@claudiolabs/claudin@1.1.28: Suspicious npm security report

Loading npm security reports…

@claudiolabs/claudin@1.1.28: Suspicious npm security report | LPM Firewall

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package automatically runs an install script after npm installation.
The install script replaces its launcher with a platform binary and copies a vendored executable.
Runtime update code installs another release of this same package into a user-local directory.
Runtime maintenance code edits shell startup files to remove a claude alias.
The launcher executes a platform-specific binary that is supplied by optional packages.

Evidence against

The inspected postinstall writes only under this package's bin directory and selects same-vendor optional dependencies.
The nested installation and shell-file change are runtime update or migration functions, not invoked by the postinstall source inspected.
No credential harvesting, secret exfiltration, remote payload download, or broad project-control-surface write was established from the inspected paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 461 file(s), 8.69 MB of source, external domains: 1.1.1.1, 127.0.0.1, 169.254.169.254, 169.254.170.2, a.co, anthropic.com, api.anthropic.com, api.githubcopilot.com, api.kimi.com, api.minimax.io, api.openai.com, app.corridor.dev, beacon.claude-ai.staging.ant.dev, clau.de, claude-staging.fedstart.com, claude.ai, claude.com, claude.fedstart.com, code.claude.com, docs.anthropic.com, docs.aws.amazon.com, docs.claude.com, docs.expo.dev, duckduckgo.com, example.com, external-content.duckduckgo.com, fonts.googleapis.com, github.com, json-schema.org, json.schemastore.org, links.duckduckgo.com, mcp-proxy.anthropic.com, mcp.sentry.dev, models.github.ai, mths.be, platform.claude.com, portal.sso, portal.sso-fips, raw.githubusercontent.com, react-native.canny.io, react.dev, slack.com, sts.amazonaws.com, support.claude.com, www.googleapis.com, www.ibm.com, www.schemastore.org, www.stickermule.com, www.w3.org, your-resource-name.services.ai.azure.com

Oversized source lightweight scan

dist/chunks/cli-1.1.28-zhftjycn.mjs3.68 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsexample.comraw.githubusercontent.com

Source & flagged code

16 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.28",

36 "@claudiolabs/claudin-linux-arm64": "1.1.28",

37 "@claudiolabs/claudin-darwin-arm64": "1.1.28",

38 "@claudiolabs/claudin-linux-arm64-musl": "1.1.28",

39 "@claudiolabs/claudin-linux-x64": "1.1.28",

40 "@claudiolabs/claudin-win32-x64": "1.1.28",

41 "@claudiolabs/claudin-darwin-x64": "1.1.28",

42 "@claudiolabs/claudin-win32-arm64": "1.1.28"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/openaiShim-1.1.28-qt0bgn0p.mjsView file

Lines 1-15javascript

1import{$i as WZ,Zi as QZ,_i as J0}from"./cli-1.1.28-rbjeq16x.mjs";import{cj as l$,ej as D1}from"./cli-1.1.28-sz8sgxj4.mjs";import{$R as TZ,Hj as U$,Ij as tZ,Jj as a,Kj as

dist/chunks/cli-1.1.28-94sk1z8g.mjsView file

Lines 1-6javascript

1import{cp as y,gp as r,pG as F,qG as S,tG as C,zG as a}from"./cli-1.1.28-zhftjycn.mjs";import{a0 as D,b0 as o,c0 as z,d0 as b}from

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/cli-1.1.28-avxe0zxq.mjsView file

Lines 1-16javascript

1import{I3 as qJ,L3 as VJ}from"./cli-1.1.28-zarbrcn7.mjs";import{$ha as q,Bga as m,Gca as U,Ica as E,Nca as ZJ,Pca as TJ,Raa as YJ,S$ as W,Saa as jJ,T$ as

dist/chunks/cli-1.1.28-5y1xeh89.mjsView file

Lines 1-21javascript

1import{Jia as Y6,Nia as XB}from"./cli-1.1.28-8avwqt1z.mjs";import{Via as fq,Wia as Z6,Xia as Ak}from"./cli-1.1.28-3bj091x6.mjs";import{fja as s1,rja as Oq}from"./cli-1.1.28-es8var4t.mjs"

dist/chunks/watchLoop-1.1.28-rtznty0c.mjsView file

Lines 1-14javascript

dist/chunks/index-1.1.28-xaw4tf13.mjsView file

Lines 1-31javascript

1import{Tta as A,Wta as v}from"./cli-1.1.28-3fssr567.mjs";var D8=A((i)=>{var B1=i&&i.__assign||function(){

