Loading npm security reports…

@claudiolabs/claudin@1.1.38: Suspicious npm security report | LPM Firewall

registry / @claudiolabs/claudin / 1.1.38

@claudiolabs/claudin@1.1.38

Claudin — Claude Code opened to any LLM (OpenAI, Gemini, DeepSeek, Ollama, and 200+ models)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user selects and confirms import or invokes the relevant migration workflow.

Impact

This can alter AI-agent configuration and preserve a compatible local session, so it is a guarded agent-control capability rather than a confirmed attack.

Mechanism

Selected artifacts can be written into Claudin configuration; legacy credentials may be copied only from the known Claude configuration to Claudin's configuration when no destination credential file exists.

AI rationale

The source supports a guarded AI-agent configuration and credential-migration capability, but not malicious installation behavior, credential exfiltration, or a foreign control-surface mutation. The package should be warned on rather than blocked.

Evidence

dist/chunks/import-1.1.38-tjgkgqtj.mjsdist/chunks/cli-1.1.38-y57qzkxr.mjs.claude/.credentials.json.claudin/.credentials.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence with false-positive risk.

Source & flagged code

22 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-arm64-musl": "1.1.38",

36 "@claudiolabs/claudin-win32-x64": "1.1.38",

37 "@claudiolabs/claudin-linux-arm64": "1.1.38",

38 "@claudiolabs/claudin-darwin-x64": "1.1.38",

39 "@claudiolabs/claudin-linux-x64-musl": "1.1.38",

40 "@claudiolabs/claudin-win32-arm64": "1.1.38",

41 "@claudiolabs/claudin-darwin-arm64": "1.1.38",

42 "@claudiolabs/claudin-linux-x64": "1.1.38"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.38-qebn65cx.mjsView file

Lines 29-51javascript

29 <h1>Codex login failed</h1>

30 <p>${X2(q)}</p>

31 <p>You can close this window and try again in Claudin.</p>

32 </body>

33</

dist/chunks/cli-1.1.38-s1nggz9g.mjsView file

Lines 1-17javascript

1import{Y5 as N5,_5 as Z8}from"./cli-1.1.38-z8x4q5cc.mjs";import{a6 as A,b6 as a$}from"./cli-1.1.38-z9faf3ft.mjs";import{d6 as U2,e6 as JJ}from"./cli-1.1.38-zx5nqvq6.mjs";import

dist/chunks/cli-1.1.38-a678cgp1.mjsView file

Lines 1-21javascript

1import{Cga as NB,yga as Y6}from"./cli-1.1.38-qv0rqvhj.mjs";import{Kga as Yq,Lga as Z6,Mga as YN}from"./cli-1.1.38-6g33twaj.mjs";import{$ga as Hw,Cha as K,Dha as g0,Eha as I,Fha

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/cli-1.1.38-n5tx4p12.mjsView file

Lines 1-16javascript

1import{v1 as $J,x1 as TJ}from"./cli-1.1.38-pnngv0r7.mjs";import{A_ as YJ,Ada as ZJ,B_ as xJ,Nda as NJ,S9 as U,Tfa as q,U9 as P,Yfa as m,c_ as

dist/chunks/cli-1.1.38-dfcp3asv.mjsView file

1import{Nqa as y,Qqa as b}from"./cli-1.1.38-y66mw08s.mjs";var P0=y(($w)=>{$w.HttpAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})($w.HttpAuthLocation||($w.HttpAu... L2: `).slice(0,5).filter((T)=>!T.includes("stackTraceWarning")).join(`

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/cli-1.1.38-dfcp3asv.mjsView on unpkg · L1

