registry / @promptctl/cc-candybar / 1.160.8
@promptctl/cc-candybar@1.160.8
Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.
AI Security Review
scanned 8d ago · by lpm-firewall-aiI found no concrete attack behavior. The scanner’s process and network matches resolve to CLI functionality and package-aligned requests; no install-time attack or credential transfer was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI activates the bundled runtime; setup and release checking are exposed through its install command.
Impact
No attack impact is established by the inspected paths.
Mechanism
The observed requests retrieve pricing data from the publisher’s repository or check release metadata at the npm registry. No credential or command-output transfer to a remote endpoint was identified.
AI rationale
I found no concrete attack behavior. The scanner’s process and network matches resolve to CLI functionality and package-aligned requests; no install-time attack or credential transfer was identified.
Network endpoints2
registry.npmjs.orgraw.githubusercontent.com/promptctl/cc-candybar/main/pricing.json
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json routes runtime and CLI entrypoints to the bundle; its lifecycle-like script is prepublishOnly and runs build checks.
- The CLI shim imports the bundle when invoked. Three inspected optional packages are same-version, platform-specific binaries with no lifecycle scripts.
- Observed network requests are package-aligned: pricing comes from the publisher’s GitHub repository, and the npm registry is used for release checking during the install command.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
9 flaggeddist/index.mjsView file
9contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),x(`eof`)}b()},value(){switch(_){case`{`:case`[`:return x(`punctuator`,b());case`n`:return b(),S(`ull`),x(`null`,null);case`t`:return b(),S(`rue`),x(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.mjsView on unpkg · L9480Trigger-reachable chain: scripts.start -> dist/index.mjs
L480: `)+1,a=0,o=0;for(let e of n.slice(r,i).split(`
L481: `)){let t=rK(e);t.kind!==`blank`&&(a++,t.kind===`unparsed`&&o++)}return{lines:a,unparsed:o,whole:t}}function S0(e){let t=Xa(e,tN+1);return t.kind===`ok`?P(x0(t.value.buf,t.value.fr...
L482: `)};return e.error===null?{...t,kind:`loaded`,unused:e.unused}:{...t,kind:`failed`,error:e.error}}const O0=e=>o0(()=>co(e));function k0(e,t){let n=e=>JSON.stringify([e.managedDir,e...
L483: `:null,r=U0(e.value);return r===null?{stdout:n??Z0(e.value),stderr:``,code:0}:{stdout:n??``,stderr:`daemon-stats: ${r}\n`,code:1}}function H0(){return cn(()=>({kind:`stats`}),z0,e=...
...
L495: `).map(e=>e.trim().split(` `)).filter(([,e])=>e===t).map(([e])=>e)}const K6=/(^|\/)(cc-attach|bun-attach\.js)(
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L480Findings
3 Critical4 High4 Medium7 Low
CriticalTrojan Source Unicodedist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugin/bin/preview.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @promptctl/cc-candybar@1.160.8.
See all versions of @promptctl/cc-candybar for other recorded verdicts.
- Review the evidence and your use of @promptctl/cc-candybar@1.160.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.