@kaitranntt/ccs: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@kaitranntt/ccs: AI-agent control-surface risk | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/assets/index-m5EMndrQ.jsView file

10patternName = generic_password severity = medium line = 10

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/assets/index-m5EMndrQ.jsView on unpkg · L10

dist/utils/ui/init.jsView file

17*/ L18: const dynamicImport = new Function('specifier', 'return import(specifier)'); L19: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/utils/ui/init.jsView on unpkg · L17

dist/ui/assets/proxy-C4-M_9kB.jsView file

8} L9: `),()=>{a.current?.removeAttribute("data-motion-pop-id"),b.contains(T)&&b.removeChild(T)}},[e]),nt.jsx(Tu,{isPresent:e,childRef:a,sizeRef:u,pop:r,children:r===!1?t:w.cloneElement(t...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/assets/proxy-C4-M_9kB.jsView on unpkg · L8

dist/utils/shell-completion.jsView file

32Trigger-reachable persistence chain: scripts.dev -> dist/ccs.js -> dist/dispatcher/cli-argument-parser.js -> dist/commands/root-command-router.js -> dist/commands/shell-completion-command.js -> dist/utils/shell-completion.js L32: * Shell Completion Installer L33: * Auto-configures shell completion for bash, zsh, fish, PowerShell L34: */ ... L36: constructor() { L37: this.homeDir = os.homedir(); L38: this.ccsDir = (0, config_manager_1.getCcsDir)(); ... L45: detectShell() { L46: const shell = process.env.SHELL || ''; L47: if (shell.includes('bash')) ... L52: return 'fish'; L53: if (process.platform === 'win32') L54: return 'powershell';

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/utils/shell-completion.jsView on unpkg · L32

32* Shell Completion Installer L33: * Auto-configures shell completion for bash, zsh, fish, PowerShell L34: */ ... L36: constructor() { L37: this.homeDir = os.homedir(); L38: this.ccsDir = (0, config_manager_1.getCcsDir)(); ... L45: detectShell() { L46: const shell = process.env.SHELL || ''; L47: if (shell.includes('bash')) ... L52: return 'fish'; L53: if (process.platform === 'win32') L54: return 'powershell';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shell-completion.jsView on unpkg · L32

scripts/postinstall.jsView file

79L80: // Check ~/.claude/settings.json (warning only, not critical) L81: const claudeSettings = path.join(homedir, '.claude', 'settings.json'); L82: if (!fs.existsSync(claudeSettings)) { L83: warnings.push('~/.claude/settings.json not found - run "claude /login"'); L84: } ... L104: } else { L105: fs.mkdirSync(ccsDir, { recursive: true, mode: 0o755 }); L106: console.log('[OK] Created directory: ~/.ccs/'); ... L113: if (!fs.existsSync(sharedDir)) { L114: fs.mkdirSync(sharedDir, { recursive: true, mode: 0o755 }); L115: console.log('[OK] Created directory: ~/.ccs/shared/');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L79

dist/utils/claude-symlink-manager.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. var __createbinding = (this && this.__createbinding) || (object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = object.getownpropertydescriptor(m, k); if (!desc || ("get" in desc ? !m.__esmodule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } object.defineproperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setmoduledefault = (this && this.__setmoduledefault) || (object.create ? (function(o, v) { object.defineproperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/utils/claude-symlink-manager.jsView on unpkg

scripts/get-version.shView file

•path = scripts/get-version.sh kind = build_helper sizeBytes = 323 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/get-version.shView on unpkg

dist/auth/commands/create-command.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/auth/commands/create-command.js#virtual:normalized:round1View on unpkg

dist/commands/bar/launch-subcommand.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kaitranntt/ccs@8.9.0 matchedIdentity = npm:QGthaXRyYW5udHQvY2Nz:8.9.0 similarity = 0.467 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/bar/launch-subcommand.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 41-118json

41 "lib/",

42 "scripts/",

43 "config/",

44 ".claude/",

45 "VERSION",

46 "README.md",

47 "LICENSE"

48 ],

49 "engines": {

50 "node": ">=18.0.0",

51 "bun": ">=1.0.0"

52 },

53 "packageManager": "bun@1.3.9",

54 "os": [

55 "darwin",

56 "linux",

57 "win32"

58 ],

59 "preferGlobal": true,

60 "scripts": {

61 "preinstall": "node scripts/preinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "postuninstall": "node scripts/postuninstall.js",

63 "build": "tsc && node scripts/add-shebang.js",

64 "build:watch": "tsc --watch",

65 "build:server": "tsc && node scripts/add-shebang.js",

66 "build:all": "bun run ui:build && bun run build:server",

67 "prebuild": "node scripts/clean-dist.js",

68 "prebuild:server": "node scripts/clean-dist.js",

69 "prebuild:all": "rm -rf dist tsconfig.tsbuildinfo",

70 "postbuild:all": "node scripts/verify-bundle.js",

71 "typecheck": "tsc --noEmit",

72 "lint": "eslint src/",

73 "lint:fix": "eslint src/ --fix",

74 "format": "prettier --write src/",

75 "format:check": "prettier --check src/",

76 "validate": "bun run typecheck && bun run lint && bun run format:check && bun run test:fast",

77 "validate:ci-parity": "bash scripts/ci-parity-gate.sh",

78 "verify:bundle": "node scripts/verify-bundle.js",

79 "test": "bun run build && bun run test:all",

80 "test:ci": "bun run test:all",

81 "test:fast": "node scripts/run-test-bucket.js fast",

82 "test:slow": "node scripts/run-test-bucket.js slow",

83 "test:all": "node scripts/run-test-bucket.js all",

84 "test:unit": "bun test tests/unit",

85 "test:npm": "bun test tests/npm/",

86 "test:native": "bash tests/native/unix/edge-cases.sh",

87 "test:runtime-matrix": "bun run build && CCS_RUNTIME_MATRIX=1 bun test tests/integration/proxy/runtime-transport-matrix.test.ts --timeout 60000",

88 "test:e2e": "bun test tests/e2e/ --bail --timeout 60000",

89 "report:hardening": "node scripts/hardening-inventory.js",

90 "dev": "bun run build:server && node dist/ccs.js config --dev",

91 "dev:symlink": "bash scripts/dev-symlink.sh",

92 "dev:unlink": "bash scripts/dev-symlink.sh --restore",

93 "ui:build": "cd ui && bun run build",

94 "ui:preview": "cd ui && bun run preview",

95 "ui:validate": "cd ui && bun run validate",

96 "prepack": "bun run build:all",

97 "prepare": "husky",

98 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 },

100 "dependencies": {

101 "bcrypt": "^6.0.0",

102 "boxen": "^5.1.2",

103 "chalk": "^4.1.2",

104 "chokidar": "^3.6.0",

105 "cli-table3": "^0.6.5",

106 "express": "^4.18.2",

107 "express-rate-limit": "^8.2.1",

108 "express-session": "^1.18.2",

109 "get-port": "^5.1.1",

110 "gradient-string": "^2.0.2",

111 "http-proxy-agent": "^7.0.2",

112 "https-proxy-agent": "^7.0.6",

113 "js-yaml": "^4.1.1",

114 "listr2": "^3.14.0",

115 "open": "^8.4.2",

116 "ora": "^5.4.1",

117 "proper-lockfile": "^4.1.2",

118 "smol-toml": "^1.6.1",

dist/ui/assets/index-m5EMndrQ.jsView file

10patternName = generic_password severity = medium line = 10

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/assets/index-m5EMndrQ.jsView on unpkg · L10

dist/utils/ui/init.jsView file

Lines 1-37javascript

1"use strict";

2/**

3 * UI Initialization

4 *

5 * Handles lazy loading of ESM dependencies

6 * @module utils/ui/init

7 */

8Object.defineProperty(exports, "__esModule", { value:

dist/ui/assets/proxy-C4-M_9kB.jsView file

Lines 1-10javascript

1import{j as nt}from"./radix-ui-nu4wz29m.js";import{r as w}from"./react-vendor-Bjx91N7w.js";const Qe=w.createContext({});function tn(t){const

dist/utils/shell-completion.jsView file

Lines 12-52javascript

12}));

13var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {

14 Object.defineProperty(o, "default"

scripts/postinstall.jsView file

Lines 59-99javascript

59 */

60function validateConfiguration() {

61 const homedir = getCcsHome();

62 const errors = [];

63

dist/utils/claude-symlink-manager.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. var __createbinding = (this && this.__createbinding) || (object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = object.getownpropertydescriptor(m, k); if (!desc || ("get" in desc ? !m.__esmodule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } object.defineproperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setmoduledefault = (this && this.__setmoduledefault) || (object.create ? (function(o, v) { object.defineproperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/utils/claude-symlink-manager.jsView on unpkg

scripts/get-version.shView file

•path = scripts/get-version.sh kind = build_helper sizeBytes = 323 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/get-version.shView on unpkg

dist/auth/commands/create-command.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/auth/commands/create-command.js#virtual:normalized:round1View on unpkg

dist/commands/bar/launch-subcommand.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kaitranntt/ccs@8.9.0 matchedIdentity = npm:QGthaXRyYW5udHQvY2Nz:8.9.0 similarity = 0.467 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/bar/launch-subcommand.jsView on unpkg