@lizard-build/lizard-studio-host@1.0.42: Suspicious npm security | LPM Firewall

Loading npm security reports…

@lizard-build/lizard-studio-host@1.0.42: Suspicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

src/host/codex-spawn.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lizard-build/lizard-studio-host@1.0.41 matchedIdentity = npm:[redacted]:1.0.41 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/codex-spawn.mjsView on unpkg

2// Hosts and Codex use separate shims, tokens and launchd job labels. L3: import { spawn, execFile } from "node:child_process"; L4: import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

src/host/codex-spawn.mjsView on unpkg · L2

2// Hosts and Codex use separate shims, tokens and launchd job labels. L3: import { spawn, execFile } from "node:child_process"; L4: import { EventEmitter } from "node:events"; ... L8: import { join } from "node:path"; L9: import net from "node:net"; L10: ... L25: L26: // launchctl submit restarts jobs that exit nonzero — always leave with 0. L27: const bail = () => process.exit(0); ... L34: sock.setNoDelay(true); L35: sock.write(JSON.stringify({ token: token, spawnId: spawnId, chan: chan }) + "\\n", () => cb(sock)); L36: });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/host/codex-spawn.mjsView on unpkg · L2

src/host/claude-host.mjsView file

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over L6: // this process's stdin/stdout. We spawn `claude` in headless stream-json mode L7: // (`claude -p --input-format stream-json --output-format stream-json`), keep it ... L46: // instead) (→ openPath reply) L47: // { type:"stashFile", id, reqId, name, data } write an attached file (base64) to a L48: // temp dir so claude can Read it by path ... L98: L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto"; ... L107: import { PassThrough } from "node:stream"; L108: import net from "node:n

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

597// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through L598: // cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own L599: // cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L597

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Source & flagged code

6 flagged

src/host/codex-spawn.mjsView file

Lines 1-22javascript

1// Start local tools outside Chrome's inherited file quarantine on macOS.

2// Hosts and Codex use separate shims, tokens and launchd job labels.

3import { spawn, execFile } from "node:child_process";

4import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

src/host/codex-spawn.mjsView on unpkg · L2

5import { PassThrough } from "node:stream";

6import { randomBytes } from "node:crypto";

7import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync } from "node:fs";

8import { join } from "node:path";

9import net from "node:net";

10

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/host/codex-spawn.mjsView on unpkg · L2

11const SHIM_SOURCE = `#!/usr/bin/env node

12// Generated by codex-spawn.mjs — do not edit. argv: <port> <tokenFile> <spawnId>

13import net from "node:net";

14import { spawn } from "node:child_process";

15import { readFileSync } from "node:fs";

16

17const port = Number(process.argv[2]);

18// The shared secret is read from a 0600 file, NOT passed on argv — argv is

19// visible in \`ps\` to other local users, and it authenticates receipt of the

20// child's full env (secrets included).

21const tokenFile = process.argv[3];

22const spawnId = process.argv[4];

•matchType = previous_version_dangerous_delta matchedPackage = @lizard-build/lizard-studio-host@1.0.41 matchedIdentity = npm:[redacted]:1.0.41 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/codex-spawn.mjsView on unpkg

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Lines 577-617javascript

577 join(home, ".local/bin/claude"),

578 join(home, ".claude/local/claude"),

579 "/usr/bin/claude",

580 ]) {

581 if (existsSync(c)) return c;

582 }

583 return "claude";

584}

585const CLAUDE = resolveClaude();

586log("claude resolved to", CLAUDE, "exists=", existsSync(CLAUDE));

587

588// The node that runs this host also runs the MCP relay we hand to claude.

589const NODE = (CONFIG.nodePath && existsSync(CONFIG.nodePath)) ? CONFIG.nodePath : process.execPath;

590

591// How every claude spawn is actually invoked: `cmd` + `prefix` ++ our args.

592//

593// On Windows the global npm install exposes claude as claude.cmd, and Node

594// (≥18.20 / ≥20.12) throws `spawn EINVAL` when a .cmd/.bat is spawned without a

595// shell — the CVE-2024-27980 mitigation. That's the "Failed to start claude:

596// spawn EINVAL" users hit on Windows. Setting `shell:true` would route our

597// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through

598// cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own

599// cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L597

600// an .exe, spawned verbatim with the args array untouched. Non-Windows and the

601// standalone .exe installer are unaffected and spawn CLAUDE as-is.

602function winClaudeJs(cmdPath) {

603 // npm's shim embeds the entry path relative to the shim's own dir, e.g.

604 // "%dp0%\node_modules\@anthropic-ai\claude-code\cli.js" (modern npm)

605 // "%~dp0\node_modules\@anthropic-ai\claude-code\cli.js" (older npm)

606 try {

607 const m = readFileSync(cmdPath, "utf8").match(/%~?dp0%?\\?([^"\r\n]+\.js)/i);

608 if (m) {

609 const abs = join(dirname(cmdPath), m[1]);

610 if (existsSync(abs)) return abs;

611 }

612 } catch {

613 /* unreadable shim — fall through to the well-known layout */

614 }

615 const guess = join(dirname(cmdPath), "node_modules", "@anthropic-ai", "claude-code", "cli.js");

616 return existsSync(guess) ? guess : null;

617}