@promptctl/cc-candybar@1.176.0
Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package’s optional attach launcher does more than animate the statusline: it overrides a default-false Claude Code feature gate to expose the model’s goal-proposal tool. Because this broader capability is enabled as a side effect of selecting statusline animation, warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The user enables the optional statusline animation, which restarts Claude Code under the attach launcher.
Impact
The model gains access to ProposeGoal, which can enqueue `/goal <condition>` in the session; this is a broader agent capability than statusline rendering requires.
Mechanism
The launcher applies a seam that makes the `tengu_propose_goal` gate return true, overriding its default-false server gate.
AI rationale
The package’s optional attach launcher does more than animate the statusline: it overrides a default-false Claude Code feature gate to expose the model’s goal-proposal tool. Because this broader capability is enabled as a side effect of selecting statusline animation, warn rather than block.
Evidence
dist/cc-extra/src/seams.jsdist/index.mjs
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The attach seam targets Claude Code’s ProposeGoal model tool, which can enqueue `/goal <condition>` on the session’s message queue.
- The source says the `tengu_propose_goal` server-side feature gate defaults to false, then defines a seam that inserts `return true;` for it.
- Enabling the optional statusline animation restarts Claude Code under the attach launcher, where the seams are applied.
- The package describes itself as a Claude Code statusline renderer; the goal-tool change is a separate capability from rendering the statusline.
Evidence against
- The package’s setup and primary function are statusline rendering; the attach launcher is used when the user enables the optional statusline animation.
- The manifest’s `prepublishOnly` script runs publishing checks and a build; it is not an install hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
11 flaggeddist/index.mjsView file
10contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),S(`eof`)}b()},value(){switch(_){case`{`:case`[`:return S(`punctuator`,b());case`n`:return b(),C(`ull`),S(`null`,null);case`t`:return b(),C(`rue`),S(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.mjsView on unpkg · L10488Trigger-reachable chain: scripts.start -> dist/index.mjs
L488: `)){n.push(r);continue}let e=r.split(`
L489: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function Q2(e){let t=new Map;return e.map(e=>{let n=`${e.place}.${e.band}`,r=t.get(n)??0;return t.s...
L490: `),nextChange:ye,motion:be,menuRows:_e,evaluated:_.evaluated-y,pending:[...te].sort(),rules:re}}catch(e){l.e=e}finally{l.d()}}const T3={moving:1e3/30,still:1e3},E3=[`data`,`state`,...
L491: `}function Z3(e,t){let{sessionState:n}=e,r=t.sessionId,{client:i,...a}=t.hints,o=JSON.stringify(a);n.get(r,`client-hints`)!==o&&n.set(r,P1,o);let s=a1(t.requested);n.get(r,`render-...
L492: `}const i6=new Set([`hook_event_name`,`session_id`,`session_name`,`transcript_path`,`cwd`,`model`,`workspace`,`version`,`o
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L4881#!/usr/bin/env node
L2: import{createRequire as e}from"node:module";import t from"node:process";import{URL as n,URLSearchParams as r,fileURLToPath as i}from"node:url";import{json as a}from"node:stream/con...
L3: `)}function Bt(e){if(typeof e!=`object`||!e||Array.isArray(e))return;let t=e,n=At.filter(e=>t[e]!==void 0);return n.every(e=>typeof t[e]==`string`&&t[e]!==``)?Object.fromEntries(n....
High
491`}function Z3(e,t){let{sessionState:n}=e,r=t.sessionId,{client:i,...a}=t.hints,o=JSON.stringify(a);n.get(r,`client-hints`)!==o&&n.set(r,P1,o);let s=a1(t.requested);n.get(r,`render-...
L492: `}const i6=new Set([`hook_event_name`,`session_id`,`session_name`,`transcript_path`,`cwd`,`model`,`workspace`,`version`,`output_style`,`cost`,`context_window`,`exceeds_200k_tokens`...
L493: `),r=+!t;for(let e=n.length-1;e>=r;e--){let t=n[e];if(!t||!s5.test(t))continue;let r=c5(t);if(r!=null)return r}return null}var p5=class{bySession=Y.observable.map(void 0,{deep:!1})...
...
L502: `).map(e=>e.trim().split(` `)).filter(([,e])=>e===t).map(([e])=>e)}const $te=/(^|\/)(cc-attach|bun-attach\.js)(\s|$)/;function ene(e,t,n){for(let r of hY(mY(e),t)){if(r.command.spl...
L503: `);async function nne(e,t){if(
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.mjsView on unpkg · L491488`)){n.push(r);continue}let e=r.split(`
L489: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function Q2(e){let t=new Map;return e.map(e=>{let n=`${e.place}.${e.band}`,r=t.get(n)??0;return t.s...
