registry / @daniellins/power-claude / 0.17.1
@daniellins/power-claude@0.17.1
Lean, budget-gated agent framework for Claude Code — pods by job-to-be-done
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 20 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcebin/cli.jsView file
17L18: const path = require('node:path');
L19: const pkg = require(path.join(__dirname, '..', 'package.json'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L17scripts/pod-export-tools.cjsView file
21const path = require('node:path');
L22: const https = require('node:https');
L23: const http = require('node:http');
...
L83: let parsed;
L84: try { parsed = JSON.parse(fs.readFileSync(ledgerPath, 'utf8')); } catch (e) {
L85: throw new Error(`registro de proveniência ilegível (${ledgerPath}): ${e.message} — recusando gravar por cima (fail-loud)`);
...
L319: res.on('data', (d) => { if (buf.length < maxBytes) buf = Buffer.concat([buf, d]); });
L320: res.on('end', () => resolve({ ok: true, status: res.statusCode, contentType: res.headers['content-type'] || '', body: buf.slice(0, maxBytes).toString('utf8'), bytes: buf.length }))...
L321: });
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
scripts/pod-export-tools.cjsView on unpkg · L21Findings
10 High5 Medium5 Low
HighCloud Metadata Accessscripts/pod-export-tools.cjs
HighSemantic Analysis Limitedinstaller/motor-scripts.json
HighKnown Malware Source Similarityscripts/pod-export-service.cjs
HighKnown Malware Source Similarityscripts/validate-story-acs.cjs
HighKnown Malware Source Similarityscripts/pod-export-compile.cjs
HighKnown Malware Source Similarityscripts/pod-export-executor.cjs
HighKnown Malware Source Similarityscripts/pod-export-ui.cjs
HighKnown Malware Source Similarityscripts/veto-checks/html-valid.cjs
HighKnown Malware Source Similarityscripts/pod-export-tools.cjs
HighKnown Malware Source Similaritytemplate/pods/dev-ia/tools/db-ops/bootstrap-runner.sh
Affected versions and remediation
This report applies to @daniellins/power-claude@0.17.1.
See all versions of @daniellins/power-claude for other recorded verdicts.
- Review the evidence and your use of @daniellins/power-claude@0.17.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.