@claudiolabs/claudin@1.1.33: Manual Review npm security report

Loading npm security reports…

@claudiolabs/claudin@1.1.33: Manual Review npm security report | LPM Firewall

Source & flagged code

26 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.33",

36 "@claudiolabs/claudin-linux-arm64": "1.1.33",

37 "@claudiolabs/claudin-darwin-arm64": "1.1.33",

38 "@claudiolabs/claudin-linux-arm64-musl": "1.1.33",

39 "@claudiolabs/claudin-linux-x64": "1.1.33",

40 "@claudiolabs/claudin-win32-x64": "1.1.33",

41 "@claudiolabs/claudin-darwin-x64": "1.1.33",

42 "@claudiolabs/claudin-win32-arm64": "1.1.33"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.33-7sm3r61g.mjsView file

Lines 29-51javascript

29 <h1>Codex login failed</h1>

30 <p>${X2(q)}</p>

31 <p>You can close this window and try again in Claudin.</p>

32 </body>

33</

dist/chunks/setup-1.1.33-nbfqv6x2.mjsView file

Lines 1-13javascript

1import{D as L$}from"./cli-1.1.33-sv5dwqh6.mjs";import"./cli-1.1.33-yqqr1e67.mjs";import{Mf as B$,Nf as gJ}from"./cli-1.1.33-s5kw6064.mjs";import{Sf as x,Tf as _,Uf as S2,Vf

dist/chunks/cli-1.1.33-vgynvhys.mjsView file

881`),Z=[];for(let Y of Q){let X=Y.match(/^([a-zA-Z_-]+):\s+(.+)$/);if(X){let[,q,K]=X;if(!q||!K){Z.push(Y);continue}if(K.startsWith('"')&&K.endsWith('"')||K.startsWith("'")&&K.endsWit... L882: `)}function HJ(J,Q){let Z=J.match(vX8);if(!Z)return{frontmatter:{},content:J};let Y=Z[1]||"",X=J.slice(Z[0].length),q={};try{let K=S80(Y);if(K&&typeof K==="object"&&!Array.isArray(... L883: `).filter((q)=>q),Y=Math.min(...Z.map((q)=>q.length-q.trimStart().length)),X=Z.map((q)=>q.slice(Y)).map((q)=>" ".repeat(this.indent*2)+q);for(let q of X)this.content.push(q)}compil... L884: `))}}var K60=()=>{};var HC0;var V60=I(()=>{HC0={major:4,minor:4,patch:3}});function gC0(J){if(J==="")return!0;if(/\s/.test(J))return!1;if(J.length%4!==0)return!1;try{return atob(J)... L885: if (${M}.issues.length) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.33-vgynvhys.mjsView on unpkg · L881

58- This tool can read Jupyter notebooks (.ipynb files) and returns all cells with their outputs, combining code, text, and visualizations. L59: - Do NOT re-read a file you just edited to verify the change — Edit/Write would have errored if it failed, and the harness tracks file state for you.`}var _9="Read",DU="File unchan... L60: - Allows Claude to search the web and use the results to inform responses ... L74: Sources: L75: - [Source Title 1](https://example.com/1) L76: - [Source Title 2](https://example.com/2) ... L129: - For GitHub URLs, prefer using the gh CLI via Bash instead (e.g., gh pr view, gh issue view, gh api). L130: `;var U4=()=>{};var Z6="PowerShell";var rV=()=>{};function Fy(){if(t0()!=="windows")return!1;return o(process.env.CLAUDIN_USE_POWERSHELL_TOOL)}var NU;var AU=I

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/watchLoop-1.1.33-w4q3ncxj.mjsView file

1import{a as A,g as j}from"./cli-1.1.33-rrhe6g9q.mjs";import{_fa as $,dga as C}from"./cli-1.1.33-20v60hvd.mjs";import"./cli-1.1.33-n2d1txyn.mjs";import"./cli-1.1.33-dv29f6yk.mjs";im... L2: ${X}`)}`;Z.push({id:G,title:W||U(X),body:X||W})}return Z}function N(q){return typeof q==="object"&&q!==null&&!Array.isArray(q)}function J(q){return typeof q==="string"&&q.trim()?q....

