@decoopus/claude-setup@1.0.9
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe package has no install hook or confirmed credential exfiltration, but its explicit CLI setup mutates Claude Desktop’s inference configuration to use a publisher-selected third-party gateway. Warn about this agent configuration capability without treating it as a confirmed attack.
Decision evidence
public snapshot- The package describes a third-party gateway setup command and exposes a CLI entry point; its manifest lists a start script but no install lifecycle hook.
- The CLI defaults to api-anthropic.help and also allows a caller-supplied gateway URL.
- The CLI asks the user for a gateway API key or accepts one as an argument.
- The CLI writes the gateway URL and key into Claude Desktop configuration.
- The package’s stated purpose is configuring Claude Desktop for a third-party inference gateway.
- The configuration change requires running the CLI; the inspected source does not establish that the package itself sends credentials or prompts over the network.
Source & flagged code
7 flagged · loading sourceThe package describes a third-party gateway setup command and exposes a CLI entry point; its manifest lists a start script but no install lifecycle hook.
package.jsonView on unpkg · L4The package describes a third-party gateway setup command and exposes a CLI entry point; its manifest lists a start script but no install lifecycle hook.
package.jsonView on unpkg · L15Findings
Affected versions and remediation
This report applies to @decoopus/claude-setup@1.0.9.
See all versions of @decoopus/claude-setup for other recorded verdicts.
- Review the evidence and your use of @decoopus/claude-setup@1.0.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.