L490: `),nextChange:ye,motion:be,menuRows:_e,evaluated:_.evaluated-y,pending:[...te].sort(),rules:re}}catch(e){l.e=e}finally{l.d()}}const T3={moving:1e3/30,still:1e3},E3=[`data`,`state`,...
L491: `}function Z3(e,t){let{sessionState:n}=e,r=t.sessionId,{client:i,...a}=t.hints,o=JSON.stringify(a);n.get(r,`client-hints`)!==o&&n.set(r,P1,o);let s=a1(t.requested);n.get(r,`render-...
L492: `}const i6=new Set([`hook_event_name`,`session_id`,`session_name`,`transcript_path`,`cwd`,`model`,`workspace`,`version`,`output_style`,`cost`,`context_window`,`exceeds_200k_tokens
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.mjsView on unpkg · L488488Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.mjs
L488: `)){n.push(r);continue}let e=r.split(`
L489: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function Q2(e){let t=new Map;return e.map(e=>{let n=`${e.place}.${e.band}`,r=t.get(n)??0;return t.s...
L490: `),nextChange:ye,motion:be,menuRows:_e,evaluated:_.evaluated-y,pending:[...te].sort(),rules:re}}catch(e){l.e=e}finally{l.d()}}const T3={moving:1e3/30,still:1e3},E3=[`data`,`state`,...
L491: `}function Z3(e,t){let{sessionState:n}=e,r=t.sessionId,{client:i,...a}=t.hints,o=JSON.stringify(a);n.get(r,`client-hints`)!==o&&n.set(r,P1,o);let s=a1(t.requested);n.get(r,`render-...
L492: `}const i6=new Set([`hook_event_name`,`session_id`,`session_name`,`transcript_path`,`cwd`,`mod
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.mjsView on unpkg · L4881#!/usr/bin/env node
L2: import{createRequire as e}from"node:module";import t from"node:process";import{URL as n,URLSearchParams as r,fileURLToPath as i}from"node:url";import{json as a}from"node:stream/con...
L3: `)}function Bt(e){if(typeof e!=`object`||!e||Array.isArray(e))return;let t=e,n=At.filter(e=>t[e]!==void 0);return n.every(e=>typeof t[e]==`string`&&t[e]!==``)?Object.fromEntries(n....
L4: `),withdraw:()=>c.end()})}function Ln(e){let t;try{t=y(e,`utf8`).trim()}catch(e){if(e.code===`ENOENT`)return null;throw e}let n=/^exit (\d+)$/.exec(t);if(n)return{kind:`exit`,code:...
L5: `)}const _r=`/usr/bin/footprint`;function vr(e,t,n){return t===`darwin`?[Sr(e,_r,[`-p`,String(n)]),Sr(e,`/usr/bin/vmmap`,[`--summary`,String(n)])]:t===`linux`?[Cr(`/proc/self/smaps...
L6: `).map(e=>e.trim()).
Low
plugin/bin/preview.shView file
•path = plugin/bin/preview.sh
kind = build_helper
sizeBytes = 6874
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
plugin/bin/preview.shView on unpkgdist/attach-preload.cjsView file
•matchType = normalized_sha256
matchedPackage = @promptctl/cc-candybar@1.174.1
matchedPath = dist/attach-preload.cjs
matchedIdentity = npm:QHByb21wdGN0bC9jYy1jYW5keWJhcg:1.174.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/attach-preload.cjsView on unpkgdist/cc-extra/src/bun-attach.jsView file
•matchType = normalized_sha256
matchedPackage = @promptctl/cc-candybar@1.174.1
matchedPath = dist/cc-extra/src/bun-attach.js
matchedIdentity = npm:QHByb21wdGN0bC9jYy1jYW5keWJhcg:1.174.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cc-extra/src/bun-attach.jsView on unpkgdist/cc-extra/src/launch.jsView file
•matchType = normalized_sha256
matchedPackage = @promptctl/cc-candybar@1.174.1
matchedPath = dist/cc-extra/src/launch.js
matchedIdentity = npm:QHByb21wdGN0bC9jYy1jYW5keWJhcg:1.174.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cc-extra/src/launch.jsView on unpkgFindings
2 Critical7 High4 Medium7 Low
CriticalTrojan Source Unicodedist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighKnown Malware Source Similaritydist/attach-preload.cjs
HighKnown Malware Source Similaritydist/cc-extra/src/bun-attach.js
HighKnown Malware Source Similaritydist/cc-extra/src/launch.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugin/bin/preview.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.mjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @promptctl/cc-candybar@1.176.0.
See all versions of @promptctl/cc-candybar for other recorded verdicts.
- Review the evidence and your use of @promptctl/cc-candybar@1.176.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.