Loading npm security reports…

@claudiolabs/claudin@1.1.32: Manual Review npm security report | LPM Firewall

registry / @claudiolabs/claudin / 1.1.32

@claudiolabs/claudin@1.1.32

⚠ Under review

Claudin — Claude Code opened to any LLM (OpenAI, Gemini, DeepSeek, Ollama, and 200+ models)

AI Security Review

scanned 13d ago · by lpm-firewall-ai

No confirmed attack surface was established from the inspected source. The package does have install-time launcher setup and user-invoked update and migration capabilities.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package installation runs the launcher setup; the update and migration behavior require later application actions.

Impact

No confirmed exfiltration, remote code execution, or unconsented broad agent-control mutation was identified.

Mechanism

The installer selects and places a platform launcher. Bundled code can globally update the package and copy a local credentials file during migration.

AI rationale

The package has meaningful lifecycle and local credential-migration behavior, but the inspected evidence does not establish an active attack. A clean verdict requires citations for nineteen designated paths while the result format permits only eight, so the required clean coverage cannot be represented.

Decision evidence

public snapshot

AI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.

AI review observations

The package runs a postinstall launcher setup.
The updater can globally install the same package after a user invokes the update command.
A bundled migration routine can copy an existing Claude credentials file into another local configuration directory.

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.32",

36 "@claudiolabs/claudin-linux-arm64": "1.1.32",

37 "@claudiolabs/claudin-darwin-arm64": "1.1.32",

38 "@claudiolabs/claudin-linux-arm64-musl": "1.1.32",

39 "@claudiolabs/claudin-linux-x64": "1.1.32",

40 "@claudiolabs/claudin-win32-x64": "1.1.32",

41 "@claudiolabs/claudin-darwin-x64": "1.1.32",

42 "@claudiolabs/claudin-win32-arm64": "1.1.32"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.32-yhftam6y.mjsView file

Lines 29-51javascript

29 <h1>Codex login failed</h1>

30 <p>${X2(q)}</p>

31 <p>You can close this window and try again in Claudin.</p>

32 </body>

33</

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView file

18${Q}`,color:"permission",onCancel:()=>J?.("cancel"),isCancelActive:!0,inputGuide:(_)=>_.pending?E(L,{children:["Press ",_.keyName," again to exit"]}):E(tY,{children:[U(sY,{action:"... L19: ${Q}`,color:"permission",onCancel:()=>Z("cancel"),isCancelActive:!0,inputGuide:(w)=>w.pending?E(L,{children:["Press ",w.keyName," again to exit"]}):E(tY,{children:[U(sY,{action:"co... L20: `),k=M.length>q,C=k?M.slice(0,q):M,S=Math.min(z??0,q),T=Math.max(0,S-C.length-(k?1:0)),$=T>0?[...C,...Array(T).fill("")]:C,f=Math.max(V,...$.map(tv)),p=Math.min(f+4,B),v=p-4,t;if(Z...

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView on unpkg · L18

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-55ayan24.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 32 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView on unpkg

dist/chunks/cli-1.1.32-pve0ffcp.mjsView file

Lines 1-21javascript

1import{fha as G6,jha as NB}from"./cli-1.1.32-1rackf2c.mjs";import{rha as Vq,sha as $6,tha as zN}from"./cli-1.1.32-v4chz2b0.mjs";import{Dha as kX,Iha as zw,Jha as WB,Lha

dist/chunks/cli-1.1.32-1913x5jp.mjsView file

Lines 1-16javascript

1import{i2 as $J,l2 as TJ}from"./cli-1.1.32-qmgvm9rq.mjs";import{Dga as m,I_ as QJ,K_ as jJ,N_ as w,cfa as E,gea as ZJ,kaa as K,laa as f,r$ as

