@lizard-build/lizard-studio-host@1.0.26: Suspicious npm security | LPM Firewall

Loading npm security reports…

@lizard-build/lizard-studio-host@1.0.26: Suspicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

src/host/router.mjsView file

35L36: import { spawn } from "node:child_process"; L37: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L35

src/host/claude-host.mjsView file

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over L6: // this process's stdin/stdout. We spawn `claude` in headless stream-json mode L7: // (`claude -p --input-format stream-json --output-format stream-json`), keep it ... L46: // instead) (→ openPath reply) L47: // { type:"stashFile", id, reqId, name, data } write an attached file (base64) to a L48: // temp dir so claude can Read it by path ... L98: L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto"; ... L107: import { PassThrough } from "node:stream"; L108: import net from "node:n

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

584// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through L585: // cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own L586: // cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L584

234const SKILL_DIR = join(HERE, "skills", "lizard"); const SKILL_MARKER = join(SKILL_DIR, "SKILL.md"); const SKILL_FILES = ["SKILL.md", "README.md", "sk[redacted]"]; const SKILL_RAW_BASE = "https://raw.githubusercontent.com/lizard-build/skill/main";

Medium

Ai Review Evidence

At host startup, it fetches mutable skill files from raw.githubusercontent.com, writes them into its runtime directory, and passes that directory to Claude as a plugin.

src/host/claude-host.mjsView on unpkg · L234

297mkdirSync(SKILL_DIR, { recursive: true }); for (const name of SKILL_FILES) { const text = await fetchText(`${SKILL_RAW_BASE}/${name}`); const tmp = join(SKILL_DIR, name + ".tmp"); writeFileSync(tmp, text, "utf8"); renameSync(tmp, join(SKILL_DIR, name)); // atomic swap — never leaves a half-written file }

Medium

Ai Review Evidence

At host startup, it fetches mutable skill files from raw.githubusercontent.com, writes them into its runtime directory, and passes that directory to Claude as a plugin.

src/host/claude-host.mjsView on unpkg · L297

1252// Ship the lizard-build/skill bootstrap skill to this session (see the // refreshBundledSkill block above) — ephemeral, doesn't touch user config. if (existsSync(SKILL_MARKER)) args.push("--plugin-dir", SKILL_DIR);

Medium

Ai Review Evidence

At host startup, it fetches mutable skill files from raw.githubusercontent.com, writes them into its runtime directory, and passes that directory to Claude as a plugin.

src/host/claude-host.mjsView on unpkg · L1252

Source & flagged code

6 flagged

src/host/router.mjsView file

Lines 15-55javascript

15//

16// The one rule that keeps the working path safe: THIS FILE NEVER PARSES WHAT A

17// CHILD SENDS. Messages from a host to the panel are forwarded as the exact

18// bytes the child produced. Only the Chrome->host direction is inspected, and

19// only far enough to pick a child — the original bytes are what gets forwarded

20// there too. A bug here can drop or misroute a message; it can never corrupt

21// one.

22//

23// Routing, in order:

24// 1. `browserResult` — by bid range (see CODEX_BID_BASE below)

25// 2. an explicit `agent` field on the message

26// 3. the agent remembered for that chat id (set by `start` / `prewarm`)

27// 4. claude — the default, so a panel that knows nothing about any of this

28// behaves exactly as it did before

29//

30// Protocol additions the panel may use (every one is optional; a panel that

31// never sends them gets today's behaviour):

32// panel -> router: { type:"prewarm", agent, id? } spin a host up early

33// panel -> any: { ..., agent } pick the host explicitly

34// router -> panel: { type:"agentExit", agent, code } a non-claude host died

35

36import { spawn } from "node:child_process";

37import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L35

38import { join } from "node:path";

39import { HOST_DIR, makeLog, frameReader, frameRaw, writeFrame } from "./hostkit.mjs";

40

41const log = makeLog("router");

42

43// Bumped on every router change the panel needs to know about. Reported inside

44// the `agentReady` message each non-claude host sends; claude's own `ready`

45// (and the HOST_VERSION in it) passes through untouched.

46const ROUTER_VERSION = 1;

47

48// The browser bridge correlates requests by `bid`, and each host numbers its

49// own from scratch. Rather than rewrite ids in flight — which would mean

50// parsing and re-serializing every message — the hosts are given disjoint

51// ranges: claude counts up from 1, codex counts up from this base. Routing a

52// `browserResult` is then a comparison, and the router still never touches a

53// byte of what a child wrote. Keep in step with codex-host.mjs.

54const CODEX_BID_BASE = 1_000_000_000;

55

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

Lines 214-254javascript

214// works with no live claude), and never signal a subtree that reaches a

215// protected pid. New probeShells op reports which shells are still alive

216// so the panel's drawer converges to ground truth.