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/watchLoop-1.1.33-w4q3ncxj.mjsView on unpkg · L1

dist/chunks/index-1.1.33-1cyg72cg.mjsView file

1import{u8 as ve,v8 as L}from"./cli-1.1.33-nq2hxcp4.mjs";import{hqa as _e}from"./cli-1.1.33-22addsh7.mjs";import{kqa as Ke,nqa as he,oqa as Se}from"./cli-1.1.33-6fq5cn5g.mjs";import... L2: - loopback CIDR 127.0.0.0/8 or [::1/128] L3: - ECS container host 169.254.170.2 L4: - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:j})};ye.checkUrl=Ae});var Ce=H((B)=>{Object.defineProperty(B,"__esModule",{value:!0});B.resolveHttpHandlerRuntimeConf... L5: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:f.logger});let n=new URL(j);(0,ut.checkUrl)(n,f.logger);let r=nt.NodeHttpHandler.create({...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.33-1cyg72cg.mjsView on unpkg · L1

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.30 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.30 similarity = 0.383 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.33-62ytf81q.mjs spawns dist/chunks/cli-1.1.33-0kvxjey5.mjs; helper contains network access plus dynamic code execution. L1: import{T as NJ,U as Mz,V as PJ,W as Sz,X as uz,Y as EJ}from"./cli-1.1.33-rtme70ck.mjs";import{_ as Az}from"./cli-1.1.33-bfx6z02g.mjs";import{Sa as oz,Ta as _z,Ua as rz,Va as iz,Xa ... L2: `).filter((X)=>X.length>0)}function zJ(z){let J=z.write??((Z)=>process.stdout.write(Z)),X=z.verbose,W=0,O="idle",K="Ready",C="",F="",D="",B="",x="",R=null,_=[],M=!1,E=null,P=0,f=0,... L3: `)){if(Wz.length===0){T++;continue}let Nz=lz(Wz);T+=Math.max(1,Math.ceil(Nz/j))}if(Z.endsWith(` ... L31: `),Z)h(`${Q.red(Z)} L32: `)},updateSessionStatus(Z,j,T,Wz){if(T.type==="tool_start")E=T.summary,P=Date.now();S()},clearStatus(){r(),t

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.33-t1wa4x2g.mjsView file

1import{r as O,t as MG,u as CG,v as SB,w as uB}from"./cli-1.1.33-kxjb58yw.mjs";import"./cli-1.1.33-dp41gds0.mjs";import{A as _Z,z as pZ}from"./cli-1.1.33-kty1kjfd.mjs";import{G as v... L2: `)),process.exit(1);if(jI()==="windows")process.stderr.write(F.red(`Error: --tmux is not supported on Windows ... L25: 1. **Code review** — Invoke the \`${Bg}\` tool with \`skill: "code-review"\` and \`args: "medium"\` to get a correctness-bug report on your changes, then fix every reported bug bef... L26: 2. **Run unit tests** — Run the project's test suite (check for package.json scripts, Makefile targets, or common commands like \`npm test\`, \`bun test\`, \`pytest\`, \`go test\`)... L27: 3. **Test end-to-end** — Follow the e2e test recipe from the coordinator's prompt (below). If the recipe says t

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.33-t1wa4x2g.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.33-8xyzgp13.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cli-1.1.33-8xyzgp13.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.33-dd7gk6d2.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-vypd5zf6.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-dd7gk6d2.mjsView on unpkg

dist/chunks/cli-1.1.33-0ktq50cd.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-kvt0v6vq.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-0ktq50cd.mjsView on unpkg

dist/chunks/cli-1.1.33-j6ep4mfm.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-01erqdx7.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-j6ep4mfm.mjsView on unpkg

dist/chunks/cli-1.1.33-0kvxjey5.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-hxty6b5t.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-0kvxjey5.mjsView on unpkg

dist/chunks/cli-1.1.33-v08vb0sv.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-32vewh62.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-v08vb0sv.mjsView on unpkg

dist/chunks/cli-1.1.33-525zf497.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-tgtv1jp3.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 0.813 shingleOverlap = 39 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-525zf497.mjsView on unpkg

dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjs

dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjsView on unpkg · L11

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/cli-1.1.33-7sm3r61g.mjsView file

49patternName = generic_password severity = medium line = 49

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/cli-1.1.33-7sm3r61g.mjsView on unpkg · L49

dist/chunks/setup-1.1.33-nbfqv6x2.mjsView file

1import{D as L$}from"./cli-1.1.33-sv5dwqh6.mjs";import"./cli-1.1.33-yqqr1e67.mjs";import{Mf as B$,Nf as gJ}from"./cli-1.1.33-s5kw6064.mjs";import{Sf as x,Tf as _,Uf as S2,Vf as k,Wf... L2: `),G=[];for(let j of Y.dirCounts){let v=k(Q,j.path,z);if(v===0)continue;if(!p(j.claimed,v))continue;G.push({lineNumber:j.lineNumber,path:j.path,actual:v});let K=j.lineNumber-1,q=X[...

