registry / @promptctl/cc-candybar / 1.155.2
@promptctl/cc-candybar@1.155.2
⚠ Under reviewStatusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe declared runtime entrypoint could not be inspected as UTF-8 source, and readable companion code describes a capability affecting Claude Code behavior without establishing its activation path. Manual review is needed to resolve the unreadable entrypoint; the inspected manifest shows no install lifecycle hook.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Potential activation through the declared runtime entrypoint; the setup wizard separately invokes an explicit install command.
Impact
The feature could permit model-originated goal submissions. No credential theft, destructive action, or other concrete attack was established from the readable source.
Mechanism
Companion source describes debugger-based attachment and a patch to the feature gate for ProposeGoal. Whether the unreadable entrypoint activates this code is unresolved.
AI rationale
The declared runtime entrypoint could not be inspected as UTF-8 source, and readable companion code describes a capability affecting Claude Code behavior without establishing its activation path. Manual review is needed to resolve the unreadable entrypoint; the inspected manifest shows no install lifecycle hook.
Evidence
dist/index.mjsdist/attach-preload.cjsdist/cc-extra/src/seams.jsdist/cc-extra/src/bun-attach.js
Decision evidence
public snapshotAI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest points to dist/index.mjs as the runtime entrypoint, but the source reader rejected that file as binary or NUL-containing, leaving its behavior unresolved.
- Readable companion code describes attaching to Claude Code and enabling the model-accessible ProposeGoal feature; its linkage to the unreadable entrypoint is unverified.
- The manifest’s only lifecycle hook is prepublishOnly, which runs release checks and a build.
- The setup wizard invokes install as an explicit setup step.
Evidence against
- The companion code describes statusline frame updates over a local socket as one purpose of its Claude Code attachment path.
- The reviewed sources do not establish credential transfer, destructive behavior, or an unconsented install-time action.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetry
Source & flagged code
10 flaggeddist/index.mjsView file
1#!/usr/bin/env node
L2: import{createRequire as e}from"node:module";import t from"node:process";import{URL as n,URLSearchParams as r,fileURLToPath as i,pathToFileURL as a}from"node:url";import{json as o}f...
L3: `)}function Wt(e){if(typeof e!=`object`||!e||Array.isArray(e))return;let t=e,n=Mt.filter(e=>t[e]!==void 0);return n.every(e=>Gt(t[e])!==void 0)?Object.fromEntries(n.map(e=>[e,t[e]]...
L4: `)}const Sn=`/usr/bin/footprint`;function Cn(e,t){return e===`darwin`?[En(Sn,[`-p`,String(t)]),En(`/usr/bin/vmmap`,[`--summary`,String(t)])]:e===`linux`?[Dn(`/proc/self/smaps_rollu...
L5: `).map(e=>e.trim()).find(e=>e.length>0);return t===void 0?``:` (${t})`}const kn=`CC_CANDYBAR_RSS_LIMIT_MB`;function An(e){let t=e[kn];if(t===void 0)return 512;let n=/^\d+$/.test(t)...
L6: `)}catch(e){t.stderr
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.mjsView on unpkg · L19contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),x(`eof`)}b()},value(){switch(_){case`{`:case`[`:return x(`punctuator`,b());case`n`:return b(),S(`ull`),x(`null`,null);case`t`:return b(),S(`rue`),x(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.mjsView on unpkg · L9Findings
3 Critical5 High4 Medium7 Low
CriticalCredential Exfiltrationdist/index.mjs
CriticalTrojan Source Unicodedist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Credential Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugin/bin/preview.sh
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @promptctl/cc-candybar@1.155.2.
See all versions of @promptctl/cc-candybar for other recorded verdicts.
- Review the evidence and your use of @promptctl/cc-candybar@1.155.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.