Loading npm security reports…

@lizard-build/lizard-studio-host@1.0.34: Suspicious npm security | LPM Firewall

registry / @lizard-build/lizard-studio-host / 1.0.34

@lizard-build/lizard-studio-host@1.0.34

Local host installer for Claude Code and ChatGPT in the Lizard Studio browser extension.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The installed native host refreshes a mutable vendor skill at startup and supplies it to each Claude session. The same host can replace its runtime modules after a side-panel self-update request.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user installs and opens the Lizard Studio browser host; later Claude session starts or panel selfUpdate messages activate the behavior.

Impact

A vendor-controlled remote skill can alter agent instructions and prompt global CLI installation; a later registry release can replace the browser-launched host.

Mechanism

Remote skill injection into Claude sessions and registry-driven runtime replacement.

AI rationale

No automatic install hook or confirmed credential theft is present, so a block is not warranted. Automatic mutable skill injection and remote runtime replacement create a concrete, vendor-controlled agent-extension lifecycle risk.

Evidence

src/host/claude-host.mjssrc/host/skills/lizard/SKILL.md~/.lizard-studio/host/skills/lizard/SKILL.md~/.lizard-studio/host/skills/lizard/README.md~/.lizard-studio/host/skills/lizard/skills.sh.json~/.lizard-studio/host/claude-host.mjs~/.lizard-studio/host/mcp-browser.mjs~/.lizard-studio/host/router.mjs~/.lizard-studio/host/hostkit.mjs

Source & flagged code

7 flagged · loading source

src/host/router.mjsView file

35L36: import { spawn } from "node:child_process"; L37: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L35

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/router.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/router.mjsView on unpkg

src/host/claude-host.mjsView file

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over L6: // this process's stdin/stdout. We spawn `claude` in headless stream-json mode L7: // (`claude -p --input-format stream-json --output-format stream-json`), keep it ... L46: // instead) (→ openPath reply) L47: // { type:"stashFile", id, reqId, name, data } write an attached file (base64) to a L48: // temp dir so claude can Read it by path ... L98: L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto"; ... L107: import { PassThrough } from "node:stream"; L108: import net from "node:n

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

•matchType = previous_version_dangerous_delta matchedPackage = @lizard-build/lizard-studio-host@1.0.32 matchedIdentity = npm:[redacted]:1.0.32 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/claude-host.mjsView on unpkg

587// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through L588: // cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own L589: // cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L587

src/host/codex-spawn.mjsView file

3// shim, token and job labels so the two hosts cannot replace each other's state. L4: import { spawn, execFile } from "node:child_process"; L5: import { EventEmitter } from "node:events"; ... L9: import { join } from "node:path"; L10: import net from "node:net"; L11: ... L26: L27: // launchctl submit restarts jobs that exit nonzero — always leave with 0. L28: const bail = () => process.exit(0); ... L35: sock.setNoDelay(true); L36: sock.write(JSON.stringify({ token: token, spawnId: spawnId, chan: chan }) + "\\n", () => cb(sock)); L37: });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/host/codex-spawn.mjsView on unpkg · L3

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Source & flagged code

7 flagged

src/host/router.mjsView file

Lines 15-55javascript

15//

16// The one rule that keeps the working path safe: THIS FILE NEVER PARSES WHAT A

17// CHILD SENDS. Messages from a host to the panel are forwarded as the exact

18// bytes the child produced. Only the Chrome->host direction is inspected, and

19// only far enough to pick a child — the original bytes are what gets forwarded

20// there too. A bug here can drop or misroute a message; it can never corrupt

21// one.

