registry  /  @seemseam/ccb  /  8.0.13

@seemseam/ccb@8.0.13

Visible, controllable multi-agent CLI workspace for Codex, Claude, Gemini, Kimi, MiMo, Qwen, Cursor, Copilot, Crush, Kiro, Pi, Z.ai, OpenCode, Antigravity, and Droid.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The npm package is a thin JS wrapper that lifecycle-downloads and installs a native release artifact. This creates unresolved binary payload risk, but the inspected JS does not show malicious behavior or agent control-surface hijacking.

Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; later user-invoked bin commands
Impact
Native binary runs with user privileges when ccb/ask/autonew/ctx-transfer is invoked; install-time writes are limited to package .ccb-release and temp files.
Mechanism
download, checksum-verify, extract, and execute packaged release binary
Attack narrative
On npm install, postinstall runs bin/ccb-npm-install.js, downloads a platform tarball and SHA256SUMS from the package's GitHub releases, verifies the archive against that checksum file, extracts it to .ccb-release, and later bin wrappers execute the extracted native commands. No inspected JS plants agent instructions or harvests data, but the remote native artifact is outside this source review.
Rationale
Source inspection supports a package-aligned binary installer/wrapper, not confirmed malware. Because install-time remote native payload installation leaves uninspected executable risk, warn rather than mark clean or block.
Evidence
package.jsonbin/ccb-npm-install.jsbin/ccb-npm-runner.jsbin/ccb.jsbin/ask.jsbin/autonew.jsbin/ctx-transfer.js.ccb-releaseos.tmpdir()/ccb-npm-*
Network endpoints1
github.com/SeemSeam/claude_codex_bridge/releases/download/v8.0.13

Decision evidence

public snapshot
AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • package.json runs postinstall: node bin/ccb-npm-install.js
  • bin/ccb-npm-install.js downloads platform tarball and SHA256SUMS during install
  • Downloaded archive is extracted into .ccb-release under the package
  • bin/ccb-npm-runner.js executes the installed native ccb/ask/autonew/ctx-transfer binary on CLI invocation
Evidence against
  • Download host is package-aligned GitHub release URL for SeemSeam/claude_codex_bridge
  • Installer verifies SHA256 from SHA256SUMS before extraction
  • No source writes to home/project AI-agent control surfaces during npm lifecycle
  • No credential/env harvesting or exfiltration logic found in JS wrapper files
  • Network use is limited to release artifact/checksum download in installer
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
Manifest
CopyleftLicense
scanned 6 file(s), 5.88 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node bin/ccb-npm-install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
bin/ask.jsView file
3L4: require("./ccb-npm-runner").run("ask");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/ask.jsView on unpkg · L3

Findings

1 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumDynamic Requirebin/ask.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License