@claudiolabs/claudin@1.1.21: Suspicious npm security report

Loading npm security reports…

@claudiolabs/claudin@1.1.21: Suspicious npm security report | LPM Firewall

Source & flagged code

25 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.21",

36 "@claudiolabs/claudin-darwin-arm64": "1.1.21",

37 "@claudiolabs/claudin-win32-x64": "1.1.21",

38 "@claudiolabs/claudin-darwin-x64": "1.1.21",

39 "@claudiolabs/claudin-linux-x64": "1.1.21",

40 "@claudiolabs/claudin-linux-arm64": "1.1.21",

41 "@claudiolabs/claudin-win32-arm64": "1.1.21",

42 "@claudiolabs/claudin-linux-arm64-musl": "1.1.21"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.21-s076czd6.mjsView file

Lines 1-21javascript

1import{J1 as TO,M1 as tF}from"./cli-1.1.21-1a9968t0.mjs";import{$1 as nz,N1 as p0,O1 as E0,P1 as g0,Q1 as Z6,R1 as L1,S1 as fG,T1 as TZ,U1 as Mj,V1 as

dist/chunks/cli-1.1.21-eray52nd.mjsView file

615L616: REMEMBER: You can ONLY explore and plan. You CANNOT and MUST NOT write, edit, or modify any files. You do NOT have access to file editing tools.`}var Fj;var LC=P(()=>{J6();M4();j6(... L617: Resume this session with: ... L619: `)),FL0=!0}catch{}}function xo(Z){if(kC!==void 0)clearTimeout(kC),kC=void 0;try{eN.get(process.stdout)?.drainStdin()}catch{}try{process.exit(Z)}catch(J){process.kill(process.pid,"S... L620: `)}catch{}xo(Z)}var FL0=!1,Du9,ko=!1,kC,To,Nu9,xL0;var Nj=P(()=>{N5();a8();Fu9();E0();yL0();Ou9();Lu9();SL0();UL0();wu9();x0();xJ();G0();eY();C0();gZ();D7();Uu9();Du9=e0(()=>{if(DL... L621: `),Q=J.length-1;for(;Q>=0&&zQ.blankLine.test(J[Q]);)Q--;return J.length-Q<=2?Z:J.slice(0,Q+1).join(`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.21-eray52nd.mjsView on unpkg · L615

62- Otherwise, emit the Reads as parallel tool_use blocks in the same assistant message. Same-turn parallel Reads are first-class. L63: A serial loop of Read → short comment → Read → short comment is the wrong shape.`}var R9="Read",f$="File unchanged since last read. The content from the earlier Read tool_result in... L64: - Allows Claude to search the web and use the results to inform responses ... L78: Sources: L79: - [Source Title 1](https://example.com/1) L80: - [Source Title 2](https://example.com/2) ... L138: - Use this tool when you need to find files by name patterns, including what \`find\` is reached for: depth, directories, exclusions L139: - When you are doing an open ended search that may require multiple rounds of globbing and grepping, use the Agent tool instead`;var g7=(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.21-eray52nd.mjs

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.30 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.30 similarity = 0.517 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.21-e92yewh9.mjs spawns dist/chunks/cli-1.1.21-2b91fkp9.mjs; helper contains network access plus dynamic code execution. L1: import{sb as yJ,tb as xz,ub as rz,vb as cz,wb as iz,xb as kJ}from"./cli-1.1.21-qz8ykx4a.mjs";import{zb as Tz}from"./cli-1.1.21-2txzm68v.mjs";import{Jb as EJ,Kb as TJ,Lb as xJ,Mb as... L2: `).filter((K)=>K.length>0)}function VJ(z){let J=z.write??(($)=>process.stdout.write($)),K=z.verbose,Y=0,O="idle",Z="Ready",R="",B="",U="",F="",L="",A=null,_=[],M=!1,y=null,P=0,x=0,... L3: `)){if(Vz.length===0){w++;continue}let _z=sz(Vz);w+=Math.max(1,Math.ceil(_z/G))}if($.endsWith(` ... L31: `),$)m(`${V.red($)} L32: `)},updateSessionStatus($,G,w,Vz){if(w.type==="tool_start")y=w.summary,P=Date.now();p()},clearStatus(){t(),a

