@claudiolabs/claudin@1.1.30: Suspicious npm security report

Loading npm security reports…

@claudiolabs/claudin@1.1.30: Suspicious npm security report | LPM Firewall

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.30",

36 "@claudiolabs/claudin-linux-arm64": "1.1.30",

37 "@claudiolabs/claudin-darwin-arm64": "1.1.30",

38 "@claudiolabs/claudin-linux-arm64-musl": "1.1.30",

39 "@claudiolabs/claudin-linux-x64": "1.1.30",

40 "@claudiolabs/claudin-win32-x64": "1.1.30",

41 "@claudiolabs/claudin-darwin-x64": "1.1.30",

42 "@claudiolabs/claudin-win32-arm64": "1.1.30"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/openaiShim-1.1.30-rz4xax1e.mjsView file

Lines 1-15javascript

1import{lj as QZ,mj as D0,nj as WZ}from"./cli-1.1.30-092dkm0p.mjs";import{qj as l$,sj as Y1}from"./cli-1.1.30-pez1sh7w.mjs";import{$j as d$,Er as z1,Fr as Z$,KR as

dist/chunks/cli-1.1.30-pc2wp50b.mjsView file

878L879: ONLY return the prefix. Do not return any other text, markdown markers, or other content or formatting.`,KI0,oM,qI0,HJ8;var sY=P(()=>{lE0();M00();YJ();uU=new Set(["0","1","2"]);KI0... L880: `)});let z=!1;W.on("close",(H)=>{if(z)return;if(z=!0,H===0||H===1)q(G);else V(Error(`rg --files exited ${H}`))}),W.on("error",(H)=>{if(z)return;z=!0,V(y00(H)&&H.code==="ENOENT"?S00... ... L889: `)&&pS.test(K.target))return{ok:!1,reason:"Newline followed by # inside a redirect target can hide arguments from path validation"};if(Y==="jq"){for(let K of Q)if(/\bsystem\s*\(/.t... L890: `]);DZ8=/[ \t\n*?[]/,NZ8=/^-[ioe]$/,AZ8=/^-[ioe]./,MZ8=/^--(input|output|error)=/,RZ8=new Set(["HOME","PWD","OLDPWD","USER","LOGNAME","SHELL","PATH","HOSTNAME","UID","EUID","PPID",... L891: `);return[`<cwd>${Z}</c

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L878

58- This tool can read Jupyter notebooks (.ipynb files) and returns all cells with their outputs, combining code, text, and visualizations. L59: - Do NOT re-read a file you just edited to verify the change — Edit/Write would have errored if it failed, and the harness tracks file state for you.`}var E9="Read",Ij="File unchan... L60: - Allows Claude to search the web and use the results to inform responses ... L74: Sources: L75: - [Source Title 1](https://example.com/1) L76: - [Source Title 2](https://example.com/2) ... L129: - For GitHub URLs, prefer using the gh CLI via Bash instead (e.g., gh pr view, gh issue view, gh api). L130: `;var PX=()=>{};var n8="PowerShell";var Jq=()=>{};function mv(){if(K9()!=="windows")return!1;return r(process.env.CLAUDIN_USE_POWERSHELL_TOOL)}var _j;var bj=P

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.29 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.29 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjs spawns dist/chunks/cli-1.1.30-569esepc.mjs; helper contains network access plus dynamic code execution. L1: import{ea as yJ,fa as xz,ga as rz,ha as cz,ia as iz,ja as kJ}from"./cli-1.1.30-rdgv4qpw.mjs";import{la as Tz}from"./cli-1.1.30-p6bsj13y.mjs";import{va as EJ,wa as TJ,xa as xJ,ya as... L2: `).filter((K)=>K.length>0)}function VJ(z){let J=z.write??(($)=>process.stdout.write($)),K=z.verbose,Y=0,O="idle",Z="Ready",R="",B="",U="",F="",L="",A=null,_=[],M=!1,y=null,P=0,x=0,... L3: `)){if(Vz.length===0){w++;continue}let _z=sz(Vz);w+=Math.max(1,Math.ceil(_z/G))}if($.endsWith(` ... L31: `),$)m(`${V.red($)} L32: `)},updateSessionStatus($,G,w,Vz){if(w.type==="tool_start")y=w.summary,P=Date.now();p()},clearStatus(){t(),a

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.30-mebteknr.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-mvjefec1.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-mebteknr.mjsView on unpkg

dist/chunks/cli-1.1.30-xrrzhx6s.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-vypd5zf6.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-xrrzhx6s.mjsView on unpkg

dist/chunks/cli-1.1.30-c70p43p6.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-55ayan24.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 32 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-c70p43p6.mjsView on unpkg

dist/chunks/cli-1.1.30-wmpgbhw0.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-tgtv1jp3.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-wmpgbhw0.mjsView on unpkg

dist/chunks/cli-1.1.30-j2wahkcp.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-01erqdx7.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-j2wahkcp.mjsView on unpkg

dist/chunks/cli-1.1.30-4d90v0pd.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-32vewh62.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-4d90v0pd.mjsView on unpkg

dist/chunks/cli-1.1.30-gev0f31f.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-hxty6b5t.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-gev0f31f.mjsView on unpkg

dist/chunks/index-1.1.30-9zfyk995.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/index-1.1.26-syyhrh9b.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.30-9zfyk995.mjsView on unpkg

dist/chunks/cli-1.1.30-2yd2af56.mjsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/chunks/cli-1.1.30-2yd2af56.mjs

dist/chunks/cli-1.1.30-2yd2af56.mjsView on unpkg · L1

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/openaiShim-1.1.30-rz4xax1e.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/openaiShim-1.1.30-rz4xax1e.mjsView on unpkg · L11

dist/chunks/cli-1.1.30-pc2wp50b.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L878

