registry / @decoopus/claude-setup / 1.0.11
@decoopus/claude-setup@1.0.11
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe package’s executable behavior is a user-run third-party gateway setup tool: it prompts for gateway credentials and stores them in Claude configuration. No install-time trigger or package-side credential transfer was identified.
Static reason
No blocking static signals were detected.
Trigger
User runs the CLI and provides or accepts the gateway settings.
Impact
No unauthorized access or disclosure was established from the inspected source.
Mechanism
The CLI saves the supplied gateway key and URL in Claude’s configuration; source inspection found no package-side credential transmission.
AI rationale
The package’s executable behavior is a user-run third-party gateway setup tool: it prompts for gateway credentials and stores them in Claude configuration. No install-time trigger or package-side credential transfer was identified.
Evidence
bin/cli.js
Network endpoints1
api-anthropic.help
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and only a start script; it has no install lifecycle hook.
- The CLI describes a third-party inference gateway and sets a default gateway URL.
- The CLI prompts for a gateway API key and an email address during setup.
- The CLI stores the supplied key and gateway URL in Claude’s gateway configuration.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
UrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
5"main": "bin/cli.js",
"bin": {
"claude-desktop-setup": "bin/cli.js",
"claude-setup": "bin/cli.js"
},
"files": [
"bin",
"README.md",
"LICENSE"
],
"scripts": {
"start": "node ./bin/cli.js"
},
"keywords": [
"claude",
Low
Suspicious Lifecycle Evidence
package.json exposes a CLI and only a start script; it has no install lifecycle hook.
package.jsonView on unpkg · L5bin/cli.jsView file
16// Default configurations
const DEFAULT_GATEWAY_URL = 'https://api-anthropic.help';
const DEFAULT_AUTH_SCHEME = 'bearer';
const DEFAULT_MODELS = [
{ name: 'claude-fable-5-1', lab
Low
Ai Review Evidence
The CLI describes a third-party inference gateway and sets a default gateway URL.
bin/cli.jsView on unpkg · L1688npx claude-desktop-setup [apiKey] [options]
${c.creamBold}Arguments:${c.reset}
apiKey Your gateway API key (prompted interactively if omitted)
${c.creamBold
Low
Findings
1 Medium9 Low
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/cli.js
LowAi Review Evidencebin/cli.js
LowAi Review Evidencebin/cli.js
LowAi Review Evidencebin/cli.js
LowAi Review Evidencebin/cli.js
Affected versions and remediation
This report applies to @decoopus/claude-setup@1.0.11.
See all versions of @decoopus/claude-setup for other recorded verdicts.
- Review the evidence and your use of @decoopus/claude-setup@1.0.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.