registry / @golproductions/check / 4.2.0

@golproductions/check@4.2.0

Less hallucinations. A command firewall for Claude Code: validates every shell command before execution, so fabricated commands are denied before they run.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Runtime use contacts a remote service and executes server-directed probe content through a shell. Its MCP execution tool also runs supplied commands.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the CLI or invoking its MCP tools.

Impact

A remote service can cause arbitrary commands to run with the invoking user's privileges.

Mechanism

Obfuscated remote-directed shell execution.

Attack narrative

The obfuscated CLI posts validation data to the triage service. If the service returns probe entries, the code forwards them to a shell using a shell command argument. This grants the remote endpoint control over commands executed on the user's machine during normal validation. The companion MCP server also provides a command-execution tool.

AI rationale

Although installation has no automatic registry lifecycle hook, the package combines deliberate obfuscation with remote-controlled shell execution in its normal runtime path. This is a concrete remote code execution capability.

Evidence

dist/index.jsdist/mcp.js

Network endpoints1

triage.golproductions.com/preflight

Decision evidence

public snapshot

AI called this at 98.0% confidence with false-positive risk.

@golproductions/check@4.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code