registry / Credential exfiltration / @daniellins/power-claude
@daniellins/power-claude
Lean, budget-gated agent framework for Claude Code — pods by job-to-be-done
This report shows the evidence for @daniellins/power-claude@0.16.4. 1 of 4 known versions is blocked or flagged. The newest version, 0.17.2, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiHard-coded reads of unrelated local secret files combined with authenticated outbound requests establish credential-exfiltration behavior. The lack of lifecycle hooks limits automatic activation but does not remove the concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the installed pc-export executor.
Impact
Disclosure and use of local API credentials.
Mechanism
Hard-coded local credential fallback followed by authenticated API request.
Attack narrative
The installed export executor first uses environment credentials, but silently falls back to two hard-coded personal .env locations. It then transmits the resulting Anthropic credential as an API authentication header. These paths are unrelated to a normal package configuration and create a targeted local-secret harvesting path whenever the export command is run.
AI rationale
Hard-coded reads of unrelated local secret files combined with authenticated outbound requests establish credential-exfiltration behavior. The lack of lifecycle hooks limits automatic activation but does not remove the concrete malicious chain.
Evidence
scripts/pod-export-executor.cjsscripts/pod-export-tools.cjsinstaller/motor-scripts.jsonpackage.json~/projetos/dev/second-brain/app/.env.local~/projetos/bench/.env
Network endpoints2
api.anthropic.com/v1/messagesopenrouter.ai/api/v1/chat/completions
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Production executor reads API keys from hard-coded developer home-directory .env paths when environment variables are absent.
- The harvested Anthropic key is sent as an x-api-key to api.anthropic.com.
- The installer distributes the executor as a motor script.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- CLI installation is user-invoked; no import-time network activity was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcescripts/veto-checks/render-gate.cjsView file
37const path = require('node:path');
L38: const { execFileSync } = require('node:child_process');
L39:
High
Child Process
Package source references child process execution.
scripts/veto-checks/render-gate.cjsView on unpkg · L37bin/cli.jsView file
17L18: const path = require('node:path');
L19: const pkg = require(path.join(__dirname, '..', 'package.json'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L17scripts/pod-export-ui.test.cjsView file
20Source sends the broad process environment to a literal external destination.
L20:
L21: const http = require('node:http');
L22: const fs = require('node:fs');
...
L73: });
L74: // O approveRun real lê PODEXPORT_IDENTITIES do env (loadIdentities), então exponha no process.env.
L75: process.env.PODEXPORT_IDENTITIES = identitiesFile;
...
L90: let data = ''; res.on('data', (c) => { data += c; });
L91: res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data }));
L92: });
...
L153: assert(rej.ok && rej.kind === 'blocked', 'rejectRun move o run para blocked/');
L154: const blockedRes = JSON.parse(fs.readFileSync(path.join(cfg.queueDir, 'blocked', `${list[0].runId}.result.json`), 'utf8'));
L155: assert(blockedRes.rejected === true && blockedRes.reason === 'fora do b
Findings
2 Critical4 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationscripts/pod-export-ui.test.cjs
CriticalDownload Executescripts/pod-export-queue-race.test.cjs
HighChild Processscripts/veto-checks/render-gate.cjs
HighCloud Metadata Accessscripts/pod-export-executor.test.cjs
HighRuntime Package Installscripts/npm-scope-invocation.test.cjs
HighPayload In Excluded Dirscripts/__fixtures__/migrate-squad/legacy-squad/scripts/validate-mvn.py
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplate/pods/dev-ia/tools/db-ops/migration-runner.sh
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @daniellins/power-claude@0.16.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @daniellins/power-claude@0.16.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.