Loading npm security reports…

@costrict/csc@4.2.25: Malicious npm security report (Block) | LPM Firewall

registry / @costrict/csc / 4.2.25

@costrict/csc@4.2.25

costrict

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Installation mutates Claude Code's command control surface through a newly fetched global package. During normal CLI use, a background worker uploads AI session and repository data remotely by default.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; then normal csc assistant/session use.

Impact

Remote code/control-surface extension and exfiltration of prompts, responses, tool events, diffs, transcripts, and commit data.

Mechanism

unconsented Claude command installation plus default remote session/repository upload

Attack narrative

The postinstall hook fetches the mutable latest @costrict/cosknow globally and invokes its installer for ~/.claude/commands without user action. Separately, normal csc session use starts a worker that is remote-enabled by default and uploads raw transcript events, prompts, responses, diffs, tool events, and commit metadata to a hardcoded service; it uses stored access credentials when available and falls back to an anonymous device identifier.

Rationale

This is concrete unconsented install-time modification of an external AI-agent control surface, compounded by default collection and remote upload of sensitive development and AI-session content. The behavior is source-confirmed rather than inferred from scanner labels.

Evidence

package.jsonscripts/install-cosknow.mjsscripts/setup-chrome-mcp.mjsdist/cli.jsdist/services/rawDump/batchWorker.js~/.claude/commands/

Network endpoints3

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install-cosknow.mjsView file

21try { L22: const mod = await import(pathToFileURL(join(globalPrefix, '@costrict', 'cosknow', 'dist', 'index.js')).href) L23: install = mod.install

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install-cosknow.mjsView on unpkg · L21

dist/services/rawDump/batchWorker.jsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. [redacted].js: if (process.env.COSTRICT_CONFIG_DIR || process.env.CLAUDE_CONFIG_DIR) { const nodeOptions = process.env.NODE_OPTIONS; return process.env[`${ENV_PREFIX}_${suffix}`] ?? process.env[`${LEGACY_ENV_PREFIX}_${suffix}`] ?? process.env[`${LEGACY_BRIDGE_ENV_PREFIX}_${suffix}`]; return isEnvTruthy(process.env.COSTRICT_SIMPLE) || isEnvTruthy(process.env.CLAUDE_CODE_SIMPLE) || process.argv.includes("--bare"); return process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || "us-east-1"; return process.env.USER_TYPE === "sf" && isEnvTruthy(process.env.COO_RUNNING_ON_HOMESPACE); return (process.env.COSTRICT_CONFIG_DIR ?? process.env.

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/services/rawDump/batchWorker.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @costrict/csc@4.2.20 matchedIdentity = npm:QGNvc3RyaWN0L2NzYw:4.2.20 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/services/rawDump/batchWorker.jsView on unpkg

scripts/postinstall.cjsView file

15require("fs") L16: const { spawn, spawnSync } = require("child_process") L17: const { setDefaultResultOrder } = require("node:dns") L18: const path = require("path") ... L32: const MIRROR_RELEASE_BASE = `https://ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}` L33: const RELEASE_BASE = (process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE).replace(/\/$/, "") L34: // costrict change: fallback to private registry when GitHub and ghproxy are both unreachable L35: const COSTRICT_PRIVATE_BASE = "https://shenma.sangfor.com.cn/costrict-cli/pkg/ripgrep" ... L42: function getPlatformMapping() { L43: const arch = process.arch L44: const platform = process.platform ... L119: // csc.ps1 before csc.cmd, and enterprise ExecutionPolicy often blocks .ps

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L15

15require("fs") L16: const { spawn, spawnSync } = require("child_process") L17: const { setDefaultResultOrder } = require("node:dns") L18: const path = require("path") ... L32: const MIRROR_RELEASE_BASE = `https://ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}` L33: const RELEASE_BASE = (process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE).replace(/\/$/, "") L34: // costrict change: fallback to private registry when GitHub and ghproxy are both unreachable L35: const COSTRICT_PRIVATE_BASE = "https://shenma.sangfor.com.cn/costrict-cli/pkg/ripgrep" ... L42: function getPlatformMapping() { L43: const arch = process.arch L44: const platform = process.platform ... L119: // csc.ps1 before csc.cmd, and enterprise ExecutionPolicy often blocks .ps

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjs

scripts/setup-chrome-mcp.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { execfilesync } from 'node:child_process' import { mkdirsync } from 'node:fs' import { createrequire } from 'node:module' import { homedir } from 'node:os' import { join } from 'node:path' if (process.env.claude_code_skip_chrome_mcp_setup === '1') { process.exit(0) } const require = createrequire(import.meta.url) const clipath = require.resolve( '@claude-code-best/mcp-chrome-bridge/dist/cli.js', ) const userargs = process.argv.