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.21-g6wtm4qg.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-mvjefec1.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-g6wtm4qg.mjsView on unpkg

dist/chunks/cli-1.1.21-kc7af745.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-vypd5zf6.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-kc7af745.mjsView on unpkg

dist/chunks/cli-1.1.21-5bxzgpbd.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-tgtv1jp3.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-5bxzgpbd.mjsView on unpkg

dist/chunks/cli-1.1.21-ayg2p1x9.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-55ayan24.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 32 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-ayg2p1x9.mjsView on unpkg

dist/chunks/protocolHandler-1.1.21-e974kgtb.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/protocolHandler-1.1.26-qfw93skn.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/protocolHandler-1.1.21-e974kgtb.mjsView on unpkg

dist/chunks/cli-1.1.21-ekphtr04.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-01erqdx7.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-ekphtr04.mjsView on unpkg

dist/chunks/cli-1.1.21-xg5fsk6h.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-32vewh62.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-xg5fsk6h.mjsView on unpkg

dist/chunks/index-1.1.21-593vrygw.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/index-1.1.26-syyhrh9b.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.21-593vrygw.mjsView on unpkg

dist/chunks/processSlashCommand-1.1.21-cwxbh5pw.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/processSlashCommand-1.1.26-watbp07x.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/processSlashCommand-1.1.21-cwxbh5pw.mjsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/cli-1.1.21-s076czd6.mjsView file

1import{J1 as TO,M1 as tF}from"./cli-1.1.21-1a9968t0.mjs";import{$1 as nz,N1 as p0,O1 as E0,P1 as g0,Q1 as Z6,R1 as L1,S1 as fG,T1 as TZ,U1 as Mj,V1 as EQ,W1 as _j,X1 as r4,Y1 as q7... L2: `)G.name="enter";else if(Z==="\t")G.name="tab";else if(Z==="\b"||Z==="\x1B\b")G.name="backspace",G.meta=Z.charAt(0)==="\x1B";else if(Z===""||Z==="\x1B")G.name="backspace",G.meta=...

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.21-s076czd6.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-nv2mgz6h.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-s076czd6.mjsView on unpkg

dist/chunks/cli-1.1.21-eray52nd.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.21-eray52nd.mjsView on unpkg · L615

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.21-eray52nd.mjs

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.21-g6wtm4qg.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-g6wtm4qg.mjsView on unpkg

dist/chunks/cli-1.1.21-kc7af745.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-kc7af745.mjsView on unpkg

dist/chunks/cli-1.1.21-5bxzgpbd.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-5bxzgpbd.mjsView on unpkg

dist/chunks/cli-1.1.21-ayg2p1x9.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-ayg2p1x9.mjsView on unpkg

dist/chunks/protocolHandler-1.1.21-e974kgtb.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/protocolHandler-1.1.21-e974kgtb.mjsView on unpkg

dist/chunks/cli-1.1.21-ekphtr04.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-ekphtr04.mjsView on unpkg

dist/chunks/cli-1.1.21-xg5fsk6h.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-xg5fsk6h.mjsView on unpkg

dist/chunks/index-1.1.21-593vrygw.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.21-593vrygw.mjsView on unpkg

dist/chunks/processSlashCommand-1.1.21-cwxbh5pw.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/processSlashCommand-1.1.21-cwxbh5pw.mjsView on unpkg

Source & flagged code

25 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.21",

36 "@claudiolabs/claudin-darwin-arm64": "1.1.21",

37 "@claudiolabs/claudin-win32-x64": "1.1.21",

38 "@claudiolabs/claudin-darwin-x64": "1.1.21",

39 "@claudiolabs/claudin-linux-x64": "1.1.21",

40 "@claudiolabs/claudin-linux-arm64": "1.1.21",

41 "@claudiolabs/claudin-win32-arm64": "1.1.21",

42 "@claudiolabs/claudin-linux-arm64-musl": "1.1.21"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.21-s076czd6.mjsView file

Lines 1-21javascript

1import{J1 as TO,M1 as tF}from"./cli-1.1.21-1a9968t0.mjs";import{$1 as nz,N1 as p0,O1 as E0,P1 as g0,Q1 as Z6,R1 as L1,S1 as fG,T1 as TZ,U1 as Mj,V1 as

dist/chunks/cli-1.1.21-eray52nd.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.21-eray52nd.mjsView on unpkg · L615

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.21-eray52nd.mjs

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.21-e92yewh9.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.21-g6wtm4qg.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-g6wtm4qg.mjsView on unpkg

dist/chunks/cli-1.1.21-kc7af745.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-kc7af745.mjsView on unpkg

dist/chunks/cli-1.1.21-5bxzgpbd.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-5bxzgpbd.mjsView on unpkg

dist/chunks/cli-1.1.21-ayg2p1x9.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-ayg2p1x9.mjsView on unpkg

dist/chunks/protocolHandler-1.1.21-e974kgtb.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/protocolHandler-1.1.21-e974kgtb.mjsView on unpkg

dist/chunks/cli-1.1.21-ekphtr04.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-ekphtr04.mjsView on unpkg

dist/chunks/cli-1.1.21-xg5fsk6h.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.21-xg5fsk6h.mjsView on unpkg

dist/chunks/index-1.1.21-593vrygw.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.21-593vrygw.mjsView on unpkg

dist/chunks/processSlashCommand-1.1.21-cwxbh5pw.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/processSlashCommand-1.1.21-cwxbh5pw.mjsView on unpkg

@claudiolabs/claudin@1.1.21

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code