registry / @promptctl/cc-candybar / 1.172.0
@promptctl/cc-candybar@1.172.0
Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe entrypoint runs the statusline renderer, and the shell and network behavior fits its configurable data sources, pricing lookup, and explicit install command. The manifest has no install-time hook; the prepublishOnly script performs validation and a build.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Statusline rendering or an explicit install subcommand.
Impact
No malicious collection, unrelated execution, or unrequested account action was identified.
Mechanism
Configured shell data sources can run commands; pricing and installation helpers contact the package’s GitHub pricing file or npm registry.
AI rationale
The entrypoint runs the statusline renderer, and the shell and network behavior fits its configurable data sources, pricing lookup, and explicit install command. The manifest has no install-time hook; the prepublishOnly script performs validation and a build.
Network endpoints2
raw.githubusercontent.comregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Claude Code statusline renderer and points its entrypoint to dist/index.mjs.
- The only lifecycle script is prepublishOnly, which runs validation and builds; there is no install hook.
- Shell execution is available through the configurable shell data-source feature.
- The package fetches pricing data from its own GitHub repository.
- The npm registry request and settings update are part of the explicit install subcommand.
Evidence against
- The bundle contains process execution and network access, which merit review but fit the renderer, data-source, pricing, and install features.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
8 flaggeddist/index.mjsView file
10contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),S(`eof`)}b()},value(){switch(_){case`{`:case`[`:return S(`punctuator`,b());case`n`:return b(),C(`ull`),S(`null`,null);case`t`:return b(),C(`rue`),S(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.mjsView on unpkg · L10488Trigger-reachable chain: scripts.start -> dist/index.mjs
L488: `)){n.push(r);continue}let e=r.split(`
L489: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function B2(e){let t=new Map;return e.map(e=>{let n=`${e.place}.${e.band}`,r=t.get(n)??0;return t.s...
L490: `),nextChange:be,motion:xe,menuRows:ve,evaluated:_.evaluated-y,pending:[...te].sort(),rules:re}}catch(e){l.e=e}finally{l.d()}}const p3={moving:1e3/30,still:1e3},m3=[`data`,`state`,...
L491: `}function z3(e,t){let{sessionState:n}=e,r=t.sessionId,{client:i,...a}=t.hints,o=JSON.stringify(a);n.get(r,`client-hints`)!==o&&n.set(r,C1,o);let s=J$(t.requested);n.get(r,`render-...
L492: `}const K3=new Set([`hook_event_name`,`session_id`,`session_name`,`transcript_path`,`cwd`,`model`,`workspace`,`version`,`o
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L4881#!/usr/bin/env node
L2: import{createRequire as e}from"node:module";import t from"node:process";import{URL as n,URLSearchParams as r,fileURLToPath as i}from"node:url";import{json as a}from"node:stream/con...
L3: `)}function Rt(e){if(typeof e!=`object`||!e||Array.isArray(e))return;let t=e,n=Ot.filter(e=>t[e]!==void 0);return n.every(e=>typeof t[e]==`string`&&t[e]!==``)?Object.fromEntries(n....
High
491`}function z3(e,t){let{sessionState:n}=e,r=t.sessionId,{client:i,...a}=t.hints,o=JSON.stringify(a);n.get(r,`client-hints`)!==o&&n.set(r,C1,o);let s=J$(t.requested);n.get(r,`render-...
L492: `}const K3=new Set([`hook_event_name`,`session_id`,`session_name`,`transcript_path`,`cwd`,`model`,`workspace`,`version`,`output_style`,`cost`,`context_window`,`exceeds_200k_tokens`...
L493: `),r=+!t;for(let e=n.length-1;e>=r;e--){let t=n[e];if(!t||!Y8.test(t))continue;let r=X8(t);if(r!=null)return r}return null}var t5=class{bySession=Y.observable.map(void 0,{deep:!1})...
...
