@lizard-build/lizard-studio-host@1.0.25: Suspicious npm security | LPM Firewall

Loading npm security reports…

@lizard-build/lizard-studio-host@1.0.25: Suspicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

src/host/claude-host.mjsView file

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over L6: // this process's stdin/stdout. We spawn `claude` in headless stream-json mode L7: // (`claude -p --input-format stream-json --output-format stream-json`), keep it ... L46: // instead) (→ openPath reply) L47: // { type:"stashFile", id, reqId, name, data } write an attached file (base64) to a L48: // temp dir so claude can Read it by path ... L98: L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto"; ... L107: import { PassThrough } from "node:stream"; L108: import net from "node:n

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

98L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

src/host/claude-host.mjsView on unpkg · L98

577// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through L578: // cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own L579: // cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L577

234const SKILL_DIR = join(HERE, "skills", "lizard"); const SKILL_MARKER = join(SKILL_DIR, "SKILL.md"); const SKILL_FILES = ["SKILL.md", "README.md", "sk[redacted]"]; const SKILL_RAW_BASE = "https://raw.githubusercontent.com/lizard-build/skill/main"; const SKILL_REFRESH_TTL_MS = 12 * 60 * 60 * 1000;

Medium

Ai Review Evidence

On host startup, it fetches mutable GitHub main-branch skill files and replaces local files that are passed to Claude as a plugin.

src/host/claude-host.mjsView on unpkg · L234

358async function selfUpdate(id) { try { // Resolve the newest published version and its immutable content hash. const meta = await fetchJson(`${HOST_REGISTRY}/${HOST_PKG}/latest`); const dist = meta && meta.dist; if (!dist || !dist.tarball || !dist.integrity) { throw new Error("registry metadata missing dist.tarball/integrity"); } const tgz = await fetchBuffer(dist.tarball); // dist.integrity is "<algo>-<base64>". Verify the bytes match the registry's // hash before trusting any

Medium

Ai Review Evidence

A browser-panel message can download the latest package tarball, replace host modules, and restart the native host.

src/host/claude-host.mjsView on unpkg · L358

2561const USER_CLAUDE_DIR = join(homedir(), ".claude"); function configResolve(key, scope, cwd) { const proj = scope === "project"; if (proj && !(cwd && existsSync(cwd))) return null; // no project dir to write into switch (key) { case "claudemd": return { path: proj ? join(cwd, "CLAUDE.md") : join(USER_CLAUDE_DIR, "CLAUDE.md"), kind: "text" }; case "hooks": return { path: proj ? join(cwd, ".claude", "settings.json") : join(USER_CLAUDE_DIR, "settings.json"), kind: "json", subkey: "hooks" }; case "mcp": return { path: proj ? join(cwd, ".mcp.json") : join(homedir

Medium

Ai Review Evidence

It can write Claude configuration, hooks, MCP, and plugin settings in a selected project or user directory.

src/host/claude-host.mjsView on unpkg · L2561

Source & flagged code

6 flagged

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

9// (including the incremental `stream_event` objects from --include-partial-messages).

10//

11// 100% local: no network of our own, no deps. `claude` does the real work in the

12// chosen working directory — real tools, real edits, real shell.

13//

14// Every message carries an `id` naming the chat tab it belongs to, so the host

15// can run one independent `claude` process per tab and the panel can route each

16// stream back to the right conversation.

17//

18// Protocol — panel -> host:

19// { type:"start", id, cwd, model?, effort?, permissionMode?, resume? } spawn (or respawn) claude

20// { type:"prompt", id, text, images? } send one user turn (images: [{mediaType,data}])

21// { type:"interrupt", id } hard-stop: kill + resume the session

22// { type:"killShell", id, taskId, shellId?, command?, kill just one background shell / dev

23// outputFile?, port? } server's process subtree (→ shellKilled)

24// { type:"probeShellPort", id, taskId, command } ask what TCP port a dev server listens

25// on (→ shellPort)

Lines 78-118javascript

78// { type:"exit", id, code }

79// { type:"folder", id, path } null path == cancelled

80// { type:"fileStashed", id, reqId, ok, name, path?, error? } reply to stashFile

81// { type:"openPath", id, path, ok, error? } reply to openPath

82// { type:"gitBranches", id, cwd, isRepo, current, branches, checkedOut? }

83// { type:"gitDiff", id, cwd, isRepo, files, insertions, deletions }

84// { type:"configRead", id, key, scope, ok, content?, path?, exists?, error? }

85// { type:"configWrite", id, key, scope, ok, path?, error? }

86// files: [{ path, status: "added"|"modified"|"deleted", binary, insertions, deletions, diff }]

87// `diff` is the unified-diff body (from the first `@@` hunk marker on) with

Lines 214-254javascript

214// works with no live claude), and never signal a subtree that reaches a

215// protected pid. New probeShells op reports which shells are still alive

216// so the panel's drawer converges to ground truth.

217// v23: stashFile — binary attachments (PDFs, Office docs) are written to a temp

218// dir and read back by path, since the panel can only carry text and

219// images. That dir is on every session's --add-dir list.

220// v24: openPath — file paths in the transcript are clickable; the click asks the

221// host to hand the path to the platform opener.

222const HOST_VERSION = 24

Lines 338-378javascript

338 const want = new Set(wanted);

339 const out = {};

340 let off = 0;

341 while (off +

Lines 557-597javascript

557 join(home, ".local/bin/claude"),

558 join(home, ".claude/local/claude"),

559 "/usr/bin/claude",

560 ]) {

561 if (existsSync(c)) return c;

562 }

563

Lines 2541-2581javascript

2541 // resent turn — `interrupted` would endTurn() that brand-new turn.

2542 startClaude({ id, cwd, model, effort, permissionMode: mode, resume });

2543 sendPrompt(id, text, images);

2544 };

2545

2546 if (child && child.exitCode == null && child.signalCode == null