Loading npm security reports…

@lizard-build/lizard-studio-host@1.0.31: Suspicious npm security | LPM Firewall

registry / @lizard-build/lizard-studio-host / 1.0.31

@lizard-build/lizard-studio-host@1.0.31

Native-messaging host installer that lets the Lizard Studio browser extension drive the local Claude Code and Codex CLIs.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. When the browser native host starts, it can replace its bundled agent skill from GitHub and expose it to Claude and Codex. The skill can cause an agent handling a deployment request to install and run a separate global CLI.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Launching the installed browser native host, then using a Claude or Codex session with the bundled skill.

Impact

Unreviewed remote instructions can gain agent command execution and install another npm package; a panel update request can also replace host code.

Mechanism

Remote skill refresh and agent-extension registration

AI rationale

This is a first-party agent-extension setup with automatic remote skill replacement and broad capability escalation, not a proven autonomous install-time malware chain. Its absence of npm lifecycle hooks and origin-locked native manifest lower the risk below a publish-block threshold.

Evidence

src/host/claude-host.mjssrc/host/codex-host.mjssrc/host/skills/lizard/SKILL.md~/.lizard-studio/host/skills/lizard/SKILL.md~/.lizard-studio/host/skills/lizard/README.md~/.lizard-studio/host/skills/lizard/skills.sh.json~/.lizard-studio/host/claude-host.mjs~/.lizard-studio/host/mcp-browser.mjs

Network endpoints2

Source & flagged code

7 flagged · loading source

src/host/router.mjsView file

35L36: import { spawn } from "node:child_process"; L37: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L35

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/router.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/router.mjsView on unpkg

src/host/claude-host.mjsView file

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over L6: // this process's stdin/stdout. We spawn `claude` in headless stream-json mode L7: // (`claude -p --input-format stream-json --output-format stream-json`), keep it ... L46: // instead) (→ openPath reply) L47: // { type:"stashFile", id, reqId, name, data } write an attached file (base64) to a L48: // temp dir so claude can Read it by path ... L98: L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto"; ... L107: import { PassThrough } from "node:stream"; L108: import net from "node:n

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

584// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through L585: // cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own L586: // cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L584

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/claude-host.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/claude-host.mjsView on unpkg

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

src/host/codex-host.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lizard-build/lizard-studio-host@1.0.26 matchedIdentity = npm:[redacted]:1.0.26 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/codex-host.mjsView on unpkg

Source & flagged code

7 flagged

src/host/router.mjsView file

Lines 15-55javascript

15//

16// The one rule that keeps the working path safe: THIS FILE NEVER PARSES WHAT A

17// CHILD SENDS. Messages from a host to the panel are forwarded as the exact

18// bytes the child produced. Only the Chrome->host direction is inspected, and

19// only far enough to pick a child — the original bytes are what gets forwarded

20// there too. A bug here can drop or misroute a message; it can never corrupt

21// one.

22//

23// Routing, in order:

24// 1. `browserResult` — by bid range (see CODEX_BID_BASE below)

25// 2. an explicit `agent` field on the message

26// 3. the agent remembered for that chat id (set by `start` / `prewarm`)

27// 4. claude — the default, so a panel that knows nothing about any of this

28// behaves exactly as it did before

29//

30// Protocol additions the panel may use (every one is optional; a panel that

31// never sends them gets today's behaviour):

32// panel -> router: { type:"prewarm", agent, id? } spin a host up early

33// panel -> any: { ..., agent } pick the host explicitly

34// router -> panel: { type:"agentExit", agent, code } a non-claude host died

35

36import { spawn } from "node:child_process";

37import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L35

38import { join } from "node:path";

39import { HOST_DIR, makeLog, frameReader, frameRaw, writeFrame } from "./hostkit.mjs";

40

41const log = makeLog("router");

42

43// Bumped on every router change the panel needs to know about. Reported inside

44// the `agentReady` message each non-claude host sends; claude's own `ready`

45// (and the HOST_VERSION in it) passes through untouched.

46const ROUTER_VERSION = 1;

47

48// The browser bridge correlates requests by `bid`, and each host numbers its

49// own from scratch. Rather than rewrite ids in flight — which would mean

50// parsing and re-serializing every message — the hosts are given disjoint

51// ranges: claude counts up from 1, codex counts up from this base. Routing a

52// `browserResult` is then a comparison, and the router still never touches a

53// byte of what a child wrote. Keep in step with codex-host.mjs.

54const CODEX_BID_BASE = 1_000_000_000;

55

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/router.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/router.mjsView on unpkg

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

src/host/codex-host.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lizard-build/lizard-studio-host@1.0.26 matchedIdentity = npm:[redacted]:1.0.26 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/codex-host.mjsView on unpkg

Lines 564-604javascript

564 join(home, ".local/bin/claude"),

565 join(home, ".claude/local/claude"),

566 "/usr/bin/claude",

567 ]) {

568 if (existsSync(c)) return c;

569 }

570 return "claude";

571}

572const CLAUDE = resolveClaude();

573log("claude resolved to", CLAUDE, "exists=", existsSync(CLAUDE));

574

575// The node that runs this host also runs the MCP relay we hand to claude.

576const NODE = (CONFIG.nodePath && existsSync(CONFIG.nodePath)) ? CONFIG.nodePath : process.execPath;

577

578// How every claude spawn is actually invoked: `cmd` + `prefix` ++ our args.

579//

580// On Windows the global npm install exposes claude as claude.cmd, and Node

581// (≥18.20 / ≥20.12) throws `spawn EINVAL` when a .cmd/.bat is spawned without a

582// shell — the CVE-2024-27980 mitigation. That's the "Failed to start claude:

583// spawn EINVAL" users hit on Windows. Setting `shell:true` would route our

584// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through

585// cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own

586// cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L584

587// an .exe, spawned verbatim with the args array untouched. Non-Windows and the

588// standalone .exe installer are unaffected and spawn CLAUDE as-is.

589function winClaudeJs(cmdPath) {

590 // npm's shim embeds the entry path relative to the shim's own dir, e.g.

591 // "%dp0%\node_modules\@anthropic-ai\claude-code\cli.js" (modern npm)

592 // "%~dp0\node_modules\@anthropic-ai\claude-code\cli.js" (older npm)

593 try {

594 const m = readFileSync(cmdPath, "utf8").match(/%~?dp0%?\\?([^"\r\n]+\.js)/i);

595 if (m) {

596 const abs = join(dirname(cmdPath), m[1]);

597 if (existsSync(abs)) return abs;

598 }

599 } catch {

600 /* unreadable shim — fall through to the well-known layout */

601 }

602 const guess = join(dirname(cmdPath), "node_modules", "@anthropic-ai", "claude-code", "cli.js");

603 return existsSync(guess) ? guess : null;

604}