22//

23// Routing, in order:

24// 1. `browserResult` — by bid range (see CODEX_BID_BASE below)

25// 2. an explicit `agent` field on the message

26// 3. the agent remembered for that chat id (set by `start` / `prewarm`)

27// 4. claude — the default, so a panel that knows nothing about any of this

28// behaves exactly as it did before

29//

30// Protocol additions the panel may use (every one is optional; a panel that

31// never sends them gets today's behaviour):

32// panel -> router: { type:"prewarm", agent, id? } spin a host up early

33// panel -> any: { ..., agent } pick the host explicitly

34// router -> panel: { type:"agentExit", agent, code } a non-claude host died

35

36import { spawn } from "node:child_process";

37import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L35

38import { join } from "node:path";

39import { HOST_DIR, makeLog, frameReader, frameRaw, writeFrame } from "./hostkit.mjs";

40

41const log = makeLog("router");

42

43// Bumped on every router change the panel needs to know about. Reported inside

44// the `agentReady` message each non-claude host sends; claude's own `ready`

45// (and the HOST_VERSION in it) passes through untouched.

46const ROUTER_VERSION = 1;

47

48// The browser bridge correlates requests by `bid`, and each host numbers its

49// own from scratch. Rather than rewrite ids in flight — which would mean

50// parsing and re-serializing every message — the hosts are given disjoint

51// ranges: claude counts up from 1, codex counts up from this base. Routing a

52// `browserResult` is then a comparison, and the router still never touches a

53// byte of what a child wrote. Keep in step with codex-host.mjs.

54const CODEX_BID_BASE = 1_000_000_000;

55

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/router.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/router.mjsView on unpkg

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

src/host/codex-spawn.mjsView file

Lines 1-23javascript

1// Start Codex outside Chrome's inherited file quarantine on macOS.

2// The socket relay follows the Claude host's launchd path. It uses its own

3// shim, token and job labels so the two hosts cannot replace each other's state.

4import { spawn, execFile } from "node:child_process";

5import { EventEmitter } from "node:events";

6import { PassThrough } from

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Lines 567-607javascript

567 join(home, ".local/bin/claude"),

568 join(home, ".claude/local/claude"),

569 "/usr/bin/claude",

570 ]) {

571 if (existsSync(c)) return c;

572 }

573 return "claude";

574}

575const CLAUDE = resolveClaude();

576log("claude resolved to", CLAUDE, "exists=", existsSync(CLAUDE));

577

578// The node that runs this host also runs the MCP relay we hand to claude.

579const NODE = (CONFIG.nodePath && existsSync(CONFIG.nodePath)) ? CONFIG.nodePath : process.execPath;

580

581// How every claude spawn is actually invoked: `cmd` + `prefix` ++ our args.

582//

583// On Windows the global npm install exposes claude as claude.cmd, and Node

584// (≥18.20 / ≥20.12) throws `spawn EINVAL` when a .cmd/.bat is spawned without a

585// shell — the CVE-2024-27980 mitigation. That's the "Failed to start claude:

586// spawn EINVAL" users hit on Windows. Setting `shell:true` would route our

587// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through

588// cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own

589// cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L587

590// an .exe, spawned verbatim with the args array untouched. Non-Windows and the

591// standalone .exe installer are unaffected and spawn CLAUDE as-is.

592function winClaudeJs(cmdPath) {

593 // npm's shim embeds the entry path relative to the shim's own dir, e.g.

594 // "%dp0%\node_modules\@anthropic-ai\claude-code\cli.js" (modern npm)

595 // "%~dp0\node_modules\@anthropic-ai\claude-code\cli.js" (older npm)

596 try {

597 const m = readFileSync(cmdPath, "utf8").match(/%~?dp0%?\\?([^"\r\n]+\.js)/i);

598 if (m) {

599 const abs = join(dirname(cmdPath), m[1]);

600 if (existsSync(abs)) return abs;

601 }

602 } catch {

603 /* unreadable shim — fall through to the well-known layout */

604 }

605 const guess = join(dirname(cmdPath), "node_modules", "@anthropic-ai", "claude-code", "cli.js");

606 return existsSync(guess) ? guess : null;

607}