dist/chunks/cli-1.1.32-vf3r8a91.mjsView file

Lines 1-17javascript

1import{B6 as D5,D6 as J8}from"./cli-1.1.32-a3dfp7ps.mjs";import{F6 as M,G6 as p$}from"./cli-1.1.32-6jxftegx.mjs";import{I6 as b2,J6 as n$}from"./cli-1.1.32-czrfbd3q.mjs";import

dist/chunks/index-1.1.32-vaknvmtk.mjsView file

1import{Oqa as u,Rqa as k}from"./cli-1.1.32-2wcdy0zp.mjs";import{Wqa as f,Xqa as y}from"./cli-1.1.32-yw64r19c.mjs";function j(z){return new Promise((G,U)=>{let K=g.request({method:"... L2: For more information, please visit: `+Xz);let Q=z.originalExpiration??z.expiration;return{...z,...Q?{originalExpiration:Q}:{},expiration:K}},Zz=(z,G={})=>{let U=G?.logger||console,...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.32-vaknvmtk.mjsView on unpkg · L1

dist/chunks/index-1.1.32-dn9thxs1.mjsView file

20contains invisible/control Unicode U+200B (zero width space) \v\f\r\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.32-dn9thxs1.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.30 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.30 similarity = 0.408 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.32-d20ebbde.mjs spawns dist/chunks/cli-1.1.32-0pmhmsew.mjs; helper contains network access plus dynamic code execution. L1: import{$ as NJ,aa as Mz,ba as PJ,ca as Sz,da as uz,ea as EJ}from"./cli-1.1.32-fr30sgy9.mjs";import{ga as Az}from"./cli-1.1.32-wsqyehdw.mjs";import{$a as _z,_a as oz,ab as rz,bb as ... L2: `).filter((X)=>X.length>0)}function zJ(z){let J=z.write??((Z)=>process.stdout.write(Z)),X=z.verbose,W=0,O="idle",K="Ready",C="",F="",D="",B="",x="",R=null,_=[],M=!1,E=null,P=0,f=0,... L3: `)){if(Wz.length===0){T++;continue}let Nz=lz(Wz);T+=Math.max(1,Math.ceil(Nz/j))}if(Z.endsWith(` ... L31: `),Z)h(`${Q.red(Z)} L32: `)},updateSessionStatus(Z,j,T,Wz){if(T.type==="tool_start")E=T.summary,P=Date.now();S()},clearStatus(){r(),t

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.32-nf0mf9nq.mjsView file

1import{B as MG,C as CG,D as SB,E as uB,z as O}from"./cli-1.1.32-x0crp5g9.mjs";import"./cli-1.1.32-vy2ngm3p.mjs";import{H as pZ,I as _Z}from"./cli-1.1.32-7566j53x.mjs";import{O as v... L2: `)),process.exit(1);if(jI()==="windows")process.stderr.write(F.red(`Error: --tmux is not supported on Windows ... L25: 1. **Code review** — Invoke the \`${Bg}\` tool with \`skill: "code-review"\` and \`args: "medium"\` to get a correctness-bug report on your changes, then fix every reported bug bef... L26: 2. **Run unit tests** — Run the project's test suite (check for package.json scripts, Makefile targets, or common commands like \`npm test\`, \`bun test\`, \`pytest\`, \`go test\`)... L27: 3. **Test end-to-end** — Follow the e2e test recipe from the coordinator's prompt (below). If the recipe says t

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.32-nf0mf9nq.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.32-a9jc0rn9.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.32-a9jc0rn9.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.32-9yka8m9x.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-kvt0v6vq.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-9yka8m9x.mjsView on unpkg

dist/chunks/cli-1.1.32-aqfcrtfz.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-vypd5zf6.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-aqfcrtfz.mjsView on unpkg

dist/chunks/cli-1.1.32-260jjrwt.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-01erqdx7.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-260jjrwt.mjsView on unpkg

dist/chunks/cli-1.1.32-6jxftegx.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-32vewh62.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-6jxftegx.mjsView on unpkg

dist/chunks/cli-1.1.32-g5dzf2w1.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-hxty6b5t.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-g5dzf2w1.mjsView on unpkg

dist/chunks/index-1.1.32-bpzdp87c.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/index-1.1.26-syyhrh9b.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.32-bpzdp87c.mjsView on unpkg

dist/chunks/openaiShim-1.1.32-68nafznt.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.32-68nafznt.mjs

dist/chunks/openaiShim-1.1.32-68nafznt.mjsView on unpkg · L11

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/cli-1.1.32-yhftam6y.mjsView file