dist/chunks/index-1.1.38-wwvwtd47.mjsView file

20contains invisible/control Unicode U+200B (zero width space) \v\f\r\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.38-wwvwtd47.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @claudiolabs/claudin@1.1.30 matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.30 similarity = 0.383 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjs spawns dist/chunks/cli-1.1.38-4g2k1n93.mjs; helper contains network access plus dynamic code execution. L1: import{Aa as oz,Ca as rz,Da as nz,Ea as iz,Fa as sz,xa as cz,ya as Nz,za as az}from"./cli-1.1.38-m9k89rb6.mjs";import{$a as BJ,ab as Lz,bb as CJ,cb as kz,db as hz,eb as FJ,fb as NJ... L2: `).filter((W)=>W.length>0)}function tz(z){let J=z.write??((Z)=>process.stdout.write(Z)),W=z.verbose,$=0,q="idle",K="Ready",_="",B="",E="",O="",w="",U=null,N=[],f=!1,A=null,F=0,x=0,... L3: `)){if(e.length===0){L++;continue}let $z=uz(e);L+=Math.max(1,Math.ceil($z/G))}if(Z.endsWith(` ... L31: `),Z)k(`${H.red(Z)} L32: `)},updateSessionStatus(Z,G,L,e){if(L.type==="tool_start")A=L.summary,F=Date.now();g()},clearStatus(){d(),zz()

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.38-t4spryyh.mjsView file

1import{r as q,t as vG,u as bG,v as BB,w as ZB}from"./cli-1.1.38-21x08w6j.mjs";import"./cli-1.1.38-ygyme6j6.mjs";import{A as yZ,z as VZ}from"./cli-1.1.38-tvh77h3r.mjs";import{G as d... L2: `)),process.exit(1);if(VI()==="windows")process.stderr.write(Q.red(`Error: --tmux is not supported on Windows ... L25: 1. **Code review** — Invoke the \`${pI}\` tool with \`skill: "code-review"\` and \`args: "medium"\` to get a correctness-bug report on your changes, then fix every reported bug bef... L26: 2. **Run unit tests** — Run the project's test suite (check for package.json scripts, Makefile targets, or common commands like \`npm test\`, \`bun test\`, \`pytest\`, \`go test\`)... L27: 3. **Test end-to-end** — Follow the e2e test recipe from the coordinator's prompt (below). If the recipe says t

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.38-t4spryyh.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.38-dvwdm93b.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.38-dvwdm93b.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.38-exexvj4k.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-vypd5zf6.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-exexvj4k.mjsView on unpkg

dist/chunks/cli-1.1.38-tk968ykv.mjsView file

•matchType = token_shingles matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-kvt0v6vq.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-tk968ykv.mjsView on unpkg

dist/chunks/cli-1.1.38-kjt1gn6d.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-kjt1gn6d.mjsView on unpkg

dist/chunks/cli-1.1.38-e5by1ynv.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-01erqdx7.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-e5by1ynv.mjsView on unpkg

dist/chunks/cli-1.1.38-t8k5snq9.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-hxty6b5t.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-t8k5snq9.mjsView on unpkg

dist/chunks/cli-1.1.38-z9faf3ft.mjsView file

•matchType = normalized_sha256 matchedPackage = @claudiolabs/claudin@1.1.26 matchedPath = dist/chunks/cli-1.1.26-32vewh62.mjs matchedIdentity = npm:QGNsYXVkaW9sYWJzL2NsYXVkaW4:1.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-z9faf3ft.mjsView on unpkg

dist/chunks/openaiShim-1.1.38-12snq1gc.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.38-12snq1gc.mjs

dist/chunks/openaiShim-1.1.38-12snq1gc.mjsView on unpkg · L11

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunks/cli-1.1.38-qebn65cx.mjsView file

49patternName = generic_password severity = medium line = 49

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/chunks/cli-1.1.38-qebn65cx.mjsView on unpkg · L49

dist/chunks/cli-1.1.38-s1nggz9g.mjsView file

1import{Y5 as N5,_5 as Z8}from"./cli-1.1.38-z8x4q5cc.mjs";import{a6 as A,b6 as a$}from"./cli-1.1.38-z9faf3ft.mjs";import{d6 as U2,e6 as JJ}from"./cli-1.1.38-zx5nqvq6.mjs";import{c7 ... L2: `;await W0("security",["-i"],{input:X,reject:!1}),J=!0}catch(Q){k(Q)}let Z=t5($);h((Q)=>{let Y=Q.customApiKeyResponses?.approved??[];return{...Q,primaryApiKey:J?Q.primaryApiKey:$,c...

