registry / @oked/claude-code / 0.6.20
@oked/claude-code@0.6.20
OKed for Claude Code - zero-code human approval for sensitive actions
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifests show no npm install hook, and the Claude Code hook is installed through an explicit CLI command. Credentialed approval and rules requests plus a throttled hostname heartbeat go to the configured OKed backend; the inspected source establishes no unrelated recipient or concrete attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `oked init` to configure the hook and pair the device.
Impact
No confirmed malicious effect was established; the inspected credential and hostname transfers serve the configured OKed backend.
Mechanism
The CLI writes hook configuration to project settings; SDK requests use the configured OKed backend.
AI rationale
The manifests show no npm install hook, and the Claude Code hook is installed through an explicit CLI command. Credentialed approval and rules requests plus a throttled hostname heartbeat go to the configured OKed backend; the inspected source establishes no unrelated recipient or concrete attack.
Evidence
package.jsondist/cli.jsdist/hook-config.js.lpm-dependency-evidence-54744bbd-a442-4408-9eee-7826400275ac/0/npm-linux/package.json.lpm-dependency-evidence-54744bbd-a442-4408-9eee-7826400275ac/0/npm-linux/dist/index.js
Network endpoints1
api.oked.ai
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json and the SDK manifest define only prepublishOnly build scripts; neither has an npm install hook.
- The hook is added to project settings only through the explicit `oked init` command; the SDK also supports key-only setup without adding a hook.
- The SDK sends approval requests and its API key to the configured backend, which defaults to api.oked.ai.
- The SDK sends a throttled hostname heartbeat and authenticated rules requests to that same configured backend.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
6 flaggeddist/cli.jsView file
4import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
High
4import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
...
L11: import { renderQR } from "./qr.js";
L12: const DEFAULT_BACKEND_URL = process.env.OKED_BACKEND_URL || "https://api.oked.ai";
L13: /** `oked init --key-only`: create or show the API key; add or change no hook. */
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L4•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
import { readfilesync, writefilesync, existssync, mkdirsync, chmodsync } from "fs";
import { hostname } from "os";
import { join, dirname } from "path";
import { spawn } from "child_process";
import { createinterface } from "readline";
import { okedclient, loadokedconfig, oked_config_path } from "@oked/sdk";
import { hook_config, hasokedcommandhook, ensuremcpmatcher, ensurehooktimeout, upgradesettingsfile, usersettingspath, } from "./hook-config.js";
import { client_version } from "./version.js";
import { oked_receipts_log, verifyreceiptsfile } from "./receipts.js";
import { renderqr } from "./qr.js";
const default_backend_url = process.env.oked_backend_url || "https://api.oked.ai
Findings
4 High2 Medium6 Low
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighPrevious Version Dangerous Deltadist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-54744bbd-a442-4408-9eee-7826400275ac/0/npm-linux/package.json
Affected versions and remediation
This report applies to @oked/claude-code@0.6.20.
See all versions of @oked/claude-code for other recorded verdicts.
- Review the evidence and your use of @oked/claude-code@0.6.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.