49patternName = generic_password severity = medium line = 49

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/cli-1.1.32-yhftam6y.mjsView on unpkg · L49

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView file

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView on unpkg · L18

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView on unpkg · L18

dist/chunks/cli-1.1.32-pve0ffcp.mjsView file

1import{fha as G6,jha as NB}from"./cli-1.1.32-1rackf2c.mjs";import{rha as Vq,sha as $6,tha as zN}from"./cli-1.1.32-v4chz2b0.mjs";import{Dha as kX,Iha as zw,Jha as WB,Lha as K,Mha as... L2: `;break;case 114:D+="\r";break;case 116:D+="\t";break;case 117:let A=L(4,!0);if(A>=0)D+=String.fromCharCode(A);else V=4;break;default:V=5}w=Q;continue}if(T>=0&&T<=31)if(M6(T)){D+=Z...

High

Shell

Package source references shell execution.

dist/chunks/cli-1.1.32-pve0ffcp.mjsView on unpkg · L1

dist/chunks/cli-1.1.32-1913x5jp.mjsView file

1import{i2 as $J,l2 as TJ}from"./cli-1.1.32-qmgvm9rq.mjs";import{Dga as m,I_ as QJ,K_ as jJ,N_ as w,cfa as E,gea as ZJ,kaa as K,laa as f,r$ as YJ,s$ as xJ,tea as NJ,w_ as U,y_ as P,... L2: exec "${J}/node_modules/.bin/claudin" "$@"`,493))await vJ(Q,493);return!0}catch(J){return q(J),!1}}async function eJ(J,Q){try{if(!await _J())return"install_failed";let Z=await K("n... L3: `)}catch(Q){if(g(Q))return null;throw Q}}async function l(J,Q){let Y=await OJ(J,"w");try{await Y.writeFile(Q.join(`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunks/cli-1.1.32-1913x5jp.mjsView on unpkg · L1

dist/chunks/cli-1.1.32-vf3r8a91.mjsView file

1import{B6 as D5,D6 as J8}from"./cli-1.1.32-a3dfp7ps.mjs";import{F6 as M,G6 as p$}from"./cli-1.1.32-6jxftegx.mjs";import{I6 as b2,J6 as n$}from"./cli-1.1.32-czrfbd3q.mjs";import{H7 ... L2: `;await B0("security",["-i"],{input:q,reject:!1}),J=!0}catch(Q){b(Q)}let Z=d5($);S((Q)=>{let Y=Q.customApiKeyResponses?.approved??[];return{...Q,primaryApiKey:J?Q.primaryApiKey:$,c...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/cli-1.1.32-vf3r8a91.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/cli-1.1.32-vf3r8a91.mjsView on unpkg · L1

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-tgtv1jp3.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 0.813 shingleOverlap = 39 summary = source token shingles overlapped finalized malicious source

dist/chunks/index-1.1.32-vaknvmtk.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.32-vaknvmtk.mjsView on unpkg · L1

dist/chunks/index-1.1.32-dn9thxs1.mjsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.32-dn9thxs1.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.32-nf0mf9nq.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.32-nf0mf9nq.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.32-a9jc0rn9.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.32-a9jc0rn9.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.32-9yka8m9x.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-9yka8m9x.mjsView on unpkg

dist/chunks/cli-1.1.32-aqfcrtfz.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-aqfcrtfz.mjsView on unpkg