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L58

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L58

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L878

1156L1157: `)}catch(Y){return k9("error","git_status_failed",{duration_ms:Date.now()-J}),k(Y),null}}),pq=X9(async()=>{let J=Date.now();k9("info","system_context_started");let Z=r(process.env.... L1158: `).filter((K)=>K),Y=Math.min(...Q.map((K)=>K.length-K.trimStart().length)),X=Q.map((K)=>K.slice(Y)).map((K)=>" ".repeat(this.indent*2)+K);for(let K of X)this.content.push(K)}compil...

High

Eval

Package source references dynamic code evaluation.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L1156

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L878

138`)).includes(Q))}function FF0(J,Z){if(!Ms())return!0;let Q=cv(Z);if(Q.trim()==="")return!0;if(J.injectedView!==void 0)return cv(J.injectedView).includes(Q);if(Rs(J))return!0;return... L139: `)).includes(Q))}function OF0(J){let Z=Ps(J);if(Z.length===0)return"no lines";let Q=Z.map(({offset:X,lines:K})=>K.length===1?`${X}`:`${X}-${X+K.length-1}`);return`${Z.length===1&&Z... L140: ... L680: L681: > WARNING: ${sZ} is ${W}. Only part of it was loaded. Keep index entries to one line under ~200 chars; move detail into topic files.`,lineCount:Y,byteCount:X,wasLineTruncated:K,was... L682: `)}function iT(J){if(!u0("tengu_coral_fern",!1))return[];let Z=w6(U9()),Q=NJ()||NM(),Y=Q?`grep -rn "<search term>" ${J} --include="*.md"`:`${b8} with pattern="<search term>" path="... ... L878: L879: ONLY

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L138

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg

•matchType = token_shingles matchedPackage = johns-harness@2026.9.27 matchedPath = dist/reply-C5LKjXcC.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.27 similarity = 1.000 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L58

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.30-mebteknr.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-mebteknr.mjsView on unpkg

dist/chunks/cli-1.1.30-xrrzhx6s.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-xrrzhx6s.mjsView on unpkg

dist/chunks/cli-1.1.30-c70p43p6.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-c70p43p6.mjsView on unpkg

dist/chunks/cli-1.1.30-wmpgbhw0.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-wmpgbhw0.mjsView on unpkg

dist/chunks/cli-1.1.30-j2wahkcp.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-j2wahkcp.mjsView on unpkg

dist/chunks/cli-1.1.30-4d90v0pd.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-4d90v0pd.mjsView on unpkg

dist/chunks/cli-1.1.30-gev0f31f.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-gev0f31f.mjsView on unpkg

dist/chunks/index-1.1.30-9zfyk995.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.30-9zfyk995.mjsView on unpkg

dist/chunks/cli-1.1.30-2yd2af56.mjsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/chunks/cli-1.1.30-2yd2af56.mjs

dist/chunks/cli-1.1.30-2yd2af56.mjsView on unpkg · L1

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.30",

36 "@claudiolabs/claudin-linux-arm64": "1.1.30",

37 "@claudiolabs/claudin-darwin-arm64": "1.1.30",

38 "@claudiolabs/claudin-linux-arm64-musl": "1.1.30",

39 "@claudiolabs/claudin-linux-x64": "1.1.30",

40 "@claudiolabs/claudin-win32-x64": "1.1.30",

41 "@claudiolabs/claudin-darwin-x64": "1.1.30",

42 "@claudiolabs/claudin-win32-arm64": "1.1.30"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/openaiShim-1.1.30-rz4xax1e.mjsView file

Lines 1-15javascript

1import{lj as QZ,mj as D0,nj as WZ}from"./cli-1.1.30-092dkm0p.mjs";import{qj as l$,sj as Y1}from"./cli-1.1.30-pez1sh7w.mjs";import{$j as d$,Er as z1,Fr as Z$,KR as

dist/chunks/cli-1.1.30-pc2wp50b.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.30-pc2wp50b.mjsView on unpkg · L878

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.30-9cpc29zx.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.30-mebteknr.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-mebteknr.mjsView on unpkg

dist/chunks/cli-1.1.30-xrrzhx6s.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-xrrzhx6s.mjsView on unpkg

dist/chunks/cli-1.1.30-c70p43p6.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-c70p43p6.mjsView on unpkg

dist/chunks/cli-1.1.30-wmpgbhw0.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-wmpgbhw0.mjsView on unpkg

dist/chunks/cli-1.1.30-j2wahkcp.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-j2wahkcp.mjsView on unpkg

dist/chunks/cli-1.1.30-4d90v0pd.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-4d90v0pd.mjsView on unpkg

dist/chunks/cli-1.1.30-gev0f31f.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.30-gev0f31f.mjsView on unpkg

dist/chunks/index-1.1.30-9zfyk995.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.30-9zfyk995.mjsView on unpkg

dist/chunks/cli-1.1.30-2yd2af56.mjsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/chunks/cli-1.1.30-2yd2af56.mjs

dist/chunks/cli-1.1.30-2yd2af56.mjsView on unpkg · L1

@claudiolabs/claudin@1.1.30

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code