217// v23: stashFile — binary attachments (PDFs, Office docs) are written to a temp

218// dir and read back by path, since the panel can only carry text and

219// images. That dir is on every session's --add-dir list.

220// v24: openPath — file paths in the transcript are clickable; the click asks the

221// host to hand the path to the platform opener.

222const HOST_VERSION = 24;

223

224log("=== host starting ===", "node", process.version, "argv", JSON.stringify(process.argv.slice(2)));

225

226// ---- bundled "lizard" skill ---------------------------------------------------

227// Ships the lizard-build/skill bootstrap skill to every spawned claude via

228// --plugin-dir — ephemeral, per-process, never touches the user's own

229// ~/.claude/skills. install.sh seeds this dir with a copy at install time (so it

230// works offline / on first run); in the background we refresh it straight from

231// GitHub so users get upstream updates without reinstalling the host. Fetches

232// are throttled and never block a claude spawn — spawning always uses whatever

233// is on disk right now.

234const SKILL_DIR = join(HERE, "skills", "lizard");

235const SKILL_MARKER = join(SKILL_DIR, "SKILL.md");

236const SKILL_FILES = ["SKILL.md", "README.md", "skills.sh.json"];

237const SKILL_RAW_BASE = "https://raw.githubusercontent.com/lizard-build/skill/main";

Medium

Ai Review Evidence

At host startup, it fetches mutable skill files from raw.githubusercontent.com, writes them into its runtime directory, and passes that directory to Claude as a plugin.

src/host/claude-host.mjsView on unpkg · L234

238const SKILL_REFRESH_TTL_MS = 12 * 60 * 60 * 1000; // 12h — upstream is a thin, rarely-changing bootstrap

239

240function fetchText(url, redirects = 1) {

241 return new Promise((resolve, reject) => {

242 const req = https.get(url, { headers: { "User-Agent": "lizard-studio-host" }, timeout: 10000 }, (res) => {

243 // Follow a single redirect — raw.githubusercontent can 301 and a silent

244 // failure here would break self-update with no signal to the panel.

245 if (res.statusCode >= 301 && res.statusCode <= 308 && res.headers.location && redirects > 0) {

246 res.resume();

247 return resolve(fetchText(new URL(res.headers.location, url).href, redirects - 1));

248 }

249 if (res.statusCode !== 200) {

250 res.resume();

251 return reject(new Error("HTTP " + res.statusCode + " for " + url));

252 }

253 let body = "";

254 res.setEncoding("utf8");

Lines 277-317javascript

277 return reject(new Error("HTTP " + res.statusCode + " for " + url));

278 }

279 const chunks = [];

280 res.on("data", (c) => chunks.push(c));

281 res.on("end", () => resolve(Buffer.concat(chunks)));

282 });

283 req.on("timeout", () => req.destroy(new Error("timeout fetching " + url)));

284 req.on("error", reject);

285 });

286}

287

288async function fetchJson(url) {

289 return JSON.parse((await fetchBuffer(url)).toString("utf8"));

290}

291

292async function refreshBundledSkill() {

293 try {

294 if (existsSync(SKILL_MARKER) && Date.now() - statSync(SKILL_MARKER).mtimeMs < SKILL_REFRESH_TTL_MS) {

295 return; // refreshed recently enough — skip the network round-trip

296 }

297 mkdirSync(SKILL_DIR, { recursive: true });

298 for (const name of SKILL_FILES) {

299 const text = await fetchText(`${SKILL_RAW_BASE}/${name}`);

300 const tmp = join(SKILL_DIR, name + ".tmp");

301 writeFileSync(tmp, text, "utf8");

302 renameSync(tmp, join(SKILL_DIR, name)); // atomic swap — never leaves a half-written file

303 }

Medium

Ai Review Evidence

At host startup, it fetches mutable skill files from raw.githubusercontent.com, writes them into its runtime directory, and passes that directory to Claude as a plugin.

src/host/claude-host.mjsView on unpkg · L297

304 log("skill: refreshed lizard-build/skill from upstream");

305 } catch (err) {

306 // Offline, GitHub unreachable, rate-limited, etc. — keep whatever's already

307 // on disk (the bundled fallback from install.sh, or the last good fetch).

308 log("skill: refresh skipped —", err && err.message);

309 }

310}

311// Fire-and-forget at startup; every claude spawn below just reads SKILL_DIR

312// synchronously off disk, so this never adds latency to a chat turn.

313refreshBundledSkill();

314

315// ---- host self-update -------------------------------------------------------

316// The extension updates via git/store, but this runtime copy only via

317// install.sh — so when the panel sees a stale HOST_VERSION it sends

Lines 564-604javascript

564 join(home, ".local/bin/claude"),

565 join(home, ".claude/local/claude"),

566 "/usr/bin/claude",

567 ]) {

568 if (existsSync(c)) return c;

569 }

570 return "claude";

571}

572const CLAUDE = resolveClaude();

573log("claude resolved to", CLAUDE, "exists=", existsSync(CLAUDE));

574

575// The node that runs this host also runs the MCP relay we hand to claude.