L502: `).map(e=>e.trim().split(` `)).filter(([,e])=>e===t).map(([e])=>e)}const xte=/(^|\/)(cc-attach|bun-attach\.js)(\s|$)/;function Ste(e,t,n){for(let r of aY(iY(e),t)){if(r.command.spl...
L503: `);async function wte(e,t){if(
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.mjsView on unpkg · L491488`)){n.push(r);continue}let e=r.split(`
L489: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function B2(e){let t=new Map;return e.map(e=>{let n=`${e.place}.${e.band}`,r=t.get(n)??0;return t.s...
L490: `),nextChange:be,motion:xe,menuRows:ve,evaluated:_.evaluated-y,pending:[...te].sort(),rules:re}}catch(e){l.e=e}finally{l.d()}}const p3={moving:1e3/30,still:1e3},m3=[`data`,`state`,...
L491: `}function z3(e,t){let{sessionState:n}=e,r=t.sessionId,{client:i,...a}=t.hints,o=JSON.stringify(a);n.get(r,`client-hints`)!==o&&n.set(r,C1,o);let s=J$(t.requested);n.get(r,`render-...
L492: `}const K3=new Set([`hook_event_name`,`session_id`,`session_name`,`transcript_path`,`cwd`,`model`,`workspace`,`version`,`output_style`,`cost`,`context_window`,`exceeds_200k_tokens
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.mjsView on unpkg · L488488Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.mjs
L488: `)){n.push(r);continue}let e=r.split(`
L489: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function B2(e){let t=new Map;return e.map(e=>{let n=`${e.place}.${e.band}`,r=t.get(n)??0;return t.s...
L490: `),nextChange:be,motion:xe,menuRows:ve,evaluated:_.evaluated-y,pending:[...te].sort(),rules:re}}catch(e){l.e=e}finally{l.d()}}const p3={moving:1e3/30,still:1e3},m3=[`data`,`state`,...
L491: `}function z3(e,t){let{sessionState:n}=e,r=t.sessionId,{client:i,...a}=t.hints,o=JSON.stringify(a);n.get(r,`client-hints`)!==o&&n.set(r,C1,o);let s=J$(t.requested);n.get(r,`render-...
L492: `}const K3=new Set([`hook_event_name`,`session_id`,`session_name`,`transcript_path`,`cwd`,`mod
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.mjsView on unpkg · L4881#!/usr/bin/env node
L2: import{createRequire as e}from"node:module";import t from"node:process";import{URL as n,URLSearchParams as r,fileURLToPath as i}from"node:url";import{json as a}from"node:stream/con...
L3: `)}function Rt(e){if(typeof e!=`object`||!e||Array.isArray(e))return;let t=e,n=Ot.filter(e=>t[e]!==void 0);return n.every(e=>typeof t[e]==`string`&&t[e]!==``)?Object.fromEntries(n....
L4: `),withdraw:()=>c.end()})}function Mn(e){let t;try{t=y(e,`utf8`).trim()}catch(e){if(e.code===`ENOENT`)return null;throw e}let n=/^exit (\d+)$/.exec(t);if(n)return{kind:`exit`,code:...
L5: `)}const dr=`/usr/bin/footprint`;function fr(e,t,n){return t===`darwin`?[gr(e,dr,[`-p`,String(n)]),gr(e,`/usr/bin/vmmap`,[`--summary`,String(n)])]:t===`linux`?[_r(`/proc/self/smaps...
L6: `).map(e=>e.trim()).
Low
plugin/bin/preview.shView file
•path = plugin/bin/preview.sh
kind = build_helper
sizeBytes = 6874
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
plugin/bin/preview.shView on unpkgFindings
2 Critical4 High4 Medium7 Low
CriticalTrojan Source Unicodedist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugin/bin/preview.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.mjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @promptctl/cc-candybar@1.172.0.
See all versions of @promptctl/cc-candybar for other recorded verdicts.
- Review the evidence and your use of @promptctl/cc-candybar@1.172.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.