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.20 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.20 similarity = 0.542 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjs spawns dist/chunks/cli-1.1.28-0njtm2nf.mjs; helper contains network access plus dynamic code execution. L1: import{ea as yJ,fa as xz,ga as rz,ha as cz,ia as iz,ja as kJ}from"./cli-1.1.28-hxbkncxe.mjs";import{la as Tz}from"./cli-1.1.28-a79xcdg3.mjs";import{va as EJ,wa as TJ,xa as xJ,ya as... L2: `).filter((K)=>K.length>0)}function VJ(z){let J=z.write??(($)=>process.stdout.write($)),K=z.verbose,Y=0,O="idle",Z="Ready",R="",B="",U="",F="",L="",A=null,_=[],M=!1,y=null,P=0,x=0,... L3: `)){if(Vz.length===0){w++;continue}let _z=sz(Vz);w+=Math.max(1,Math.ceil(_z/G))}if($.endsWith(` ... L31: `),$)m(`${V.red($)} L32: `)},updateSessionStatus($,G,w,Vz){if(w.type==="tool_start")y=w.summary,P=Date.now();p()},clearStatus(){t(),a

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.28-4sxh2jyw.mjsView file

1import"./cli-1.1.28-ze1j03ww.mjs";import{B as PG,C as BG,D as IZ,E as BZ,z as a}from"./cli-1.1.28-jqnzq23v.mjs";import"./cli-1.1.28-mkm05wf9.mjs";import"./cli-1.1.28-7d7hz6b4.mjs";... L2: `)),process.exit(1);if(pI()==="windows")process.stderr.write(Q.red(`Error: --tmux is not supported on Windows ... L26: 1. **Code review** — Invoke the \`${jB}\` tool with \`skill: "code-review"\` and \`args: "medium"\` to get a correctness-bug report on your changes, then fix every reported bug bef... L27: 2. **Run unit tests** — Run the project's test suite (check for package.json scripts, Makefile targets, or common commands like \`npm test\`, \`bun test\`, \`pytest\`, \`go test\`)... L28: 3. **Test end-to-end** — Follow the e2e test recipe from the coordinator's prompt (below). If the recipe says t

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.28-4sxh2jyw.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.28-avxe0zxq.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cli-1.1.28-avxe0zxq.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.28-zhftjycn.mjsView file

•matchType = token_shingles matchedPackage = @clicktap/state@3.0.8 matchedPath = helpers/index.mjs matchedIdentity = npm:QGNsaWNrdGFwL3N0YXRl:3.0.8 similarity = 1.000 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.28-zhftjycn.mjsView on unpkg

dist/chunks/cli-1.1.28-vctvnrwx.mjsView file

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/REPL-DPOsR0Mc.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 0.865 shingleOverlap = 32 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.28-vctvnrwx.mjsView on unpkg

dist/chunks/cli-1.1.28-130w2y17.mjsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/chunks/cli-1.1.28-130w2y17.mjs

dist/chunks/cli-1.1.28-130w2y17.mjsView on unpkg · L1

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/openaiShim-1.1.28-qt0bgn0p.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/openaiShim-1.1.28-qt0bgn0p.mjsView on unpkg · L11

dist/chunks/cli-1.1.28-94sk1z8g.mjsView file

1import{cp as y,gp as r,pG as F,qG as S,tG as C,zG as a}from"./cli-1.1.28-zhftjycn.mjs";import{a0 as D,b0 as o,c0 as z,d0 as b}from"./cli-1.1.28-0njtm2nf.mjs";import{haa as R,iaa as... L2: `)&&!Q.endsWith(`

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.28-94sk1z8g.mjsView on unpkg · L1

cli-wrapper.cjsView file

14L15: const { spawnSync } = require('child_process') L16: const { arch, constants } = require('os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli-wrapper.cjsView on unpkg · L14

dist/chunks/cli-1.1.28-avxe0zxq.mjsView file

1import{I3 as qJ,L3 as VJ}from"./cli-1.1.28-zarbrcn7.mjs";import{$ha as q,Bga as m,Gca as U,Ica as E,Nca as ZJ,Pca as TJ,Raa as YJ,S$ as W,Saa as jJ,T$ as f,cfa as $J,dga as w,hia a... L2: exec "${J}/node_modules/.bin/claudin" "$@"`,493))await BJ(Q,493);return!0}catch(J){return q(J),!1}}async function JQ(J,Q){try{if(!await OJ())return"install_failed";let Z=await W("n... L3: `)}catch(Q){if(n(Q))return null;throw Q}}async function l(J,Q){let Y=await MJ(J,"w");try{await Y.writeFile(Q.join(`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunks/cli-1.1.28-avxe0zxq.mjsView on unpkg · L1

dist/chunks/cli-1.1.28-5y1xeh89.mjsView file

1import{Jia as Y6,Nia as XB}from"./cli-1.1.28-8avwqt1z.mjs";import{Via as fq,Wia as Z6,Xia as Ak}from"./cli-1.1.28-3bj091x6.mjs";import{fja as s1,rja as Oq}from"./cli-1.1.28-es8var4... L2: `;try{$.appendFileSync(X,Y)}catch{try{$.mkdirSync(w_(X)),$.appendFileSync(X,Y)}catch{}}}function k_(){return process.env.CLAUDIN_DIAGNOSTICS_FILE}async function Pv(Z,q,J){let X=Dat... ... L4: `;break;case"t":J+="\t";break;case"b":J+="\b";break;case'"':J+='"';break;case"\\":J+="\\";break;default:J+=Y;break}Q+=2;continue}if(Y==="\\"){J+="\\",Q+=2;continue}}J+=$,Q++}if(!X)... L5: `)){if(X.startsWith("#")||X.startsWith("^"))continue;let Q=X.indexOf(" ");if(Q===-1)continue;if(X.slice(Q+1)===q){let $=X.slice(0,Q);return X3($)?$:null}}}catch{}return null}async ... L6: `)Y-=1,H+=1;else if(U==="u"&&q[H+2]==="{