High

Child Process

Package source references child process execution.

dist/chunks/cli-1.1.38-s1nggz9g.mjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/cli-1.1.38-s1nggz9g.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/cli-1.1.38-s1nggz9g.mjsView on unpkg · L1

dist/chunks/cli-1.1.38-a678cgp1.mjsView file

1import{Cga as NB,yga as Y6}from"./cli-1.1.38-qv0rqvhj.mjs";import{Kga as Yq,Lga as Z6,Mga as YN}from"./cli-1.1.38-6g33twaj.mjs";import{$ga as Hw,Cha as K,Dha as g0,Eha as I,Fha as ... L2: `;break;case 114:D+="\r";break;case 116:D+="\t";break;case 117:let A=L(4,!0);if(A>=0)D+=String.fromCharCode(A);else V=4;break;default:V=5}w=Q;continue}if(T>=0&&T<=31)if(B6(T)){D+=Z...

High

Shell

Package source references shell execution.

dist/chunks/cli-1.1.38-a678cgp1.mjsView on unpkg · L1

cli-wrapper.cjsView file

14L15: const { spawnSync } = require('child_process') L16: const { arch, constants } = require('os')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli-wrapper.cjsView on unpkg · L14

dist/chunks/cli-1.1.38-n5tx4p12.mjsView file

1import{v1 as $J,x1 as TJ}from"./cli-1.1.38-pnngv0r7.mjs";import{A_ as YJ,Ada as ZJ,B_ as xJ,Nda as NJ,S9 as U,Tfa as q,U9 as P,Yfa as m,c_ as QJ,e_ as jJ,h_ as w,s$ as K,t$ as f,xe... L2: exec "${J}/node_modules/.bin/claudin" "$@"`,493))await vJ(Q,493);return!0}catch(J){return q(J),!1}}async function eJ(J,Q){try{if(!await _J())return"install_failed";let Z=await K("n... L3: `)}catch(Q){if(g(Q))return null;throw Q}}async function l(J,Q){let Y=await OJ(J,"w");try{await Y.writeFile(Q.join(`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunks/cli-1.1.38-n5tx4p12.mjsView on unpkg · L1

dist/chunks/cli-1.1.38-dfcp3asv.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/cli-1.1.38-dfcp3asv.mjsView on unpkg · L1

dist/chunks/index-1.1.38-wwvwtd47.mjsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.38-wwvwtd47.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.38-t4spryyh.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.38-t4spryyh.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.38-dvwdm93b.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.38-dvwdm93b.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.38-exexvj4k.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-exexvj4k.mjsView on unpkg

dist/chunks/cli-1.1.38-tk968ykv.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-tk968ykv.mjsView on unpkg

dist/chunks/cli-1.1.38-kjt1gn6d.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-kjt1gn6d.mjsView on unpkg

dist/chunks/cli-1.1.38-e5by1ynv.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-e5by1ynv.mjsView on unpkg

dist/chunks/cli-1.1.38-t8k5snq9.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-t8k5snq9.mjsView on unpkg

dist/chunks/cli-1.1.38-z9faf3ft.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-z9faf3ft.mjsView on unpkg

dist/chunks/openaiShim-1.1.38-12snq1gc.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.38-12snq1gc.mjs

dist/chunks/openaiShim-1.1.38-12snq1gc.mjsView on unpkg · L11

Source & flagged code

22 flagged

package.jsonView file

Lines 12-52json

12 },

13 "license": "MIT",

14 "keywords": [

15 "claude-code",

16 "openai",

17 "llm",

18 "cli",

19 "agent",

20 "deepseek",

21 "ollama",

22 "gemini"

23 ],

24 "engines": {

25 "node": ">=22.12.0"

26 },

27 "type": "commonjs",

28 "bin": {

29 "claudin": "./bin/claudin.exe"

30 },

31 "scripts": {

32 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "optionalDependencies": {

35 "@claudiolabs/claudin-linux-arm64-musl": "1.1.38",

36 "@claudiolabs/claudin-win32-x64": "1.1.38",

37 "@claudiolabs/claudin-linux-arm64": "1.1.38",

38 "@claudiolabs/claudin-darwin-x64": "1.1.38",

39 "@claudiolabs/claudin-linux-x64-musl": "1.1.38",

40 "@claudiolabs/claudin-win32-arm64": "1.1.38",

41 "@claudiolabs/claudin-darwin-arm64": "1.1.38",

42 "@claudiolabs/claudin-linux-x64": "1.1.38"