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/setup-chrome-mcp.mjsView on unpkg

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 33998021 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 33998021 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 57-97json

57 "build:binary:all": "bun run build && bun run compile:linux && bun run compile:linux-baseline && bun run compile:linux-musl && bun run compile:linux-musl-baseline && bun run compile:win && bun run compile:win-baseline && bun run compile:mac-arm64 && bun run compile:mac-x64 && bun run compile:mac-x64-baseline",

58 "compile:linux": "bun build dist/cli.js --compile --target=bun-linux-x64 --outfile dist/csc-linux-x64",

59 "compile:linux-baseline": "bun build dist/cli.js --compile --target=bun-linux-x64-baseline --outfile dist/csc-linux-x64-baseline",

60 "compile:linux-musl": "bun build dist/cli.js --compile --target=bun-linux-x64-musl --outfile dist/csc-linux-x64-musl",

61 "compile:linux-musl-baseline": "bun build dist/cli.js --compile --target=bun-linux-x64-musl-baseline --outfile dist/csc-linux-x64-musl-baseline",

62 "compile:win": "bun build dist/cli.js --compile --target=bun-windows-x64 --outfile dist/csc-windows-x64.exe",

63 "compile:win-baseline": "bun build dist/cli.js --compile --target=bun-windows-x64-baseline --outfile dist/csc-windows-x64-baseline.exe",

64 "compile:mac-arm64": "bun build dist/cli.js --compile --target=bun-darwin-arm64 --outfile dist/csc-darwin-arm64",

65 "compile:mac-x64": "bun build dist/cli.js --compile --target=bun-darwin-x64 --outfile dist/csc-darwin-x64",

66 "compile:mac-x64-baseline": "bun build dist/cli.js --compile --target=bun-darwin-x64-baseline --outfile dist/csc-darwin-x64-baseline",

67 "dev": "bun run scripts/dev.ts",

68 "dev:inspect": "bun run scripts/dev-debug.ts",

69 "prepublishOnly": "bun run security:scan && bun run build",

70 "lint": "biome lint src/",

71 "lint:fix": "biome lint --fix src/",

72 "format": "biome format --write src/",

73 "prepare": "git config core.hooksPath .githooks",

74 "test": "bun test",

75 "check:unused": "knip-bun",

76 "health": "bun run scripts/health-check.ts",

77 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "docs:dev": "npx mintlify dev",

79 "typecheck": "tsc --noEmit",

80 "rcs": "bun run scripts/rcs.ts",

81 "self-verify": "bun run scripts/self-verify.ts",

82 "security:scan": "bun run scripts/security-scan.ts"

83 },

84 "dependencies": {

85 "@agentclientprotocol/sdk": "^0.19.2",

86 "@anthropic-ai/sandbox-runtime": "^0.0.54",

87 "@claude-code-best/mcp-chrome-bridge": "^2.0.9",

88 "@protobufjs/utf8": "1.1.1",

89 "baseline-browser-mapping": "2.10.29",

90 "gray-matter": "^4.0.3",

91 "hono": "^4.12.26",

92 "partial-json": "^0.1.7",

93 "pngjs": "5.0.0",

94 "semver": "^7.8.4",

95 "undici": "^7.28.0",

96 "ws": "^8.21.0"

97 },

scripts/install-cosknow.mjsView file

Lines 1-35javascript

1import { spawnSync, execSync } from 'node:child_process'

2import { join } from 'node:path'

3import { pathToFileURL } from 'node:url'

4

5// 全局安装最新版

6spawnSync('npm', ['install'

dist/services/rawDump/batchWorker.jsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. [redacted].js: if (process.env.COSTRICT_CONFIG_DIR || process.env.CLAUDE_CONFIG_DIR) { const nodeOptions = process.env.NODE_OPTIONS; return process.env[`${ENV_PREFIX}_${suffix}`] ?? process.env[`${LEGACY_ENV_PREFIX}_${suffix}`] ?? process.env[`${LEGACY_BRIDGE_ENV_PREFIX}_${suffix}`]; return isEnvTruthy(process.env.COSTRICT_SIMPLE) || isEnvTruthy(process.env.CLAUDE_CODE_SIMPLE) || process.argv.includes("--bare"); return process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || "us-east-1"; return process.env.USER_TYPE === "sf" && isEnvTruthy(process.env.COO_RUNNING_ON_HOMESPACE); return (process.env.COSTRICT_CONFIG_DIR ?? process.env.

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/services/rawDump/batchWorker.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @costrict/csc@4.2.20 matchedIdentity = npm:QGNvc3RyaWN0L2NzYw:4.2.20 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/services/rawDump/batchWorker.jsView on unpkg

scripts/postinstall.cjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

scripts/setup-chrome-mcp.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { execfilesync } from 'node:child_process' import { mkdirsync } from 'node:fs' import { createrequire } from 'node:module' import { homedir } from 'node:os' import { join } from 'node:path' if (process.env.claude_code_skip_chrome_mcp_setup === '1') { process.exit(0) } const require = createrequire(import.meta.url) const clipath = require.resolve( '@claude-code-best/mcp-chrome-bridge/dist/cli.js', ) const userargs = process.argv.

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/setup-chrome-mcp.mjsView on unpkg

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 33998021 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 33998021 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg