registry / @litfamily/litclaude / 1.0.11

@litfamily/litclaude@1.0.11

⚠ Under review

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 30 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 242 file(s), 2.14 MB of source, external domains: 127.0.0.1, anthropic.com, biomejs.dev, clangd.llvm.org, doi.org, duckduckgo.com, github.com, lit.stage, litclaude.invalid, registry.npmjs.org, www.w3.org

Source & flagged code

21 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/litclaude-ai.jsView file

1609case "motion-runtime": { L1610: const { main: motionRuntime } = await import(pathToFileURL(join(motionSkillScripts, "motion-runtime.mjs")).href); L1611: process.exit(await motionRuntime(parsed.rest));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/litclaude-ai.jsView on unpkg · L1609

plugins/litclaude/skills/lit-typographic-motion/engine/node/ws-server.mjsView file

1// Frame egress (MO-A-02 option 1): a minimal RFC 6455 WebSocket server on 127.0.0.1 with an L2: // OS-assigned port. The page sends each frame's metadata as a text message and its RGBA bytes as a ... L13: res.writeHead(426); L14: res.end("websocket only"); L15: }); ... L22: } L23: const accept = createHash("sha1").update(key + GUID).digest("base64"); L24: sock.write(`HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: ${accept}\r\n\r\n`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/litclaude/skills/lit-typographic-motion/engine/node/ws-server.mjsView on unpkg · L1

plugins/litclaude/lib/office_runtime_bootstrap.pyView file

•path = plugins/litclaude/lib/office_runtime_bootstrap.py kind = build_helper sizeBytes = 2650 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/litclaude/lib/office_runtime_bootstrap.pyView on unpkg

plugins/litclaude/skills/lit-docx/templates/docx/korean-generic.docxView file

•path = plugins/litclaude/skills/lit-docx/templates/docx/korean-generic.docx kind = high_entropy_blob sizeBytes = 37588 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

plugins/litclaude/skills/lit-docx/templates/docx/korean-generic.docxView on unpkg

•path = plugins/litclaude/skills/lit-docx/templates/docx/korean-generic.docx kind = compressed_blob sizeBytes = 37588 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

plugins/litclaude/skills/lit-docx/templates/docx/korean-generic.docxView on unpkg

•path = plugins/litclaude/skills/lit-docx/templates/docx/korean-generic.docx kind = nested_archive_needs_inspection sizeBytes = 37588 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

plugins/litclaude/skills/lit-docx/templates/docx/korean-generic.docxView on unpkg

plugins/litclaude/vendor/scientific-visualization/tests/test_figure_export.pyView file

•path = [redacted]-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/litclaude/vendor/scientific-visualization/tests/test_figure_export.pyView on unpkg

plugins/litclaude/lib/motion-render-gate.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

plugins/litclaude/lib/motion-render-gate.mjs#virtual:normalized:round1View on unpkg

plugins/litclaude/lib/automatic-update.mjsView file

•matchType = normalized_sha256 matchedPackage = @litfamily/litclaude@1.0.0 matchedPath = plugins/litclaude/lib/automatic-update.mjs matchedIdentity = npm:QGxpdGZhbWlseS9saXRjbGF1ZGU:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High