child process execution.

dist/chunks/node-1.1.19-nj9qe6mk.mjsView on unpkg · L1

dist/chunks/cli-1.1.19-dt84yfk2.mjsView file

High

Shell

Package source references shell execution.

dist/chunks/cli-1.1.19-dt84yfk2.mjsView on unpkg · L1

1import{Eha as Y6,Iha as QB}from"./cli-1.1.19-nb1256fg.mjs";import{Qha as fq,Rha as Z6,Sha as jk}from"./cli-1.1.19-89n0ppp5.mjs";import{aia as s1,mia as Iq}from"./cli-1.1.19-x6xnsxa... L2: `;try{$.appendFileSync(X,Y)}catch{try{$.mkdirSync(k_(X)),$.appendFileSync(X,Y)}catch{}}}function N_(){return process.env.CLAUDIN_DIAGNOSTICS_FILE}async function Ev(Z,q,J){let X=Dat... ... L4: `;break;case"t":J+="\t";break;case"b":J+="\b";break;case'"':J+='"';break;case"\\":J+="\\";break;default:J+=Y;break}Q+=2;continue}if(Y==="\\"){J+="\\",Q+=2;continue}}J+=$,Q++}if(!X)... L5: `)){if(X.startsWith("#")||X.startsWith("^"))continue;let Q=X.indexOf(" ");if(Q===-1)continue;if(X.slice(Q+1)===q){let $=X.slice(0,Q);return J3($)?$:null}}}catch{}return null}async ... L6: `)Y-=1,H+=1;else if(U==="u"&&q[H+2]==="{

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/cli-1.1.19-dt84yfk2.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-mvjefec1.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/chunks/cli-1.1.19-ybe27dz9.mjsView file

1import{Kla as ag,Vla as l4}from"./cli-1.1.19-5eb8a4wn.mjs";import{jta as ir,kta as N,lta as Cg}from"./cli-1.1.19-cc266ybe.mjs";function fg(r){let i=0;for(let o=0;o<r.length;o++)i=(... L2: `)}var ul=(r,i)=>{r.name="$ZodError",Object.defineProperty(r,"_zod",{value:r._zod,enumerable:!1}),Object.defineProperty(r,"issues",{value:i,enumerable:!1}),r.message=JSON.stringify...

High

Eval

Package source references dynamic code evaluation.

dist/chunks/cli-1.1.19-ybe27dz9.mjsView on unpkg · L1

dist/chunks/cli-1.1.19-n5xxe310.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-n5xxe310.mjsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/cli-1.1.19-n5xxe310.mjsView on unpkg · L18

dist/chunks/cli-1.1.19-hqbspnvc.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.19-hqbspnvc.mjsView on unpkg · L614

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.19-hqbspnvc.mjs

dist/chunks/index-1.1.19-f53qyqj8.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.19-f53qyqj8.mjsView on unpkg · L1

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.19-w4a9xacm.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.19-w4a9xacm.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.19-7v3pjgvw.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-7v3pjgvw.mjsView on unpkg

dist/chunks/cli-1.1.19-m8w4as34.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-m8w4as34.mjsView on unpkg

dist/chunks/cli-1.1.19-v619rbr5.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-v619rbr5.mjsView on unpkg

dist/chunks/protocolHandler-1.1.19-6n3sh10m.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/protocolHandler-1.1.19-6n3sh10m.mjsView on unpkg

dist/chunks/cli-1.1.19-vpabfve5.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-vpabfve5.mjsView on unpkg

dist/chunks/cli-1.1.19-kjhw0mpy.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-kjhw0mpy.mjsView on unpkg

dist/chunks/index-1.1.19-mppepmze.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.19-mppepmze.mjsView on unpkg

dist/chunks/processSlashCommand-1.1.19-gy6nfdzs.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/processSlashCommand-1.1.19-gy6nfdzs.mjsView on unpkg

Findings

4 Critical20 High6 Medium6 Low

CriticalSame File Env Network Executiondist/chunks/cli-1.1.19-hqbspnvc.mjs

CriticalCredential Exfiltrationdist/chunks/cli-1.1.19-hqbspnvc.mjs

CriticalReverse Shelldist/chunks/cli-1.1.19-hqbspnvc.mjs

CriticalPrevious Version Dangerous Deltadist/chunks/bridgeMain-1.1.19-yzzr33jg.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunks/node-1.1.19-nj9qe6mk.mjs

HighShelldist/chunks/cli-1.1.19-dt84yfk2.mjs

HighEvaldist/chunks/cli-1.1.19-ybe27dz9.mjs

HighCommand Output Exfiltrationdist/chunks/cli-1.1.19-dt84yfk2.mjs

HighCloud Metadata Accessdist/chunks/index-1.1.19-f53qyqj8.mjs

HighRemote Agent Bridgedist/chunks/cli-1.1.19-hqbspnvc.mjs

HighCross File Remote Execution Contextdist/chunks/bridgeMain-1.1.19-yzzr33jg.mjs

