registry / @seemseam/ccb / 8.6.0

@seemseam/ccb@8.6.0

Lightweight multi-agent TUI and stable cross-provider collaboration layer for Codex, Claude, Gemini, Grok, Kimi, DeepSeek, and other CLI agents.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Installing the npm package fetches an opaque platform archive and executes its extracted bootstrap script. The packaged JavaScript itself contains no confirmed data theft or agent-control mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

A compromised or redirected release payload can execute with the installing user's permissions.

Mechanism

remote archive download, extraction, and bash execution

Rationale

The source establishes unconsented install-time remote code execution, but the observed default endpoint is package-aligned and no direct malicious action is present in the shipped wrappers. This warrants a warning rather than a publication block.

Evidence

package.jsonbin/ccb-npm-install.jsbin/ccb-npm-runner.jsbin/ccb.jsbin/ask.jsbin/autonew.jsbin/ctx-transfer.js.ccb-release.ccb-install.lock

Network endpoints1

github.com/SeemSeam/claude_codex_bridge/releases/download/v${version}

Decision evidence

public snapshot

@seemseam/ccb@8.6.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code