registry / @rynfar/meridian / 1.45.2

@rynfar/meridian@1.45.2

Local Anthropic API powered by your Claude Max subscription. One subscription, every agent.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 766 KB of source, external domains: api.anthropic.com, claude.ai, claude.com, github.com, platform.claude.com, www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 6-46json

6 "main": "./dist/server.js",

7 "types": "./dist/proxy/server.d.ts",

8 "bin": {

9 "meridian": "./dist/cli.js",

10 "claude-max-proxy": "./dist/cli.js"

11 },

12 "exports": {

13 ".": {

14 "types": "./dist/proxy/server.d.ts",

15 "default": "./dist/server.js"

16 }

17 },

18 "engines": {

19 "node": ">=22"

20 },

21 "scripts": {

22 "start": "./bin/claude-proxy-supervisor.sh",

23 "proxy": "./bin/claude-proxy-supervisor.sh",

24 "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && bun build bin/cli.ts src/proxy/server.ts --outdir dist --target node --splitting --external @anthropic-ai/claude-agent-sdk --external jsonc-parser --entry-naming \"[name].js\" && tsc -p tsconfig.build.json",

25 "postbuild": "node scripts/fix-bun-exports.mjs && node --check dist/cli.js && node --check dist/server.js && node -e \"if(!require('fs').existsSync('dist/proxy/server.d.ts'))process.exit(1)\"",

26 "postinstall": "node ./node_modules/@anthropic-ai/claude-code/install.cjs 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "prepublishOnly": "bun run build",

28 "test": "bun test --path-ignore-patterns '**/*session-store*' --path-ignore-patterns '**/*proxy-async-ops*' --path-ignore-patterns '**/*models-auth-status*' --path-ignore-patterns '**/*proxy-context-usage-store*' --path-ignore-patterns '**/*proxy-passthrough-thinking*' --path-ignore-patterns '**/*proxy-thinking-setting*' --path-ignore-patterns '**/*session-recovery*' --path-ignore-patterns '**/*models.test*' && bun test src/__tests__/proxy-async-ops.test.ts && bun test src/__tests__/proxy-session-store.test.ts && bun test src/__tests__/session-store-pruning.test.ts && bun test src/__tests_ ...

29 "nix:lock": "bun2nix -o bun.nix",

30 "typecheck": "tsc --noEmit",

31 "proxy:direct": "bun run ./bin/cli.ts"

32 },

33 "dependencies": {

34 "@anthropic-ai/claude-agent-sdk": "^0.2.117",

35 "@anthropic-ai/claude-code": "^2.1.198",

36 "jsonc-parser": "^3.3.1",

37 "libsql": "^0.5.29"

38 },

39 "devDependencies": {

40 "@hono/node-server": "^1.19.11",

41 "@types/bun": "^1.3.11",

42 "@types/node": "^22.0.0",

43 "bun2nix": "^2.0.8",

44 "glob": "^13.0.0",

45 "hono": "^4.11.4",

46 "typescript": "^5.8.2"

Long lines were clipped for display.

dist/cli-7bygmvmv.jsView file

Lines 5-45javascript

5function envBool(suffix) {

6 const val = env(suffix);

7 return val === "1" || val === "true" || val === "yes";

dist/cli-kgrg9sq3.jsView file

16469// src/mcpTools.ts L16470: var execAsync = promisify(exec); L16471: var getCwd = () => process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR ?? process.cwd();

High

Shell

Package source references shell execution.

dist/cli-kgrg9sq3.jsView on unpkg · L16469

206Cross-file remote execution chain: dist/cli-kgrg9sq3.js spawns dist/pluginPage-85s6t6k8.js; helper contains network access plus dynamic code execution. L206: let os = null; L207: switch (process.platform) { L208: case "android": ... L310: var require_detect_libc = __commonJS((exports, module) => { L311: var childProcess = __require("child_process"); L312: var { isLinux, getReport } = require_process(); ... L547: var require_libsql = __commonJS((exports, module) => { L548: var __dirname = "/[redacted]node_modules/libsql"; L549: var { load, currentTarget } = require_dist(); ... L551: function requireNative() { L552: if (process.env.LIBSQL_JS_DEV) { L553: return load(__dirname);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli-kgrg9sq3.jsView on unpkg · L206

202exports.load = exports.currentTarget = undefined; L203: var path = __importStar(__require("path")); L204: var fs = __importStar(__require("fs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-kgrg9sq3.jsView on unpkg · L202

dist/profileCli-w5gpxkyh.jsView file

Lines 222-262javascript

222 console.log("\x1B[33m⚠ Important: Before logging in, make sure you're signed into the");

223 console.log(` correct Claude account in your browser (the one for "${id}").\x1B[0m`);

224 console.log();

225 console.log(" If you're currently signed into a different account:");

