registry / @seemseam/ccb / 8.6.1

@seemseam/ccb@8.6.1

Lightweight multi-agent TUI and stable cross-provider collaboration layer for Codex, Claude, Gemini, Grok, Kimi, DeepSeek, and other CLI agents.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

npm postinstall downloads a platform archive, extracts it, and executes its installer. The executable payload is absent from the reviewed tarball and may be replaced at the remote release source.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation (postinstall) or a package CLI invocation when runtime is absent

Impact

Remote release compromise or URL override can cause arbitrary code execution during installation.

Mechanism

remote archive download, extraction, and shell execution

Rationale

The shipped source establishes an install-time remote-payload execution chain. It does not show credential theft or foreign AI-agent configuration mutation, but the opaque staged executable warrants a warning.

Evidence

package.jsonbin/ccb-npm-install.jsbin/ccb-npm-runner.js.ccb-release.ccb-install.lockinstall.sh

Network endpoints1

github.com/SeemSeam/claude_codex_bridge/releases/download/v${version}

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with false-positive risk.

@seemseam/ccb@8.6.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code