HighSemantic Analysis Limiteddist/chunks/cache-probe-1.1.19-w4a9xacm.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritydist/chunks/cli-1.1.19-dt84yfk2.mjs

HighKnown Malware Source Similaritydist/chunks/cli-1.1.19-7v3pjgvw.mjs

HighKnown Malware Source Similaritydist/chunks/cli-1.1.19-hqbspnvc.mjs

HighKnown Malware Source Similaritydist/chunks/cli-1.1.19-m8w4as34.mjs

HighKnown Malware Source Similaritydist/chunks/cli-1.1.19-n5xxe310.mjs

HighKnown Malware Source Similaritydist/chunks/cli-1.1.19-v619rbr5.mjs

HighKnown Malware Source Similaritydist/chunks/protocolHandler-1.1.19-6n3sh10m.mjs

HighKnown Malware Source Similaritydist/chunks/cli-1.1.19-vpabfve5.mjs

HighKnown Malware Source Similaritydist/chunks/cli-1.1.19-kjhw0mpy.mjs

HighKnown Malware Source Similaritydist/chunks/index-1.1.19-mppepmze.mjs

HighKnown Malware Source Similaritydist/chunks/processSlashCommand-1.1.19-gy6nfdzs.mjs

MediumSecret Patterndist/chunks/openaiShim-1.1.19-njr80kze.mjs

MediumDynamic Requiredist/chunks/cli-1.1.19-n5xxe310.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/claudin.exe

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/chunks/cli-1.1.19-hqbspnvc.mjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

28 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.19",

36 "@claudiolabs/claudin-darwin-arm64": "1.1.19",

37 "@claudiolabs/claudin-win32-x64": "1.1.19",

38 "@claudiolabs/claudin-darwin-x64": "1.1.19",

39 "@claudiolabs/claudin-linux-x64": "1.1.19",

40 "@claudiolabs/claudin-linux-arm64": "1.1.19",

41 "@claudiolabs/claudin-win32-arm64": "1.1.19",

42 "@claudiolabs/claudin-linux-arm64-musl": "1.1.19"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/openaiShim-1.1.19-njr80kze.mjsView file

Lines 1-15javascript

1import{Li as QZ,Mi as W0,Ni as WZ}from"./cli-1.1.19-nqznsj8y.mjs";import{Qi as l$,Si as J1}from"./cli-1.1.19-a32dnq28.mjs";import{$r as EZ,Aj as R$,Dq as Z0,Dr as

dist/chunks/node-1.1.19-nj9qe6mk.mjsView file

Lines 1-13javascript

1import{$ra as vQ,Zra as y,_ra as D,asa as O,hsa as e,isa as QQ,jsa as RQ,ksa as NQ,lsa as W,msa as r,nsa as n,osa as fQ,rsa as kQ}from"./cli-1.1.19-hph7gbkv.mjs"

dist/chunks/cli-1.1.19-dt84yfk2.mjsView file

Lines 1-21javascript

1import{Eha as Y6,Iha as QB}from"./cli-1.1.19-nb1256fg.mjs";import{Qha as fq,Rha as Z6,Sha as jk}from"./cli-1.1.19-89n0ppp5.mjs";import{aia as s1,mia as Iq}from"./cli-1.1.19-x6xnsxay.mjs"

dist/chunks/cli-1.1.19-ybe27dz9.mjsView file

Lines 1-21javascript

1import{Kla as ag,Vla as l4}from"./cli-1.1.19-5eb8a4wn.mjs";import{jta as ir,kta as N,lta as Cg}from"./cli-1.1.19-cc266ybe.mjs";function fg(r){let i

dist/chunks/cli-1.1.19-n5xxe310.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-n5xxe310.mjsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/cli-1.1.19-n5xxe310.mjsView on unpkg · L18

dist/chunks/cli-1.1.19-hqbspnvc.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.19-hqbspnvc.mjsView on unpkg · L614

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.19-hqbspnvc.mjs

dist/chunks/index-1.1.19-f53qyqj8.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.19-f53qyqj8.mjsView on unpkg · L1

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.19-yzzr33jg.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.19-w4a9xacm.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.19-w4a9xacm.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.19-7v3pjgvw.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-7v3pjgvw.mjsView on unpkg

dist/chunks/cli-1.1.19-m8w4as34.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-m8w4as34.mjsView on unpkg

dist/chunks/cli-1.1.19-v619rbr5.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-v619rbr5.mjsView on unpkg

dist/chunks/protocolHandler-1.1.19-6n3sh10m.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/protocolHandler-1.1.19-6n3sh10m.mjsView on unpkg

dist/chunks/cli-1.1.19-vpabfve5.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-vpabfve5.mjsView on unpkg

dist/chunks/cli-1.1.19-kjhw0mpy.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.19-kjhw0mpy.mjsView on unpkg

dist/chunks/index-1.1.19-mppepmze.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.19-mppepmze.mjsView on unpkg

dist/chunks/processSlashCommand-1.1.19-gy6nfdzs.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/processSlashCommand-1.1.19-gy6nfdzs.mjsView on unpkg

@claudiolabs/claudin@1.1.19

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code