registry / @golproductions/check / 4.1.6

@golproductions/check@4.1.6

Update to the latest: npx @golproductions/check@latest --install

Less hallucinations. A command firewall for Claude Code: validates every shell command before execution, so fabricated commands are denied before they run.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the CLI install command, followed by AI-agent command use.

Impact

The package can influence agent command execution and disclose command context to its service.

Mechanism

Global AI-agent hook with remote command validation.

AI rationale

There is no automatic registry-install lifecycle or self-dependency chain, so blocking as malware is not supported. The intentionally opaque, remote AI-agent permission hook remains a meaningful dangerous capability and should be warned.

Evidence

dist/index.js~/.claude/settings.json~/.check/key

Network endpoints1

triage.golproductions.com/preflight

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

@golproductions/check@4.1.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code