registry / @oked/claude-code / 0.6.19
@oked/claude-code@0.6.19
⚠ Under reviewOKed for Claude Code - zero-code human approval for sensitive actions
Static Scan Results
scanned 8d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
4 flaggeddist/cli.jsView file
4import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
High
4import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
...
L10: import { OKED_RECEIPTS_LOG, verifyReceiptsFile } from "./receipts.js";
L11: const DEFAULT_BACKEND_URL = process.env.OKED_BACKEND_URL || "https://api.oked.ai";
L12: /** `oked init --key-only`: create or show the API key; add or change no hook. */
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L4•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
import { readfilesync, writefilesync, existssync, mkdirsync, chmodsync } from "fs";
import { hostname } from "os";
import { join, dirname } from "path";
import { spawn } from "child_process";
import { createinterface } from "readline";
import { okedclient, loadokedconfig, oked_config_path } from "@oked/sdk";
import { hook_config, hasokedcommandhook, ensuremcpmatcher, ensurehooktimeout, upgradesettingsfile, usersettingspath, } from "./hook-config.js";
import { client_version } from "./version.js";
import { oked_receipts_log, verifyreceiptsfile } from "./receipts.js";
const default_backend_url = process.env.oked_backend_url || "https://api.oked.ai";
Findings
4 High2 Medium4 Low
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighPrevious Version Dangerous Deltadist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @oked/claude-code@0.6.19.
See all versions of @oked/claude-code for other recorded verdicts.
- Review the evidence and your use of @oked/claude-code@0.6.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.