Loading npm security reports…

@lizard-build/lizard-studio-host@1.0.54: Suspicious npm security | LPM Firewall

registry / @lizard-build/lizard-studio-host / 1.0.54

@lizard-build/lizard-studio-host@1.0.54

Local host installer for Claude Code and ChatGPT in the Lizard Studio browser extension.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

No install-time or import-time attack was identified. Agent binary lookups, native-messaging routing, settings edits, shell commands, and the npm self-update all run only after the user launches the host or the origin-locked extension sends a message.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User runs the lizard-studio-host command, or Chrome starts the already installed native host for the Lizard Studio extension.

Impact

No unconsented credential theft, remote payload execution, or broad agent-control write occurs during npm install.

Mechanism

The installer registers a Chrome native-messaging host locked to the package extension ids. The hosts then resolve local claude and codex binaries and act on framed messages from that extension.

AI rationale

The package is a user-invoked native-messaging host for Lizard Studio, with no registry lifecycle script and no self-dependency. Claude and Codex path hits are local binary discovery, and later shell, settings, and update behavior is gated by that explicit host session and integrity checks.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Source & flagged code

7 flagged · loading source

src/host/router.mjsView file

36import { join } from "node:path"; L37: import { spawn } from "node:child_process"; L38: import net from "node:net";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L36

36import { join } from "node:path"; L37: import { spawn } from "node:child_process"; L38: import net from "node:net"; L39: import { HOST_DIR, makeLog, frameReader, frameRaw, writeFrame, redact } from "./hostkit.mjs"; ... L42: const log = makeLog("router"); L43: const daemonMode = process.env.LIZARD_STUDIO_ROUTER_DAEMON === "1"; L44: const bridgeMode = process.platform === "darwin" && !daemonMode;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/host/router.mjsView on unpkg · L36

src/host/claude-host.mjsView file

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over L6: // this process's stdin/stdout. We spawn `claude` in headless stream-json mode L7: // (`claude -p --input-format stream-json --output-format stream-json`), keep it ... L46: // instead) (→ openPath reply) L47: // { type:"stashFile", id, reqId, name, data } write an attached file (base64) to a L48: // temp dir so claude can Read it by path ... L98: L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto"; ... L107: import { PassThrough } from "node:stream"; L108: import net from "node:n

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

•matchType = previous_version_dangerous_delta matchedPackage = @lizard-build/lizard-studio-host@1.0.46 matchedIdentity = npm:[redacted]:1.0.46 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/host/claude-host.mjsView on unpkg

609// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through L610: // cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own L611: // cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L609

src/host/codex-spawn.mjsView file

2// Hosts and Codex use separate shims, tokens and launchd job labels. L3: import { spawn, execFile } from "node:child_process"; L4: import { EventEmitter } from "node:events"; ... L8: import { join } from "node:path"; L9: import net from "node:net"; L10: ... L25: L26: // launchctl submit restarts jobs that exit nonzero — always leave with 0. L27: const bail = () => process.exit(0); ... L34: sock.setNoDelay(true); L35: sock.write(JSON.stringify({ token: token, spawnId: spawnId, chan: chan }) + "\\n", () => cb(sock)); L36: });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/host/codex-spawn.mjsView on unpkg · L2

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Source & flagged code

7 flagged

src/host/router.mjsView file

Lines 16-56javascript

16//

17// Messages from a host to the panel are forwarded as the exact bytes the child

18// produced. The router reads small Claude ready messages to reset restart delay.

19// Only the Chrome->host direction is inspected for routing; its original bytes

20// are forwarded too.

