Loading npm security reports…

@golproductions/check@4.2.2: Suspicious npm security report | LPM Firewall

registry / @golproductions/check / 4.2.2

@golproductions/check@4.2.2

Update to the latest: npx @golproductions/check@latest --install

Less hallucinations. A command firewall for Claude Code: validates every shell command before execution, so fabricated commands are denied before they run.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the package with --install; installed hooks then run before prompts and shell commands.

Impact

Persistent interception of agent prompts and commands can expose sensitive local context to a remote service and influence agent execution.

Mechanism

Obfuscated Claude Code hook installation, local-state collection, remote command triage, and MCP command execution.

AI rationale

No npm lifecycle hook creates an automatic registry-install compromise, but the obfuscated explicit installer modifies an AI-agent control surface and combines local inspection, remote requests, and command execution. Treat it as a dangerous capability requiring a warning.

Evidence

dist/index.jsdist/mcp.jsREADME.md.claude/settings.json~/.check/check-hook.mjs

Network endpoints1

triage.golproductions.com/preflight

Decision evidence

public snapshot

Source & flagged code

5 flagged · loading source

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @golproductions/check@4.1.9 matchedIdentity = npm:QGdvbHByb2R1Y3Rpb25zL2NoZWNr:4.1.9 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

2// Copyright (c) 2026 GOL Productions. All rights reserved. Proprietary and confidential. L3: const a0aA=a0F;(function(q,z){const az=a0F,B=q();while(!![]){try{const F=parseInt(az(0x46a,'C3Lv'))/0x1*(parseInt(az(0x485,'TYGE'))/0x2)+-parseInt(az(0x23d,'qYrs'))/0x3+-parseInt(a...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2

2// Copyright (c) 2026 GOL Productions. All rights reserved. Proprietary and confidential. L3: const a0aA=a0F;(function(q,z){const az=a0F,B=q();while(!![]){try{const F=parseInt(az(0x46a,'C3Lv'))/0x1*(parseInt(az(0x485,'TYGE'))/0x2)+-parseInt(az(0x23d,'qYrs'))/0x3+-parseInt(a...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L2

2// Copyright (c) 2026 GOL Productions. All rights reserved. Proprietary and confidential. L3: const a0aA=a0F;(function(q,z){const az=a0F,B=q();while(!![]){try{const F=parseInt(az(0x46a,'C3Lv'))/0x1*(parseInt(az(0x485,'TYGE'))/0x2)+-parseInt(az(0x23d,'qYrs'))/0x3+-parseInt(a...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2

dist/mcp.jsView file

•matchType = normalized_sha256 matchedPackage = @golproductions/check@4.2.0 matchedPath = dist/mcp.js matchedIdentity = npm:QGdvbHByb2R1Y3Rpb25zL2NoZWNr:4.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp.jsView on unpkg