226 console.log(" 1. Go to https://claude.ai and sign out"

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./node_modules/@anthropic-ai/claude-code/install.cjs 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./node_modules/@anthropic-ai/claude-code/install.cjs 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli-7bygmvmv.jsView file

25// src/proxy/models.ts L26: import { exec as execCallback, execFile as execFileCallback } from "child_process"; L27: import { existsSync, statSync } from "fs";

High

Child Process

Package source references child process execution.

dist/cli-7bygmvmv.jsView on unpkg · L25

dist/cli-kgrg9sq3.jsView file

16469// src/mcpTools.ts L16470: var execAsync = promisify(exec); L16471: var getCwd = () => process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR ?? process.cwd();

High

Shell

Package source references shell execution.

dist/cli-kgrg9sq3.jsView on unpkg · L16469

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli-kgrg9sq3.jsView on unpkg · L206

202exports.load = exports.currentTarget = undefined; L203: var path = __importStar(__require("path")); L204: var fs = __importStar(__require("fs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-kgrg9sq3.jsView on unpkg · L202

dist/profileCli-w5gpxkyh.jsView file

242console.error("\x1B[31m✗ Could not find a Claude executable to run auth login.\x1B[0m"); L243: console.error(" Install via: npm install -g @anthropic-ai/claude-code, or set MERIDIAN_CLAUDE_PATH=/path/to/claude"); L244: process.exit(1); L245: } L246: const result = spawnSync(resolvedAuth.path, ["auth", "login"], { L247: env: buildAuthLoginEnv(configDir, options),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/profileCli-w5gpxkyh.jsView on unpkg · L242

Findings

5 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli-7bygmvmv.js

HighShelldist/cli-kgrg9sq3.js

HighCross File Remote Execution Contextdist/cli-kgrg9sq3.js

HighRuntime Package Installdist/profileCli-w5gpxkyh.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/cli-kgrg9sq3.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 6-46json

6 "main": "./dist/server.js",

7 "types": "./dist/proxy/server.d.ts",

8 "bin": {

9 "meridian": "./dist/cli.js",

10 "claude-max-proxy": "./dist/cli.js"

11 },

12 "exports": {

13 ".": {

14 "types": "./dist/proxy/server.d.ts",

15 "default": "./dist/server.js"

16 }

17 },

18 "engines": {

19 "node": ">=22"

20 },

21 "scripts": {

22 "start": "./bin/claude-proxy-supervisor.sh",

23 "proxy": "./bin/claude-proxy-supervisor.sh",

25 "postbuild": "node scripts/fix-bun-exports.mjs && node --check dist/cli.js && node --check dist/server.js && node -e \"if(!require('fs').existsSync('dist/proxy/server.d.ts'))process.exit(1)\"",

26 "postinstall": "node ./node_modules/@anthropic-ai/claude-code/install.cjs 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "prepublishOnly": "bun run build",

29 "nix:lock": "bun2nix -o bun.nix",

30 "typecheck": "tsc --noEmit",

31 "proxy:direct": "bun run ./bin/cli.ts"

32 },

33 "dependencies": {

34 "@anthropic-ai/claude-agent-sdk": "^0.2.117",

35 "@anthropic-ai/claude-code": "^2.1.198",

36 "jsonc-parser": "^3.3.1",

37 "libsql": "^0.5.29"

38 },

39 "devDependencies": {

40 "@hono/node-server": "^1.19.11",

41 "@types/bun": "^1.3.11",

42 "@types/node": "^22.0.0",

43 "bun2nix": "^2.0.8",

44 "glob": "^13.0.0",

45 "hono": "^4.11.4",

46 "typescript": "^5.8.2"

Long lines were clipped for display.

dist/cli-7bygmvmv.jsView file

Lines 5-45javascript

5function envBool(suffix) {

6 const val = env(suffix);

7 return val === "1" || val === "true" || val === "yes";

dist/cli-kgrg9sq3.jsView file

16469// src/mcpTools.ts L16470: var execAsync = promisify(exec); L16471: var getCwd = () => process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR ?? process.cwd();

High

Shell

Package source references shell execution.

dist/cli-kgrg9sq3.jsView on unpkg · L16469

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli-kgrg9sq3.jsView on unpkg · L206

202exports.load = exports.currentTarget = undefined; L203: var path = __importStar(__require("path")); L204: var fs = __importStar(__require("fs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-kgrg9sq3.jsView on unpkg · L202

dist/profileCli-w5gpxkyh.jsView file

Lines 222-262javascript

222 console.log("\x1B[33m⚠ Important: Before logging in, make sure you're signed into the");

223 console.log(` correct Claude account in your browser (the one for "${id}").\x1B[0m`);

224 console.log();

225 console.log(" If you're currently signed into a different account:");

226 console.log(" 1. Go to https://claude.ai and sign out"