@promptctl/cc-candybar@1.180.5
Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe code intentionally overrides Claude Code’s default-false gate for the model-reachable ProposeGoal tool, hiding an agent capability change inside a statusline attach feature. It requires activation of that experimental path and shows no credential theft or external transmission, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user activates the experimental statusline attach action, which restarts the current Claude Code session under the launcher.
Impact
The model can use the built-in ProposeGoal tool to enqueue `/goal` conditions during the session.
Mechanism
A source seam inserts `return true;` before Claude Code’s `tengu_propose_goal` feature gate, overriding its default-false result.
AI rationale
The code intentionally overrides Claude Code’s default-false gate for the model-reachable ProposeGoal tool, hiding an agent capability change inside a statusline attach feature. It requires activation of that experimental path and shows no credential theft or external transmission, so this warrants a warning rather than a block.
Evidence
dist/cc-extra/src/seams.jsdist/index.mjs
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- `dist/cc-extra/src/seams.js` adds a `propose-goal` seam that inserts `return true;` before the `tengu_propose_goal` feature gate.
- The source describes ProposeGoal as a model-reachable tool and says its server-side gate defaults to false.
- The package includes this seam in its `SEAMS` list. Its experimental statusline `on` action restarts Claude Code under the attach launcher, while the UI describes that action as statusline animation.
- The manifest declares `prepublishOnly` for checks and a build; it declares no preinstall, install, or postinstall hook.
Evidence against
- The capability change is reached through an experimental statusline action that restarts the current Claude Code session.
- The package describes itself as a Claude Code statusline renderer, and the added statusline-push seam serves that rendering feature.
- The reviewed code does not show credentials or command output being sent to an external host as part of this capability change.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
11 flaggeddist/index.mjsView file
10contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),S(`eof`)}b()},value(){switch(_){case`{`:case`[`:return S(`punctuator`,b());case`n`:return b(),C(`ull`),S(`null`,null);case`t`:return b(),C(`rue`),S(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.mjsView on unpkg · L10482Trigger-reachable chain: scripts.start -> dist/index.mjs
L482: `)){n.push(r);continue}let e=r.split(`
L483: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function P2(e){let t=new Map;return e.map(e=>{let n=`${e.place}.${e.band}`,r=t.get(n)??0;return t.s...
L484: `),c=t.kind===`running`?aU(`[${i.busy}]`,null):aU(`[${i.act}]`,ea([{verb:Bi,args:[n.sessionId]}])),l=[aU(a,null),c,aU(`[dismiss]`,ea([{verb:Si,args:[n.sessionId,xz,r]}])),aU(`[disa...
L485: `),r=+!t;for(let e=n.length-1;e>=r;e--){let t=n[e];if(!t||!p5.test(t))continue;let r=m5(t);if(r!=null)return r}return null}var y5=class{bySession=Y.observable.map(void 0,{deep:!1})...
...
L493: `).flatMap(e=>{let[n,...r]=e.trim().split(` `);return gne.exec(r.join(` `))?.[1]===t?[n]:[]})}const vne=/(^|\/)(cc-att
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L482Findings
3 Critical6 High4 Medium7 Low
CriticalTrojan Source Unicodedist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighChild Processdist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighKnown Malware Source Similaritydist/attach-preload.cjs
HighKnown Malware Source Similaritydist/cc-extra/src/bun-attach.js
HighKnown Malware Source Similaritydist/cc-extra/src/launch.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugin/bin/preview.sh
Affected versions and remediation
This report applies to @promptctl/cc-candybar@1.180.5.
See all versions of @promptctl/cc-candybar for other recorded verdicts.
- Review the evidence and your use of @promptctl/cc-candybar@1.180.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.