Loading npm security reports…

@lizard-build/lizard-studio-host@1.0.57: Suspicious npm security | LPM Firewall

registry / @lizard-build/lizard-studio-host / 1.0.57

@lizard-build/lizard-studio-host@1.0.57

Local host installer for Claude Code and ChatGPT in the Lizard Studio browser extension.

AI Security Review

scanned 13h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The host retrieves a package-owned skill from a mutable upstream branch and makes it available to Claude as a plugin; Codex receives the bundled skill directory as an extra root. This is an agent extension update capability, but no unconsented install-time mutation of agent configuration was identified.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting the Claude host triggers a background skill refresh; starting a Codex session registers the bundled skills root.

Impact

Updated skill instructions can influence later agent sessions. The reviewed code does not establish credential theft, destructive behavior, or remote code execution.

Mechanism

The Claude host downloads skill files from raw.githubusercontent.com and writes them into its own skill directory, which it passes to Claude. The Codex host registers the bundled directory through its skills API.

AI rationale

The package automatically updates and supplies package-owned skill instructions to agent hosts, which creates a concrete extension lifecycle risk. The reviewed source does not establish malicious execution or credential exfiltration, so this warrants a warning rather than a publication block.

Evidence

src/host/claude-host.mjssrc/host/codex-host.mjssrc/host/skills/lizard/SKILL.mdsrc/host/skills/lizard/README.mdsrc/host/skills/lizard/skills.sh.json

Network endpoints1

/lizard-build/skill/main

Source & flagged code

6 flagged · loading source

src/host/router.mjsView file

36import { join } from "node:path"; L37: import { spawn } from "node:child_process"; L38: import net from "node:net";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L36

36import { join } from "node:path"; L37: import { spawn } from "node:child_process"; L38: import net from "node:net"; L39: import { HOST_DIR, makeLog, frameReader, frameRaw, writeFrame, redact } from "./hostkit.mjs"; ... L42: const log = makeLog("router"); L43: const daemonMode = process.env.LIZARD_STUDIO_ROUTER_DAEMON === "1"; L44: const bridgeMode = process.platform === "darwin" && !daemonMode;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/host/router.mjsView on unpkg · L36

src/host/claude-host.mjsView file

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over L6: // this process's stdin/stdout. We spawn `claude` in headless stream-json mode L7: // (`claude -p --input-format stream-json --output-format stream-json`), keep it ... L46: // instead) (→ openPath reply) L47: // { type:"stashFile", id, reqId, name, data } write an attached file (base64) to a L48: // temp dir so claude can Read it by path ... L98: L99: import { spawn, execFile, execSync } from "node:child_process"; L100: import { randomBytes, createHash } from "node:crypto"; ... L107: import { PassThrough } from "node:stream"; L108: import net from "node:n

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

620// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through L621: // cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own L622: // cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L620

src/host/codex-spawn.mjsView file

2// Hosts and Codex use separate shims, tokens and launchd job labels. L3: import { spawn, execFile } from "node:child_process"; L4: import { EventEmitter } from "node:events"; ... L8: import { join } from "node:path"; L9: import net from "node:net"; L10: ... L25: L26: // launchctl submit restarts jobs that exit nonzero — always leave with 0. L27: const bail = () => process.exit(0); ... L34: sock.setNoDelay(true); L35: sock.write(JSON.stringify({ token: token, spawnId: spawnId, chan: chan }) + "\\n", () => cb(sock)); L36: });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/host/codex-spawn.mjsView on unpkg · L2

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Source & flagged code

6 flagged

src/host/router.mjsView file

Lines 16-56javascript

16//

17// Messages from a host to the panel are forwarded as the exact bytes the child

18// produced. The router reads small Claude ready messages to reset restart delay.

19// Only the Chrome->host direction is inspected for routing; its original bytes

20// are forwarded too.

21//

22// Routing, in order:

23// 1. `browserResult` — by bid range (see CODEX_BID_BASE below)

24// 2. an explicit `agent` field on the message

25// 3. the agent remembered for that chat id (set by `start` / `prewarm`)

26// 4. claude — the default, so a panel that knows nothing about any of this

27// behaves exactly as it did before

28//

29// Protocol additions the panel may use (every one is optional; a panel that

30// never sends them gets today's behaviour):

31// panel -> router: { type:"prewarm", agent, id? } spin a host up early

32// panel -> any: { ..., agent } pick the host explicitly

33// router -> panel: { type:"agentExit", agent, code } a host died

34

35import { existsSync, chmodSync, unlinkSync } from "node:fs";

36import { join } from "node:path";

37import { spawn } from "node:child_process";

38import net from "node:net";

High

Child Process

Package source references child process execution.