dist/chunks/cli-1.1.32-260jjrwt.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-260jjrwt.mjsView on unpkg

dist/chunks/cli-1.1.32-6jxftegx.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-6jxftegx.mjsView on unpkg

dist/chunks/cli-1.1.32-g5dzf2w1.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-g5dzf2w1.mjsView on unpkg

dist/chunks/index-1.1.32-bpzdp87c.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.32-bpzdp87c.mjsView on unpkg

dist/chunks/openaiShim-1.1.32-68nafznt.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.32-68nafznt.mjs

dist/chunks/openaiShim-1.1.32-68nafznt.mjsView on unpkg · L11

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.32",

36 "@claudiolabs/claudin-linux-arm64": "1.1.32",

37 "@claudiolabs/claudin-darwin-arm64": "1.1.32",

38 "@claudiolabs/claudin-linux-arm64-musl": "1.1.32",

39 "@claudiolabs/claudin-linux-x64": "1.1.32",

40 "@claudiolabs/claudin-win32-x64": "1.1.32",

41 "@claudiolabs/claudin-darwin-x64": "1.1.32",

42 "@claudiolabs/claudin-win32-arm64": "1.1.32"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.32-yhftam6y.mjsView file

Lines 29-51javascript

29 <h1>Codex login failed</h1>

30 <p>${X2(q)}</p>

31 <p>You can close this window and try again in Claudin.</p>

32 </body>

33</

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView file

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView on unpkg · L18

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-5qjjtpkh.mjsView on unpkg

dist/chunks/cli-1.1.32-pve0ffcp.mjsView file

Lines 1-21javascript

1import{fha as G6,jha as NB}from"./cli-1.1.32-1rackf2c.mjs";import{rha as Vq,sha as $6,tha as zN}from"./cli-1.1.32-v4chz2b0.mjs";import{Dha as kX,Iha as zw,Jha as WB,Lha

dist/chunks/cli-1.1.32-1913x5jp.mjsView file

Lines 1-16javascript

1import{i2 as $J,l2 as TJ}from"./cli-1.1.32-qmgvm9rq.mjs";import{Dga as m,I_ as QJ,K_ as jJ,N_ as w,cfa as E,gea as ZJ,kaa as K,laa as f,r$ as

dist/chunks/cli-1.1.32-vf3r8a91.mjsView file

Lines 1-17javascript

1import{B6 as D5,D6 as J8}from"./cli-1.1.32-a3dfp7ps.mjs";import{F6 as M,G6 as p$}from"./cli-1.1.32-6jxftegx.mjs";import{I6 as b2,J6 as n$}from"./cli-1.1.32-czrfbd3q.mjs";import

dist/chunks/index-1.1.32-vaknvmtk.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.32-vaknvmtk.mjsView on unpkg · L1

dist/chunks/index-1.1.32-dn9thxs1.mjsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.32-dn9thxs1.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.32-d20ebbde.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.32-nf0mf9nq.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.32-nf0mf9nq.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.32-a9jc0rn9.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.32-a9jc0rn9.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.32-9yka8m9x.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-9yka8m9x.mjsView on unpkg

dist/chunks/cli-1.1.32-aqfcrtfz.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-aqfcrtfz.mjsView on unpkg

dist/chunks/cli-1.1.32-260jjrwt.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-260jjrwt.mjsView on unpkg

dist/chunks/cli-1.1.32-6jxftegx.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-6jxftegx.mjsView on unpkg

dist/chunks/cli-1.1.32-g5dzf2w1.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.32-g5dzf2w1.mjsView on unpkg

dist/chunks/index-1.1.32-bpzdp87c.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/index-1.1.32-bpzdp87c.mjsView on unpkg

dist/chunks/openaiShim-1.1.32-68nafznt.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.32-68nafznt.mjs

dist/chunks/openaiShim-1.1.32-68nafznt.mjsView on unpkg · L11

@claudiolabs/claudin@1.1.32

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code