@lizard-build/lizard-studio-host@1.0.24: Suspicious npm security | LPM Firewall

Loading npm security reports…

@lizard-build/lizard-studio-host@1.0.24: Suspicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

src/host/claude-host.mjsView file

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over L6: // this process's stdin/stdout. We spawn `claude` in headless stream-json mode L7: // (`claude -p --input-format stream-json --output-format stream-json`), keep it ... L46: // instead) (→ openPath reply) L47: // { type:"stashFile", id, reqId, name, data } write an attached file (base64) to a L48: // temp dir so claude can Read it by path ... L98: L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto"; ... L107: import { PassThrough } from "node:stream"; L108: import net from "node:n

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

98L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

src/host/claude-host.mjsView on unpkg · L98

577// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through L578: // cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own L579: // cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L577

234const SKILL_DIR = join(HERE, "skills", "lizard"); const SKILL_MARKER = join(SKILL_DIR, "SKILL.md"); const SKILL_FILES = ["SKILL.md", "README.md", "sk[redacted]"]; const SKILL_RAW_BASE = "https://raw.githubusercontent.com/lizard-build/skill/main"; const SKILL_REFRESH_TTL_MS = 12 * 60 * 60 * 1000;

Medium

Ai Review Evidence

At host startup, it fetches mutable GitHub content and overwrites bundled agent skill files.

src/host/claude-host.mjsView on unpkg · L234

297mkdirSync(SKILL_DIR, { recursive: true }); for (const name of SKILL_FILES) { const text = await fetchText(`${SKILL_RAW_BASE}/${name}`); const tmp = join(SKILL_DIR, name + ".tmp"); writeFileSync(tmp, text, "utf8"); renameSync(tmp, join(SKILL_DIR, name));

Medium

Ai Review Evidence

At host startup, it fetches mutable GitHub content and overwrites bundled agent skill files.

src/host/claude-host.mjsView on unpkg · L297

1245// Ship the lizard-build/skill bootstrap skill to this session (see the // refreshBundledSkill block above) — ephemeral, doesn't touch user config. if (existsSync(SKILL_MARKER)) args.push("--plugin-dir", SKILL_DIR); // Register the browser MCP server so claude can inspect the live tab. The // read-only tools are pre-allowed; browser_eval still goes through the normal // permission flow since it can run arbitrary JS.

Medium

Ai Review Evidence

The fetched skill directory is passed to every spawned Claude session as a plugin.

src/host/claude-host.mjsView on unpkg · L1245

Source & flagged code

6 flagged

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

9// (including the incremental `stream_event` objects from --include-partial-messages).

10//

11// 100% local: no network of our own, no deps. `claude` does the real work in the

12// chosen working directory — real tools, real edits, real shell.

13//

14// Every message carries an `id` naming the chat tab it belongs to, so the host

15// can run one independent `claude` process per tab and the panel can route each

16// stream back to the right conversation.

17//

18// Protocol — panel -> host:

19// { type:"start", id, cwd, model?, effort?, permissionMode?, resume? } spawn (or respawn) claude

20// { type:"prompt", id, text, images? } send one user turn (images: [{mediaType,data}])

21// { type:"interrupt", id } hard-stop: kill + resume the session

22// { type:"killShell", id, taskId, shellId?, command?, kill just one background shell / dev

23// outputFile?, port? } server's process subtree (→ shellKilled)

24// { type:"probeShellPort", id, taskId, command } ask what TCP port a dev server listens

25// on (→ shellPort)

Lines 78-118javascript

78// { type:"exit", id, code }

79// { type:"folder", id, path } null path == cancelled

80// { type:"fileStashed", id, reqId, ok, name, path?, error? } reply to stashFile

81// { type:"openPath", id, path, ok, error? } reply to openPath

82// { type:"gitBranches", id, cwd, isRepo, current, branches, checkedOut? }

83// { type:"gitDiff", id, cwd, isRepo, files, insertions, deletions }

84// { type:"configRead", id, key, scope, ok, content?, path?, exists?, error? }

85// { type:"configWrite", id, key, scope, ok, path?, error? }

86// files: [{ path, status: "added"|"modified"|"deleted", binary, insertions, deletions, diff }]

87// `diff` is the unified-diff body (from the first `@@` hunk marker on) with

Lines 214-254javascript

214// works with no live claude), and never signal a subtree that reaches a

215// protected pid. New probeShells op reports which shells are still alive

216// so the panel's drawer converges to ground truth.

217// v23: stashFile — binary attachments (PDFs, Office docs) are written to a temp

218// dir and read back by path, since the panel can only carry text and

219// images. That dir is on every session's --add-dir list.

220// v24: openPath — file paths in the transcript are clickable; the click asks the

221// host to hand the path to the platform opener.

222const HOST_VERSION = 24

Lines 277-317javascript

277 return reject(new Error("HTTP " + res.statusCode + " for " + url));

278 }

279 const chunks = [];

280 res.

Lines 557-597javascript

557 join(home, ".local/bin/claude"),

558 join(home, ".claude/local/claude"),

559 "/usr/bin/claude",

560 ]) {

561 if (existsSync(c)) return c;

562 }

563

Lines 1225-1265javascript

1225 // high/xhigh/max there) — it's xhigh reasoning plus the dynamic-workflow

1226 // setting, so we split it into the two flags the CLI actually understands.

1227 if (s.effort === "ultracode") {

1228 args.push("--effort", "xhigh", "--settings", JSON.stringify({ ultracode: true }));