Loading npm security reports…

@claudiolabs/claudin@1.1.36: Unknown npm security report (Allow) | LPM Firewall

registry / @claudiolabs/claudin / 1.1.36

@claudiolabs/claudin@1.1.36

⚠ Under review

Claudin — Claude Code opened to any LLM (OpenAI, Gemini, DeepSeek, Ollama, and 200+ models)

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 29 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 403 file(s), 11.9 MB of source, external domains: 1.1.1.1, 127.0.0.1, 169.254.169.254, 169.254.170.2, a.co, anthropic.com, api.anthropic.com, api.bing.microsoft.com, api.cloudflare.com, api.deepseek.com, api.exa.ai, api.firecrawl.dev, api.github.com, api.githubcopilot.com, api.groq.com, api.kimi.com, api.linkup.so, api.minimax.io, api.mistral.ai, api.moonshot.ai, api.openai.com, api.search.brave.com, api.tavily.com, api.together.xyz, api.x.ai, api.ydc-index.io, api.z.ai, app.corridor.dev, auth.kimi.com, auth.openai.com, auth.x.ai, aws.amazon.com, beacon.claude-ai.staging.ant.dev, bedrock-runtime.us-east-1.amazonaws.com, chatgpt.com, clau.de, claude-ai.staging.ant.dev, claude-staging.fedstart.com, claude.ai, claude.com, claude.fedstart.com, cli.github.com, code.claude.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, cognitiveservices.azure.com, docs.anthropic.com, docs.aws.amazon.com, docs.claude.com, docs.expo.dev

Source & flagged code

21 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-arm64-musl": "1.1.36",

36 "@claudiolabs/claudin-win32-x64": "1.1.36",

37 "@claudiolabs/claudin-linux-arm64": "1.1.36",

38 "@claudiolabs/claudin-darwin-x64": "1.1.36",

39 "@claudiolabs/claudin-linux-x64-musl": "1.1.36",

40 "@claudiolabs/claudin-win32-arm64": "1.1.36",

41 "@claudiolabs/claudin-darwin-arm64": "1.1.36",

42 "@claudiolabs/claudin-linux-x64": "1.1.36"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/openaiShim-1.1.36-m75hvh8e.mjsView file

Lines 1-15javascript

1import{Di as Y0,Ei as Y1}from"./cli-1.1.36-psd41gmc.mjs";import{Hi as c$,Ji as J1}from"./cli-1.1.36-ykz9vwbf.mjs";import{$p as j0,Do as eZ,Dp as J0,Eo as $0,Ep as

dist/chunks/watchLoop-1.1.36-4s334wzz.mjsView file

Lines 1-14javascript

dist/chunks/cli-1.1.36-t6sjxpcb.mjsView file

Lines 1-21javascript

1import{$fa as Y6,dga as NB}from"./cli-1.1.36-6q7sfj4e.mjs";import{lga as Yq,mga as Z6,nga as YN}from"./cli-1.1.36-bxrew2k8.mjs";import{Cga as Hw,Dga as WB,Fga as K,Gga as g0,Hga

dist/chunks/cli-1.1.36-ss62b517.mjsView file

Lines 1-21javascript

1import{ija as gt,tja as Wu}from"./cli-1.1.36-0qtyffhw.mjs";import{Qpa as kn,Rpa as j,Spa as it}from"./cli-1.1.36-c4pkjm54.mjs";function rt(n){let r

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/cli-1.1.36-659qh6fs.mjsView file