src/host/router.mjsView on unpkg · L36

39import { HOST_DIR, makeLog, frameReader, frameRaw, writeFrame, redact } from "./hostkit.mjs";

40import { createHostSpawner } from "./codex-spawn.mjs";

41

42const log = makeLog("router");

43const daemonMode = process.env.LIZARD_STUDIO_ROUTER_DAEMON === "1";

44const bridgeMode = process.platform === "darwin" && !daemonMode;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/host/router.mjsView on unpkg · L36

45const hostSpawner = bridgeMode ? null : createHostSpawner({ hostDir: HOST_DIR, redact });

46

47// Bumped on every router change the panel needs to know about. Reported inside

48// the `agentReady` message each non-claude host sends; claude's own `ready`

49// (and the HOST_VERSION in it) passes through untouched.

50const ROUTER_VERSION = 2;

51

52// The browser bridge correlates requests by `bid`, and each host numbers its

53// own from scratch. Rather than rewrite ids in flight — which would mean

54// parsing and re-serializing every message — the hosts are given disjoint

55// ranges: claude counts up from 1, codex counts up from this base. Routing a

56// `browserResult` is then a comparison, and the router still never touches a

src/host/claude-host.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Native-messaging host for the Lizard Studio "Claude Code chat" side panel.

3//

4// It bridges the Chrome side panel and the real `claude` CLI. The panel speaks

5// Chrome native messaging (4-byte little-endian length prefix + JSON body) over

6// this process's stdin/stdout. We spawn `claude` in headless stream-json mode

7// (`claude -p --input-format stream-json --output-format stream-json`), keep it

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/host/claude-host.mjsView on unpkg · L5

8// alive across turns, and relay every line it emits back to the panel verbatim

src/host/codex-spawn.mjsView file

Lines 1-22javascript

1// Start local tools outside Chrome's inherited file quarantine on macOS.

2// Hosts and Codex use separate shims, tokens and launchd job labels.

3import { spawn, execFile } from "node:child_process";

4import { EventEmitter } from "node:events";

5import { PassThrough } from "node:stream";

src/host/hostkit.mjsView file

•matchType = normalized_sha256 matchedPackage = @lizard-build/lizard-studio-host@1.0.30 matchedPath = src/host/hostkit.mjs matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/host/hostkit.mjsView on unpkg

Lines 600-640javascript

600 join(home, ".local/bin/claude"),

601 join(home, ".claude/local/claude"),

602 "/usr/bin/claude",

603 ]) {

604 if (existsSync(c)) return c;

605 }

606 return "claude";

607}

608const CLAUDE = resolveClaude();

609log("claude resolved to", CLAUDE, "exists=", existsSync(CLAUDE));

610

611// The node that runs this host also runs the MCP relay we hand to claude.

612const NODE = (CONFIG.nodePath && existsSync(CONFIG.nodePath)) ? CONFIG.nodePath : process.execPath;

613

614// How every claude spawn is actually invoked: `cmd` + `prefix` ++ our args.

615//

616// On Windows the global npm install exposes claude as claude.cmd, and Node

617// (≥18.20 / ≥20.12) throws `spawn EINVAL` when a .cmd/.bat is spawned without a

618// shell — the CVE-2024-27980 mitigation. That's the "Failed to start claude:

619// spawn EINVAL" users hit on Windows. Setting `shell:true` would route our

620// JSON-bearing args (--mcp-config, --settings, --append-system-prompt) through

621// cmd.exe, which mangles the embedded quotes. So instead we find the CLI's own

622// cli.js (the .cmd shim is just a node launcher) and run it with node directly —

High

Shell

Package source references shell execution.

src/host/claude-host.mjsView on unpkg · L620

623// an .exe, spawned verbatim with the args array untouched. Non-Windows and the

624// standalone .exe installer are unaffected and spawn CLAUDE as-is.

625function winClaudeJs(cmdPath) {

626 // npm's shim embeds the entry path relative to the shim's own dir, e.g.

627 // "%dp0%\node_modules\@anthropic-ai\claude-code\cli.js" (modern npm)

628 // "%~dp0\node_modules\@anthropic-ai\claude-code\cli.js" (older npm)

629 try {

630 const m = readFileSync(cmdPath, "utf8").match(/%~?dp0%?\\?([^"\r\n]+\.js)/i);

631 if (m) {

632 const abs = join(dirname(cmdPath), m[1]);

633 if (existsSync(abs)) return abs;

634 }

635 } catch {

636 /* unreadable shim — fall through to the well-known layout */

637 }

638 const guess = join(dirname(cmdPath), "node_modules", "@anthropic-ai", "claude-code", "cli.js");

639 return existsSync(guess) ? guess : null;

640}