registry / @decoopus/claude-setup / 1.0.7

@decoopus/claude-setup@1.0.7

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The package has no install lifecycle hook and its CLI performs the declared, user-invoked third-party gateway setup. The default host merits awareness, but the inspected source does not show an attack or unsolicited credential disclosure.

Static reason

No blocking static signals were detected.

Trigger

User invokes the CLI and supplies or enters a gateway API key.

Impact

Claude Desktop uses the configured gateway; the inspected source does not show unsolicited transfer of existing Anthropic credentials or session data.

Mechanism

The CLI displays the chosen gateway endpoint and writes that endpoint and key to Claude Desktop configuration.

AI rationale

Evidence

claude_desktop_config.json

Network endpoints1

api-anthropic.help

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes bin/cli.js and declares only a start script, with no install lifecycle hook.
The package describes itself as a setup tool for a custom third-party inference gateway.
The CLI accepts a gateway URL override and displays the selected endpoint before applying settings.
The CLI prompts for an API key when one is not supplied.
The CLI stores that key and endpoint in Claude Desktop configuration files.

Evidence against

The default gateway is the third-party host https://api-anthropic.help, but the CLI presents it as the custom gateway being configured.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 26.2 KB of source, external domains: api-anthropic.help

Source & flagged code

8 flagged

package.jsonView file

5"main": "bin/cli.js", "bin": { "claude-desktop-setup": "bin/cli.js", "claude-setup": "bin/cli.js" }, "files": [ "bin",

Low

Suspicious Lifecycle Evidence

The manifest exposes bin/cli.js and declares only a start script, with no install lifecycle hook.

package.jsonView on unpkg · L5

15"scripts": { "start": "node ./bin/cli.js" }, "keywords": [

Low

Suspicious Lifecycle Evidence

The manifest exposes bin/cli.js and declares only a start script, with no install lifecycle hook.

package.jsonView on unpkg · L15

4"description": "One-command setup for Claude Desktop with custom 3P inference gateway", "main":

Low

Ai Review Evidence

The package describes itself as a setup tool for a custom third-party inference gateway.

package.jsonView on unpkg · L4

bin/cli.jsView file

632} else if (arg === '-u' || arg === '--url') { gatewayUrl = args[++i] || DEFAULT_GATEWAY_URL; } else if (!arg.startsWith('-')) { if (!apiKey) {

Low

Ai Review Evidence

The CLI accepts a gateway URL override and displays the selected endpoint before applying settings.

bin/cli.jsView on unpkg · L632

17const DEFAULT_GATEWAY_URL = 'https://api-anthropic.help'; c

Low

Ai Review Evidence

The CLI accepts a gateway URL override and displays the selected endpoint before applying settings.

bin/cli.jsView on unpkg · L17

710log(` Gateway Endpoint : ${c.terracotta}${gatewayUrl}${c.reset}`); log(` API Key : ${c.sand}●●●●●●●●●● (${apiKey.slice(0

Low

Ai Review Evidence

The CLI accepts a gateway URL override and displays the selected endpoint before applying settings.

bin/cli.jsView on unpkg · L710

698apiKey = await askQuestion(` ${c.sand}API Key: ${c.reset}`); } if (!apiKey) { error('API Key cannot be empty

Low

Ai Review Evidence

The CLI prompts for an API key when one is not supplied.

bin/cli.jsView on unpkg · L698

758const configPaths = getConfigFilePaths(); for (const item of configPaths) { const ok = updateConfigFile(item.file, gatewayUrl, apiKey, authScheme, email); if (ok) {

Source & flagged code

8 flagged · loading source

package.jsonView file

5"main": "bin/cli.js", "bin": { "claude-desktop-setup": "bin/cli.js", "claude-setup": "bin/cli.js" }, "files": [ "bin",

Low

Suspicious Lifecycle Evidence

The manifest exposes bin/cli.js and declares only a start script, with no install lifecycle hook.

package.jsonView on unpkg · L5

15"scripts": { "start": "node ./bin/cli.js" }, "keywords": [

Low

Suspicious Lifecycle Evidence

The manifest exposes bin/cli.js and declares only a start script, with no install lifecycle hook.

package.jsonView on unpkg · L15

4"description": "One-command setup for Claude Desktop with custom 3P inference gateway", "main":

Low

Ai Review Evidence

The package describes itself as a setup tool for a custom third-party inference gateway.

package.jsonView on unpkg · L4

bin/cli.jsView file

Findings

1 Medium11 Low

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencepackage.json

LowAi Review Evidencebin/cli.js

Affected versions and remediation

This report applies to @decoopus/claude-setup@1.0.7.

See all versions of @decoopus/claude-setup for other recorded verdicts.

Review the evidence and your use of @decoopus/claude-setup@1.0.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 11:45:39.491Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.