Lines 1-16javascript

1import{_0 as $J,a1 as TJ}from"./cli-1.1.36-7tprmtpr.mjs";import{F9 as QJ,H9 as jJ,K9 as w,V_ as K,W_ as f,_da as E,b_ as YJ,bda as ZJ,c_ as

dist/chunks/cli-1.1.36-s8jcsdgb.mjsView file

Lines 1-17javascript

1import{B5 as $8,z5 as U2}from"./cli-1.1.36-65fkb20j.mjs";import{D5 as A,E5 as i$}from"./cli-1.1.36-8mc299mk.mjs";import{G5 as b5,H5 as o$}from"./cli-1.1.36-0qdd3hmz.mjs";import

dist/chunks/cli-1.1.36-gfn4xejp.mjsView file

1import{Ppa as y,Spa as b}from"./cli-1.1.36-c4pkjm54.mjs";var P0=y(($w)=>{$w.HttpAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})($w.HttpAuthLocation||($w.HttpAu... L2: `).slice(0,5).filter((T)=>!T.includes("stackTraceWarning")).join(`

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/cli-1.1.36-gfn4xejp.mjsView on unpkg · L1

dist/chunks/index-1.1.36-83wpkv8f.mjsView file

20contains invisible/control Unicode U+200B (zero width space) \v\f\r\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.36-83wpkv8f.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.30 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.30 similarity = 0.383 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjs spawns dist/chunks/cli-1.1.36-34sqd3h3.mjs; helper contains network access plus dynamic code execution. L1: import{$ as kz,Y as BJ,Z as Lz,_ as CJ,aa as hz,ba as FJ,ca as NJ,da as PJ,ea as _J,fa as UJ,ga as RJ}from"./cli-1.1.36-adsb7266.mjs";import{ia as Uz,ka as AJ}from"./cli-1.1.36-89d... L2: `).filter((W)=>W.length>0)}function tz(z){let J=z.write??((Z)=>process.stdout.write(Z)),W=z.verbose,$=0,q="idle",K="Ready",_="",B="",E="",O="",w="",U=null,N=[],f=!1,A=null,F=0,x=0,... L3: `)){if(e.length===0){L++;continue}let $z=uz(e);L+=Math.max(1,Math.ceil($z/G))}if(Z.endsWith(` ... L31: `),Z)k(`${H.red(Z)} L32: `)},updateSessionStatus(Z,G,L,e){if(L.type==="tool_start")A=L.summary,F=Date.now();g()},clearStatus(){d(),zz()

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.36-bvheegzj.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.36-bvheegzj.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.36-v0s0vqmm.mjsView file

•matchType = token_shingles matchedPackage = investing@0.1.76 matchedPath = dist/index.mjs matchedIdentity = npm:aW52ZXN0aW5n:0.1.76 similarity = 1.000 shingleOverlap = 25 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-v0s0vqmm.mjsView on unpkg

dist/chunks/cli-1.1.36-r241fh82.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-vypd5zf6.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-r241fh82.mjsView on unpkg

dist/chunks/cli-1.1.36-703pmf6z.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-55ayan24.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 32 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-703pmf6z.mjsView on unpkg

dist/chunks/cli-1.1.36-xs4p38vb.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-01erqdx7.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-xs4p38vb.mjsView on unpkg

dist/chunks/cli-1.1.36-8mc299mk.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-32vewh62.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-8mc299mk.mjsView on unpkg

dist/chunks/cli-1.1.36-rqhp2xt1.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-hxty6b5t.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-rqhp2xt1.mjsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/openaiShim-1.1.36-m75hvh8e.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/openaiShim-1.1.36-m75hvh8e.mjsView on unpkg · L11

dist/chunks/watchLoop-1.1.36-4s334wzz.mjsView file

1import{a as A,g as j}from"./cli-1.1.36-02vb8r9t.mjs";import{ufa as $,zfa as C}from"./cli-1.1.36-t6sjxpcb.mjs";import"./cli-1.1.36-6q7sfj4e.mjs";import"./cli-1.1.36-m11p0exg.mjs";im... L2: ${X}`)}`;Z.push({id:G,title:W||U(X),body:X||W})}return Z}function N(q){return typeof q==="object"&&q!==null&&!Array.isArray(q)}function J(q){return typeof q==="string"&&q.trim()?q....