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/cli-1.1.28-5y1xeh89.mjsView on unpkg · L1

dist/chunks/watchLoop-1.1.28-rtznty0c.mjsView file

1import{a as A,g as j}from"./cli-1.1.28-bwgr7j8z.mjs";import{$ha as $,hia as C}from"./cli-1.1.28-5y1xeh89.mjs";import"./cli-1.1.28-8avwqt1z.mjs";import"./cli-1.1.28-7e3nqd5c.mjs";im... L2: ${X}`)}`;Z.push({id:G,title:W||U(X),body:X||W})}return Z}function N(q){return typeof q==="object"&&q!==null&&!Array.isArray(q)}function J(q){return typeof q==="string"&&q.trim()?q....

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/watchLoop-1.1.28-rtznty0c.mjsView on unpkg · L1

dist/chunks/index-1.1.28-xaw4tf13.mjsView file

20contains invisible/control Unicode U+200B (zero width space) \v\f\r\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.28-xaw4tf13.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.28-4sxh2jyw.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.28-4sxh2jyw.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.28-avxe0zxq.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cli-1.1.28-avxe0zxq.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.28-zhftjycn.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.28-zhftjycn.mjsView on unpkg

dist/chunks/cli-1.1.28-vctvnrwx.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.28-vctvnrwx.mjsView on unpkg

dist/chunks/cli-1.1.28-130w2y17.mjsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/chunks/cli-1.1.28-130w2y17.mjs

dist/chunks/cli-1.1.28-130w2y17.mjsView on unpkg · L1

Source & flagged code

16 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.28",

36 "@claudiolabs/claudin-linux-arm64": "1.1.28",

37 "@claudiolabs/claudin-darwin-arm64": "1.1.28",

38 "@claudiolabs/claudin-linux-arm64-musl": "1.1.28",

39 "@claudiolabs/claudin-linux-x64": "1.1.28",

40 "@claudiolabs/claudin-win32-x64": "1.1.28",

41 "@claudiolabs/claudin-darwin-x64": "1.1.28",

42 "@claudiolabs/claudin-win32-arm64": "1.1.28"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/openaiShim-1.1.28-qt0bgn0p.mjsView file

Lines 1-15javascript

1import{$i as WZ,Zi as QZ,_i as J0}from"./cli-1.1.28-rbjeq16x.mjs";import{cj as l$,ej as D1}from"./cli-1.1.28-sz8sgxj4.mjs";import{$R as TZ,Hj as U$,Ij as tZ,Jj as a,Kj as

dist/chunks/cli-1.1.28-94sk1z8g.mjsView file

Lines 1-6javascript

1import{cp as y,gp as r,pG as F,qG as S,tG as C,zG as a}from"./cli-1.1.28-zhftjycn.mjs";import{a0 as D,b0 as o,c0 as z,d0 as b}from

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/cli-1.1.28-avxe0zxq.mjsView file

Lines 1-16javascript

1import{I3 as qJ,L3 as VJ}from"./cli-1.1.28-zarbrcn7.mjs";import{$ha as q,Bga as m,Gca as U,Ica as E,Nca as ZJ,Pca as TJ,Raa as YJ,S$ as W,Saa as jJ,T$ as

dist/chunks/cli-1.1.28-5y1xeh89.mjsView file

Lines 1-21javascript

1import{Jia as Y6,Nia as XB}from"./cli-1.1.28-8avwqt1z.mjs";import{Via as fq,Wia as Z6,Xia as Ak}from"./cli-1.1.28-3bj091x6.mjs";import{fja as s1,rja as Oq}from"./cli-1.1.28-es8var4t.mjs"

dist/chunks/watchLoop-1.1.28-rtznty0c.mjsView file

Lines 1-14javascript

dist/chunks/index-1.1.28-xaw4tf13.mjsView file

Lines 1-31javascript

1import{Tta as A,Wta as v}from"./cli-1.1.28-3fssr567.mjs";var D8=A((i)=>{var B1=i&&i.__assign||function(){

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.28-pyr5gvmx.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.28-4sxh2jyw.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.28-4sxh2jyw.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.28-avxe0zxq.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cli-1.1.28-avxe0zxq.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.28-zhftjycn.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.28-zhftjycn.mjsView on unpkg

dist/chunks/cli-1.1.28-vctvnrwx.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.28-vctvnrwx.mjsView on unpkg

dist/chunks/cli-1.1.28-130w2y17.mjsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/chunks/cli-1.1.28-130w2y17.mjs

dist/chunks/cli-1.1.28-130w2y17.mjsView on unpkg · L1

@claudiolabs/claudin@1.1.28

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code