@promptctl/cc-candybar@1.184.0
Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s attach path changes Claude Code’s feature gate to enable model-proposed goals, a capability unrelated to its documented statusline purpose. Because this happens during a user-triggered statusline restart and no data theft or destructive behavior was found, this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user turns on the statusline lane, which restarts Claude Code under the attach launcher.
Impact
Claude Code gains a model-available agent action that the package’s statusline purpose does not disclose.
Mechanism
The launcher applies a source seam that replaces the `tengu_propose_goal` feature-gate result with `true`.
AI rationale
The package’s attach path changes Claude Code’s feature gate to enable model-proposed goals, a capability unrelated to its documented statusline purpose. Because this happens during a user-triggered statusline restart and no data theft or destructive behavior was found, this warrants a warning rather than a block.
Evidence
README.mddist/index.mjsdist/cc-extra/src/bun-attach.jsdist/cc-extra/src/seams.js${XDG_STATE_HOME:-~/.local/state}/cc-extra/attach.log${os.tmpdir()}/cc-extra-attach-*/inspector.sock
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The README describes the package as a Claude Code statusline renderer.
- The `propose-goal` seam matches Claude Code’s `tengu_propose_goal` gate and inserts `return true`.
- The source says the model-proposed-goals setting defaults to `auto`, while the server-side feature gate defaults to false.
- Turning the statusline lane on restarts Claude Code under an attach launcher, which resolves and applies the seams.
- The manifest’s lifecycle script is `prepublishOnly`; this behavior is not an install hook.
Evidence against
- The seam runs when the statusline-on action restarts Claude Code, rather than automatically on package install.
- The seam changes an in-memory feature gate; the reviewed code does not show it collecting or sending credentials or other data.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
10 flaggeddist/index.mjsView file
10contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),S(`eof`)}b()},value(){switch(_){case`{`:case`[`:return S(`punctuator`,b());case`n`:return b(),C(`ull`),S(`null`,null);case`t`:return b(),C(`rue`),S(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.mjsView on unpkg · L10482Trigger-reachable chain: scripts.start -> dist/index.mjs
L482: `)){n.push(r);continue}let e=r.split(`
L483: `);n.push(e[0]);for(let r=1;r<e.length;r++)t.push(n),n=[e[r]]}return t.push(n),t}function I2(e){let t=new Map;return e.map(e=>{let n=`${e.place}.${e.band}`,r=t.get(n)??0;return t.s...
L484: `),c=t.kind===`running`?sU(`[${i.busy}]`,null):sU(`[${i.act}]`,va([{verb:ra,args:[n.sessionId]}])),l=[sU(a,null),c,sU(`[dismiss]`,va([{verb:zi,args:[n.sessionId,Cz,r]}])),sU(`[disa...
L485: `),r=+!t;for(let e=n.length-1;e>=r;e--){let t=n[e];if(!t||!y5.test(t))continue;let r=b5(t);if(r!=null)return r}return null}var T5=class{bySession=Y.observable.map(void 0,{deep:!1})...
...
L493: `).flatMap(e=>{let[n,...r]=e.trim().split(` `);return Fne.exec(r.join(` `))?.[1]===t?[n]:[]})}const Lne=/(^|\/)(cc-att
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L482Findings
2 Critical6 High4 Medium7 Low
CriticalTrojan Source Unicodedist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighKnown Malware Source Similaritydist/attach-preload.cjs
HighKnown Malware Source Similaritydist/cc-extra/src/bun-attach.js
HighKnown Malware Source Similaritydist/cc-extra/src/launch.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugin/bin/preview.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @promptctl/cc-candybar@1.184.0.
See all versions of @promptctl/cc-candybar for other recorded verdicts.
- Review the evidence and your use of @promptctl/cc-candybar@1.184.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.