High

Child Process

Package source references child process execution.

dist/chunks/watchLoop-1.1.36-4s334wzz.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/watchLoop-1.1.36-4s334wzz.mjsView on unpkg · L1

dist/chunks/cli-1.1.36-t6sjxpcb.mjsView file

1import{$fa as Y6,dga as NB}from"./cli-1.1.36-6q7sfj4e.mjs";import{lga as Yq,mga as Z6,nga as YN}from"./cli-1.1.36-bxrew2k8.mjs";import{Cga as Hw,Dga as WB,Fga as K,Gga as g0,Hga as... L2: `;break;case 114:D+="\r";break;case 116:D+="\t";break;case 117:let A=L(4,!0);if(A>=0)D+=String.fromCharCode(A);else V=4;break;default:V=5}w=Q;continue}if(T>=0&&T<=31)if(B6(T)){D+=Z...

High

Shell

Package source references shell execution.

dist/chunks/cli-1.1.36-t6sjxpcb.mjsView on unpkg · L1

dist/chunks/cli-1.1.36-ss62b517.mjsView file

1import{ija as gt,tja as Wu}from"./cli-1.1.36-0qtyffhw.mjs";import{Qpa as kn,Rpa as j,Spa as it}from"./cli-1.1.36-c4pkjm54.mjs";function rt(n){let r=0;for(let $=0;$<n.length;$++)r=(... L2: `)}var l2,qg,lt,jt=(n,r)=>{n.name="$ZodError",qg.value=r,Object.defineProperty(n,"issues",qg),qg.value=void 0,Object.defineProperty(n,"message",l2);let $=Object.getPrototypeOf(n);i...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/cli-1.1.36-ss62b517.mjsView on unpkg · L1

cli-wrapper.cjsView file

14L15: const { spawnSync } = require('child_process') L16: const { arch, constants } = require('os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli-wrapper.cjsView on unpkg · L14

dist/chunks/cli-1.1.36-659qh6fs.mjsView file

1import{_0 as $J,a1 as TJ}from"./cli-1.1.36-7tprmtpr.mjs";import{F9 as QJ,H9 as jJ,K9 as w,V_ as K,W_ as f,_da as E,b_ as YJ,bda as ZJ,c_ as xJ,oda as NJ,t9 as U,ufa as q,v9 as P,zf... L2: exec "${J}/node_modules/.bin/claudin" "$@"`,493))await vJ(Q,493);return!0}catch(J){return q(J),!1}}async function eJ(J,Q){try{if(!await _J())return"install_failed";let Z=await K("n... L3: `)}catch(Q){if(g(Q))return null;throw Q}}async function l(J,Q){let Y=await OJ(J,"w");try{await Y.writeFile(Q.join(`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunks/cli-1.1.36-659qh6fs.mjsView on unpkg · L1

dist/chunks/cli-1.1.36-s8jcsdgb.mjsView file

1import{B5 as $8,z5 as U2}from"./cli-1.1.36-65fkb20j.mjs";import{D5 as A,E5 as i$}from"./cli-1.1.36-8mc299mk.mjs";import{G5 as b5,H5 as o$}from"./cli-1.1.36-0qdd3hmz.mjs";import{F6 ... L2: `;await W0("security",["-i"],{input:q,reject:!1}),J=!0}catch(Q){k(Q)}let Z=i2($);h((Q)=>{let Y=Q.customApiKeyResponses?.approved??[];return{...Q,primaryApiKey:J?Q.primaryApiKey:$,c...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/cli-1.1.36-s8jcsdgb.mjsView on unpkg · L1

dist/chunks/cli-1.1.36-gfn4xejp.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/cli-1.1.36-gfn4xejp.mjsView on unpkg · L1

dist/chunks/index-1.1.36-83wpkv8f.mjsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.36-83wpkv8f.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.36-bvheegzj.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.36-bvheegzj.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.36-v0s0vqmm.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-v0s0vqmm.mjsView on unpkg

dist/chunks/cli-1.1.36-r241fh82.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-r241fh82.mjsView on unpkg

dist/chunks/cli-1.1.36-703pmf6z.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-703pmf6z.mjsView on unpkg

dist/chunks/cli-1.1.36-xs4p38vb.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-xs4p38vb.mjsView on unpkg

dist/chunks/cli-1.1.36-8mc299mk.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-8mc299mk.mjsView on unpkg

dist/chunks/cli-1.1.36-rqhp2xt1.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-rqhp2xt1.mjsView on unpkg