21//

22// Routing, in order:

23// 1. `browserResult` — by bid range (see CODEX_BID_BASE below)

24// 2. an explicit `agent` field on the message

25// 3. the agent remembered for that chat id (set by `start` / `prewarm`)

26// 4. claude — the default, so a panel that knows nothing about any of this

27// behaves exactly as it did before

28//

29// Protocol additions the panel may use (every one is optional; a panel that

30// never sends them gets today's behaviour):

31// panel -> router: { type:"prewarm", agent, id? } spin a host up early

32// panel -> any: { ..., agent } pick the host explicitly

33// router -> panel: { type:"agentExit", agent, code } a host died

34

35import { existsSync, chmodSync, unlinkSync } from "node:fs";

36import { join } from "node:path";

37import { spawn } from "node:child_process";

38import net from "node:net";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L36

39import { HOST_DIR, makeLog, frameReader, frameRaw, writeFrame, redact } from "./hostkit.mjs";

40import { createHostSpawner } from "./codex-spawn.mjs";

41

42const log = makeLog("router");

43const daemonMode = process.env.LIZARD_STUDIO_ROUTER_DAEMON === "1";

44const bridgeMode = process.platform === "darwin" && !daemonMode;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/host/router.mjsView on unpkg · L36

45const hostSpawner = bridgeMode ? null : createHostSpawner({ hostDir: HOST_DIR, redact });

46

47// Bumped on every router change the panel needs to know about. Reported inside

48// the `agentReady` message each non-claude host sends; claude's own `ready`

49// (and the HOST_VERSION in it) passes through untouched.

50const ROUTER_VERSION = 2;

51

52// The browser bridge correlates requests by `bid`, and each host numbers its

53// own from scratch. Rather than rewrite ids in flight — which would mean

54// parsing and re-serializing every message — the hosts are given disjoint

55// ranges: claude counts up from 1, codex counts up from this base. Routing a

56// `browserResult` is then a comparison, and the router still never touches a

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

src/host/codex-spawn.mjsView file

Lines 1-22javascript

1// Start local tools outside Chrome's inherited file quarantine on macOS.

2// Hosts and Codex use separate shims, tokens and launchd job labels.

3import { spawn, execFile } from "node:child_process";

4import { EventEmitter } from "node:events";

5import { PassThrough } from "node:stream";

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Lines 589-629javascript

589 join(home, ".local/bin/claude"),

590 join(home, ".claude/local/claude"),

591 "/usr/bin/claude",

592 ]) {

593 if (existsSync(c)) return c;

594 }

595 return "claude";

596}

597const CLAUDE = resolveClaude();

598log("claude resolved to", CLAUDE, "exists=", existsSync(CLAUDE));

599

600// The node that runs this host also runs the MCP relay we hand to claude.

601const NODE = (CONFIG.nodePath && existsSync(CONFIG.nodePath)) ? CONFIG.nodePath : process.execPath;

602

603// How every claude spawn is actually invoked: `cmd` + `prefix` ++ our args.

604//

605// On Windows the global npm install exposes claude as claude.cmd, and Node

606// (≥18.20 / ≥20.12) throws `spawn EINVAL` when a .cmd/.bat is spawned without a

607// shell — the CVE-2024-27980 mitigation. That's the "Failed to start claude:

608// spawn EINVAL" users hit on Windows. Setting `shell:true` would route our

609// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through

610// cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own

611// cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L609

612// an .exe, spawned verbatim with the args array untouched. Non-Windows and the

613// standalone .exe installer are unaffected and spawn CLAUDE as-is.

614function winClaudeJs(cmdPath) {

615 // npm's shim embeds the entry path relative to the shim's own dir, e.g.

616 // "%dp0%\node_modules\@anthropic-ai\claude-code\cli.js" (modern npm)

617 // "%~dp0\node_modules\@anthropic-ai\claude-code\cli.js" (older npm)

618 try {

619 const m = readFileSync(cmdPath, "utf8").match(/%~?dp0%?\\?([^"\r\n]+\.js)/i);

620 if (m) {

621 const abs = join(dirname(cmdPath), m[1]);

622 if (existsSync(abs)) return abs;

623 }

624 } catch {

625 /* unreadable shim — fall through to the well-known layout */

626 }

627 const guess = join(dirname(cmdPath), "node_modules", "@anthropic-ai", "claude-code", "cli.js");

628 return existsSync(guess) ? guess : null;

629}