High

Child Process

Package source references child process execution.

dist/chunks/setup-1.1.33-nbfqv6x2.mjsView on unpkg · L1

dist/chunks/cli-1.1.33-vgynvhys.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.33-vgynvhys.mjsView on unpkg · L881

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/watchLoop-1.1.33-w4q3ncxj.mjsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/watchLoop-1.1.33-w4q3ncxj.mjsView on unpkg · L1

dist/chunks/index-1.1.33-1cyg72cg.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.33-1cyg72cg.mjsView on unpkg · L1

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.33-t1wa4x2g.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.33-t1wa4x2g.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.33-8xyzgp13.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cli-1.1.33-8xyzgp13.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.33-dd7gk6d2.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-dd7gk6d2.mjsView on unpkg

dist/chunks/cli-1.1.33-0ktq50cd.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-0ktq50cd.mjsView on unpkg

dist/chunks/cli-1.1.33-j6ep4mfm.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-j6ep4mfm.mjsView on unpkg

dist/chunks/cli-1.1.33-0kvxjey5.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-0kvxjey5.mjsView on unpkg

dist/chunks/cli-1.1.33-v08vb0sv.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-v08vb0sv.mjsView on unpkg

dist/chunks/cli-1.1.33-525zf497.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-525zf497.mjsView on unpkg

dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjs

dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjsView on unpkg · L11

Source & flagged code

26 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-x64-musl": "1.1.33",

36 "@claudiolabs/claudin-linux-arm64": "1.1.33",

37 "@claudiolabs/claudin-darwin-arm64": "1.1.33",

38 "@claudiolabs/claudin-linux-arm64-musl": "1.1.33",

39 "@claudiolabs/claudin-linux-x64": "1.1.33",

40 "@claudiolabs/claudin-win32-x64": "1.1.33",

41 "@claudiolabs/claudin-darwin-x64": "1.1.33",

42 "@claudiolabs/claudin-win32-arm64": "1.1.33"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.33-7sm3r61g.mjsView file

Lines 29-51javascript

29 <h1>Codex login failed</h1>

30 <p>${X2(q)}</p>

31 <p>You can close this window and try again in Claudin.</p>

32 </body>

33</

dist/chunks/setup-1.1.33-nbfqv6x2.mjsView file

Lines 1-13javascript

1import{D as L$}from"./cli-1.1.33-sv5dwqh6.mjs";import"./cli-1.1.33-yqqr1e67.mjs";import{Mf as B$,Nf as gJ}from"./cli-1.1.33-s5kw6064.mjs";import{Sf as x,Tf as _,Uf as S2,Vf

dist/chunks/cli-1.1.33-vgynvhys.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/cli-1.1.33-vgynvhys.mjsView on unpkg · L881

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/watchLoop-1.1.33-w4q3ncxj.mjsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/watchLoop-1.1.33-w4q3ncxj.mjsView on unpkg · L1

dist/chunks/index-1.1.33-1cyg72cg.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/index-1.1.33-1cyg72cg.mjsView on unpkg · L1

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.33-62ytf81q.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.33-t1wa4x2g.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.33-t1wa4x2g.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cli-1.1.33-8xyzgp13.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cli-1.1.33-8xyzgp13.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.33-dd7gk6d2.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-dd7gk6d2.mjsView on unpkg

dist/chunks/cli-1.1.33-0ktq50cd.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-0ktq50cd.mjsView on unpkg

dist/chunks/cli-1.1.33-j6ep4mfm.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-j6ep4mfm.mjsView on unpkg

dist/chunks/cli-1.1.33-0kvxjey5.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-0kvxjey5.mjsView on unpkg

dist/chunks/cli-1.1.33-v08vb0sv.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-v08vb0sv.mjsView on unpkg

dist/chunks/cli-1.1.33-525zf497.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.33-525zf497.mjsView on unpkg

dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjs

dist/chunks/openaiShim-1.1.33-dsp1wwgs.mjsView on unpkg · L11

@claudiolabs/claudin@1.1.33

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code