@promptctl/cc-candybar@1.180.1
Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package contains a runtime patch that enables Claude Code’s model-facing goal tool, which is outside the stated statusline purpose. This warrants a warning; the inspected evidence does not establish credential theft, exfiltration, or install-time abuse.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
When Claude Code runs through the package’s attached or hosted session path.
Impact
The model can enqueue `/goal` requests in the session when Claude Code would otherwise keep that tool disabled by default.
Mechanism
The seam intercepts the `tengu_propose_goal` feature gate and returns true, exposing the model’s `ProposeGoal` tool.
AI rationale
The package contains a runtime patch that enables Claude Code’s model-facing goal tool, which is outside the stated statusline purpose. This warrants a warning; the inspected evidence does not establish credential theft, exfiltration, or install-time abuse.
Evidence
dist/cc-extra/src/seams.jsdist/cc-extra/src/bun-attach.jsdist/index.mjs
Network endpoints3
unix socket `/tmp/cc-candybar-<uid>/socket`raw.githubusercontent.com/promptctl/cc-candybar/main/pricing.jsonregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The `propose-goal` seam matches Claude Code’s `tengu_propose_goal` gate and inserts `return true;`.
- The source says the model’s goal tool is normally excluded, and its server-side feature gate defaults to false.
- The bundle’s CLI dispatches user-selected subcommands; its default mode is for Claude Code’s statusline input.
- The attach path uses a local Unix socket to push statusline frames; no credential or command-output exfiltration was identified.
Evidence against
- The manifest has no preinstall, install, or postinstall hook; `prepublishOnly` runs build checks.
- The package is described as a Claude Code statusline renderer, and the separate statusline-push seam serves that function.
- The inspected attach transport uses a local Unix socket, not an external collector.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
11 flaggeddist/index.mjsView file
10contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),S(`eof`)}b()},value(){switch(_){case`{`:case`[`:return S(`punctuator`,b());case`n`:return b(),C(`ull`),S(`null`,null);case`t`:return b(),C(`rue`),S(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.mjsView on unpkg · L10478Trigger-reachable chain: scripts.start -> dist/index.mjs
L478: `).join(` — `));let t=v$(e.value,[`handlerProbes`]);if(t!==null)return O$(t);let{version:n,handlerProbes:r}=e.value;return D$({version:n,arrivals:r})}function R$(e){return{platform...
L479: `);return{inMode:r!==`0`,screen:i}}function Q$(e,t,n){return[`load-buffer`,`-b`,t,`-`,`;`,...n.length===0?[]:[`send-keys`,`-t`,e,...n,`;`],`paste-buffer`,`-p`,`-d`,`-b`,t,`-t`,e,`;...
L480: `),t.now());let e=`dispatch: ${r.join(`; `)}`;throw i?Error(e):new Y(e)}}function w0(e){if(e.length===1)throw e[0];if(e.length>1)throw Error(e.map(e=>String(e.message??e)).join(`; ...
...
L483: `)){n.push(r);continue}let e=r.split(`
L484: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function D4(e){let t=new Map;return e
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L478Findings
2 Critical7 High4 Medium7 Low
CriticalTrojan Source Unicodedist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighKnown Malware Source Similaritydist/attach-preload.cjs
HighKnown Malware Source Similaritydist/cc-extra/src/bun-attach.js
HighKnown Malware Source Similaritydist/cc-extra/src/launch.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugin/bin/preview.sh
Affected versions and remediation
This report applies to @promptctl/cc-candybar@1.180.1.
See all versions of @promptctl/cc-candybar for other recorded verdicts.
- Review the evidence and your use of @promptctl/cc-candybar@1.180.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.