576const NODE = (CONFIG.nodePath && existsSync(CONFIG.nodePath)) ? CONFIG.nodePath : process.execPath;

577

578// How every claude spawn is actually invoked: `cmd` + `prefix` ++ our args.

579//

580// On Windows the global npm install exposes claude as claude.cmd, and Node

581// (≥18.20 / ≥20.12) throws `spawn EINVAL` when a .cmd/.bat is spawned without a

582// shell — the CVE-2024-27980 mitigation. That's the "Failed to start claude:

583// spawn EINVAL" users hit on Windows. Setting `shell:true` would route our

584// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through

585// cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own

586// cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L584

587// an .exe, spawned verbatim with the args array untouched. Non-Windows and the

588// standalone .exe installer are unaffected and spawn CLAUDE as-is.

589function winClaudeJs(cmdPath) {

590 // npm's shim embeds the entry path relative to the shim's own dir, e.g.

591 // "%dp0%\node_modules\@anthropic-ai\claude-code\cli.js" (modern npm)

592 // "%~dp0\node_modules\@anthropic-ai\claude-code\cli.js" (older npm)

593 try {

594 const m = readFileSync(cmdPath, "utf8").match(/%~?dp0%?\\?([^"\r\n]+\.js)/i);

595 if (m) {

596 const abs = join(dirname(cmdPath), m[1]);

597 if (existsSync(abs)) return abs;

598 }

599 } catch {

600 /* unreadable shim — fall through to the well-known layout */

601 }

602 const guess = join(dirname(cmdPath), "node_modules", "@anthropic-ai", "claude-code", "cli.js");

603 return existsSync(guess) ? guess : null;

604}

Lines 1232-1272javascript

1232 // high/xhigh/max there) — it's xhigh reasoning plus the dynamic-workflow

1233 // setting, so we split it into the two flags the CLI actually understands.

1234 if (s.effort === "ultracode") {

1235 args.push("--effort", "xhigh", "--settings", JSON.stringify({ ultracode: true }));

1236 } else if (s.effort) {

1237 args.push("--effort", s.effort);

1238 }

1239 if (resume) args.push("--resume", resume);

1240

1241 // Let claude read the attachment stash (see the attached-files section). The

1242 // files there are ones the user picked by hand in the panel, so an

1243 // out-of-workspace permission ask for them would be noise. Nothing else is

1244 // ever written to that dir.

1245 try {

1246 mkdirSync(ATTACH_DIR, { recursive: true, mode: 0o700 });

1247 args.push("--add-dir", ATTACH_DIR);

1248 } catch {

1249 /* no temp dir — attachments will fail loudly on their own, don't block the spawn */

1250 }

1251

1252 // Ship the lizard-build/skill bootstrap skill to this session (see the

1253 // refreshBundledSkill block above) — ephemeral, doesn't touch user config.

1254 if (existsSync(SKILL_MARKER)) args.push("--plugin-dir", SKILL_DIR);

Medium

Ai Review Evidence

At host startup, it fetches mutable skill files from raw.githubusercontent.com, writes them into its runtime directory, and passes that directory to Claude as a plugin.

src/host/claude-host.mjsView on unpkg · L1252

1255

1256 // Register the browser MCP server so claude can inspect the live tab. The

1257 // read-only tools are pre-allowed; browser_eval still goes through the normal

1258 // permission flow since it can run arbitrary JS.

1259 if (bridgePort && existsSync(MCP_RELAY)) {

1260 const mcp = JSON.stringify({

1261 mcpServers: {

1262 browser: { command: NODE, args: [MCP_RELAY], env: { RK_BRIDGE_PORT: String(bridgePort), RK_BRIDGE_TOKEN: BRIDGE_TOKEN, RK_BRIDGE_SESSION: id } },

1263 },

1264 });

1265 // Write the mcp-config to an owner-only (0600) file and pass its PATH rather

1266 // than the JSON inline: the bridge token rides in this config, and anything

1267 // on claude's argv is world-readable via `ps -ww` / /proc/<pid>/cmdline to

1268 // other local users — who could then drive the 127.0.0.1 bridge (incl.

1269 // browser_eval). Same reasoning as SPAWN_TOKEN_FILE. Cleaned up in killSession.

1270 const mcpConfigPath = join(HERE, ".mcp-config-" + id.replace(/[^A-Za-z0-9_.-]/g, "_") + ".json");

1271 writeFileSync(mcpConfigPath, mcp, { mode: 0o600 });

1272 chmodSync(mcpConfigPath, 0o600); // enforce owner-only regardless of umask