registry / @lizard-build/lizard-studio-host / 1.0.43

@lizard-build/lizard-studio-host@1.0.43

⚠ Under review

Local host installer for Claude Code and ChatGPT in the Lizard Studio browser extension.

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 303 KB of source, external domains: raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

5 flagged

src/host/codex-spawn.mjsView file

Lines 1-22javascript

1// Start local tools outside Chrome's inherited file quarantine on macOS.

2// Hosts and Codex use separate shims, tokens and launchd job labels.

3import { spawn, execFile } from "node:child_process";

4import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

src/host/codex-spawn.mjsView on unpkg · L2

5import { PassThrough } from "node:stream";

6import { randomBytes } from "node:crypto";

7import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync } from "node:fs";

8import { join } from "node:path";

9import net from "node:net";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/host/codex-spawn.mjsView on unpkg · L2

11const SHIM_SOURCE = `#!/usr/bin/env node

12// Generated by codex-spawn.mjs — do not edit. argv: <port> <tokenFile> <spawnId>

13import net from "node:net";

14import { spawn } from "node:child_process";

15import { readFileSync } from "node:fs";

17const port = Number(process.argv[2]);

18// The shared secret is read from a 0600 file, NOT passed on argv — argv is

19// visible in \`ps\` to other local users, and it authenticates receipt of the

20// child's full env (secrets included).

21const tokenFile = process.argv[3];

22const spawnId = process.argv[4];

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Source & flagged code

5 flagged · loading source

src/host/codex-spawn.mjsView file

@lizard-build/lizard-studio-host@1.0.43

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code