43 },

44 "files": [

45 "bin/",

46 "dist/",

47 "install.cjs",

48 "cli-wrapper.cjs",

49 "README.md"

50 ]

51}

dist/chunks/cli-1.1.38-qebn65cx.mjsView file

Lines 29-51javascript

29 <h1>Codex login failed</h1>

30 <p>${X2(q)}</p>

31 <p>You can close this window and try again in Claudin.</p>

32 </body>

33</

dist/chunks/cli-1.1.38-s1nggz9g.mjsView file

Lines 1-17javascript

1import{Y5 as N5,_5 as Z8}from"./cli-1.1.38-z8x4q5cc.mjs";import{a6 as A,b6 as a$}from"./cli-1.1.38-z9faf3ft.mjs";import{d6 as U2,e6 as JJ}from"./cli-1.1.38-zx5nqvq6.mjs";import

dist/chunks/cli-1.1.38-a678cgp1.mjsView file

Lines 1-21javascript

1import{Cga as NB,yga as Y6}from"./cli-1.1.38-qv0rqvhj.mjs";import{Kga as Yq,Lga as Z6,Mga as YN}from"./cli-1.1.38-6g33twaj.mjs";import{$ga as Hw,Cha as K,Dha as g0,Eha as I,Fha

cli-wrapper.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Fallback launcher for the @claudiolabs/claudin wrapper package.

3//

4// Normally the postinstall (install.cjs) hardlinks the native binary over

5// bin/claudin.exe, so this file is never invoked. It exists for environments

6// where postinstall doesn't run (--ignore-scripts): users can run

7// `node cli-wrapper.cjs` directly and pay the Node-process spawn overhead.

8//

9// If no native binary is available for this platform (unsupported OS/arch, or

10// --omit=optional), it falls back to the Node bundle (dist/cli.mjs) shipped in

dist/chunks/cli-1.1.38-n5tx4p12.mjsView file

Lines 1-16javascript

1import{v1 as $J,x1 as TJ}from"./cli-1.1.38-pnngv0r7.mjs";import{A_ as YJ,Ada as ZJ,B_ as xJ,Nda as NJ,S9 as U,Tfa as q,U9 as P,Yfa as m,c_ as

dist/chunks/cli-1.1.38-dfcp3asv.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/cli-1.1.38-dfcp3asv.mjsView on unpkg · L1

dist/chunks/index-1.1.38-wwvwtd47.mjsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/index-1.1.38-wwvwtd47.mjsView on unpkg · L20

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-1.1.38-ywfxh5hm.mjsView on unpkg · L1

dist/chunks/defaultActionDeps-1.1.38-t4spryyh.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/chunks/defaultActionDeps-1.1.38-t4spryyh.mjsView on unpkg · L1

bin/claudin.exeView file

•path = bin/claudin.exe kind = native_binary sizeBytes = 605 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/claudin.exeView on unpkg

dist/chunks/cache-probe-1.1.38-dvwdm93b.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/cache-probe-1.1.38-dvwdm93b.mjs#virtual:normalized:round1View on unpkg

dist/chunks/cli-1.1.38-exexvj4k.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-exexvj4k.mjsView on unpkg

dist/chunks/cli-1.1.38-tk968ykv.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-tk968ykv.mjsView on unpkg

dist/chunks/cli-1.1.38-kjt1gn6d.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-kjt1gn6d.mjsView on unpkg

dist/chunks/cli-1.1.38-e5by1ynv.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-e5by1ynv.mjsView on unpkg

dist/chunks/cli-1.1.38-t8k5snq9.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-t8k5snq9.mjsView on unpkg

dist/chunks/cli-1.1.38-z9faf3ft.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cli-1.1.38-z9faf3ft.mjsView on unpkg

dist/chunks/openaiShim-1.1.38-12snq1gc.mjsView file

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/chunks/openaiShim-1.1.38-12snq1gc.mjs

dist/chunks/openaiShim-1.1.38-12snq1gc.mjsView on unpkg · L11

@claudiolabs/claudin@1.1.38

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code