@decoopus/claude-setup@1.0.12: Clean npm security report (Allow)

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Source inspection found an explicitly user-invoked gateway setup that displays the default endpoint, accepts a URL override, and stores the supplied key as the gateway credential. The manifest has no install hook, and the inspected source showed no separate credential collection or transfer behavior.

Static reason

No blocking static signals were detected.

Trigger

A user runs the setup CLI and supplies an API key, optionally overriding the gateway URL.

Impact

Subsequent Claude requests use the configured gateway and credential, consistent with the package's stated setup purpose.

Mechanism

The CLI writes the URL and key into Claude Desktop configuration, then launches Claude Desktop.

AI rationale

Source inspection found an explicitly user-invoked gateway setup that displays the default endpoint, accepts a URL override, and stores the supplied key as the gateway credential. The manifest has no install hook, and the inspected source showed no separate credential collection or transfer behavior.

Evidence

bin/cli.js

Network endpoints1

api-anthropic.help

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The manifest exposes a CLI entry point and has no install lifecycle hook.
The package describes setup for a third-party gateway and displays its default endpoint.
The CLI allows a caller to override the gateway URL and prompts for an API key.
The CLI stores the supplied key as the gateway credential in Claude configuration during user-invoked setup.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 31.9 KB of source, external domains: api-anthropic.help

Source & flagged code

8 flagged

package.jsonView file

15"scripts": { "start": "node ./bin/cli.js" }, "keywords": [ "claude", "claude-deskt

Low

Suspicious Lifecycle Evidence

The manifest exposes a CLI entry point and has no install lifecycle hook.

package.jsonView on unpkg · L15

README.mdView file

3> Automated one-command setup for Claude Desktop with custom 3P inference gateway, user email identity binding, and Claude Code theme. Easily configure Claude Desktop to route requests through custom or enterprise AI gateways (such as `https://api-anthropic.h

Low

Ai Review Evidence

The package describes setup for a third-party gateway and displays its default endpoint.

README.mdView on unpkg · L3

17It will prompt for their email and API key: ```text ▐▛███▛█ Claude Desktop Setup v1.0.12 ▝▜██████▀ Claude Max 20x · API Usage Billing ▝▝ ▝▝ https://api-anthropic.help ──────────────────────────────────────────────────────

Low

Ai Review Evidence

The package describes setup for a third-party gateway and displays its default endpoint.

README.mdView on unpkg · L17

bin/cli.jsView file

17const DEFAULT_GATEWAY_URL = 'https://api-anthropic.help'; const DEFAULT_AUTH_SCHEME = 'bearer'; const DEFAULT_MODELS = [ { name: 'claude-fable-5-1', labelOverride: 'Clau

Low

Ai Review Evidence

The CLI allows a caller to override the gateway URL and prompts for an API key.

bin/cli.jsView on unpkg · L17

844apiKey = args[++i] || ''; } else if (arg === '-e' || arg === '--email') { email = args[++i] || ''; } else if (arg === '-u' || arg === '--url') { gatewayUr

Low

Ai Review Evidence

The CLI allows a caller to override the gateway URL and prompts for an API key.

bin/cli.jsView on unpkg · L844

910// Prompt 2: API Key if (!apiKey) { log(`\n ${c.terracotta}✳${c.reset} ${c.creamBold}Enter your API Key:${c.reset}`); apiKey = await askQuestion(` ${c.sand}API Key: ${c.reset}`); } if (!apiKey) { error('API Key cannot be empty. Setup aborted.'); pr

Low

Ai Review Evidence

The CLI stores the supplied key as the gateway credential in Claude configuration during user-invoked setup.

bin/cli.jsView on unpkg · L910

594config.inferenceProvider = 'gateway'; config.inferenceCredentialKind = 'static'; config.inferenceGatewayBaseUrl = url; config.inferenceGatewayApiKey = apiKey; config.inferenceGatewayAuthScheme = authS

Source & flagged code

8 flagged · loading source

package.jsonView file

15"scripts": { "start": "node ./bin/cli.js" }, "keywords": [ "claude", "claude-deskt

Low

Suspicious Lifecycle Evidence

The manifest exposes a CLI entry point and has no install lifecycle hook.

package.jsonView on unpkg · L15

README.mdView file

3> Automated one-command setup for Claude Desktop with custom 3P inference gateway, user email identity binding, and Claude Code theme. Easily configure Claude Desktop to route requests through custom or enterprise AI gateways (such as `https://api-anthropic.h

Low

Ai Review Evidence

The package describes setup for a third-party gateway and displays its default endpoint.

README.mdView on unpkg · L3

17It will prompt for their email and API key: ```text ▐▛███▛█ Claude Desktop Setup v1.0.12 ▝▜██████▀ Claude Max 20x · API Usage Billing ▝▝ ▝▝ https://api-anthropic.help ──────────────────────────────────────────────────────

Low

Findings

1 Medium11 Low

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review EvidenceREADME.md

LowAi Review Evidencebin/cli.js

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code