Source & flagged code

21 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-arm64-musl": "1.1.36",

36 "@claudiolabs/claudin-win32-x64": "1.1.36",

37 "@claudiolabs/claudin-linux-arm64": "1.1.36",

38 "@claudiolabs/claudin-darwin-x64": "1.1.36",

39 "@claudiolabs/claudin-linux-x64-musl": "1.1.36",

40 "@claudiolabs/claudin-win32-arm64": "1.1.36",

41 "@claudiolabs/claudin-darwin-arm64": "1.1.36",

42 "@claudiolabs/claudin-linux-x64": "1.1.36"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/openaiShim-1.1.36-m75hvh8e.mjsView file

Lines 1-15javascript

1import{Di as Y0,Ei as Y1}from"./cli-1.1.36-psd41gmc.mjs";import{Hi as c$,Ji as J1}from"./cli-1.1.36-ykz9vwbf.mjs";import{$p as j0,Do as eZ,Dp as J0,Eo as $0,Ep as

dist/chunks/watchLoop-1.1.36-4s334wzz.mjsView file

Lines 1-14javascript

dist/chunks/cli-1.1.36-t6sjxpcb.mjsView file

Lines 1-21javascript

1import{$fa as Y6,dga as NB}from"./cli-1.1.36-6q7sfj4e.mjs";import{lga as Yq,mga as Z6,nga as YN}from"./cli-1.1.36-bxrew2k8.mjs";import{Cga as Hw,Dga as WB,Fga as K,Gga as g0,Hga

dist/chunks/cli-1.1.36-ss62b517.mjsView file

Lines 1-21javascript

1import{ija as gt,tja as Wu}from"./cli-1.1.36-0qtyffhw.mjs";import{Qpa as kn,Rpa as j,Spa as it}from"./cli-1.1.36-c4pkjm54.mjs";function rt(n){let r

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/cli-1.1.36-659qh6fs.mjsView file

Lines 1-16javascript

1import{_0 as $J,a1 as TJ}from"./cli-1.1.36-7tprmtpr.mjs";import{F9 as QJ,H9 as jJ,K9 as w,V_ as K,W_ as f,_da as E,b_ as YJ,bda as ZJ,c_ as

dist/chunks/cli-1.1.36-s8jcsdgb.mjsView file

Lines 1-17javascript

1import{B5 as $8,z5 as U2}from"./cli-1.1.36-65fkb20j.mjs";import{D5 as A,E5 as i$}from"./cli-1.1.36-8mc299mk.mjs";import{G5 as b5,H5 as o$}from"./cli-1.1.36-0qdd3hmz.mjs";import

dist/chunks/cli-1.1.36-gfn4xejp.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/cli-1.1.36-gfn4xejp.mjsView on unpkg · L1

dist/chunks/index-1.1.36-83wpkv8f.mjsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.36-83wpkv8f.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.36-6v5c06t6.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.36-bvheegzj.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.36-bvheegzj.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.36-v0s0vqmm.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-v0s0vqmm.mjsView on unpkg

dist/chunks/cli-1.1.36-r241fh82.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-r241fh82.mjsView on unpkg

dist/chunks/cli-1.1.36-703pmf6z.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-703pmf6z.mjsView on unpkg

dist/chunks/cli-1.1.36-xs4p38vb.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-xs4p38vb.mjsView on unpkg

dist/chunks/cli-1.1.36-8mc299mk.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-8mc299mk.mjsView on unpkg

dist/chunks/cli-1.1.36-rqhp2xt1.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.36-rqhp2xt1.mjsView on unpkg

@claudiolabs/claudin@1.1.36

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code