Loading npm security reports…

@seemseam/ccb@8.6.15: Malicious npm security report (Block) | LPM Firewall

registry / @seemseam/ccb / 8.6.15

@seemseam/ccb@8.6.15

Lightweight multi-agent TUI and stable cross-provider collaboration layer for Codex, Claude, Gemini, Grok, Kimi, and other CLI agents.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package automatically downloads, extracts, and executes an opaque remote release installer. The package contains no pinned artifact hash or bundled installer for this code path.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation invokes postinstall.

Impact

A party controlling the release asset, checksum, configured release URL, or accepted redirect can cause code to run during installation.

Mechanism

Remote archive download followed by shell execution of its extracted installer.

Attack narrative

The npm postinstall hook invokes the installer without a user command. It downloads both an archive and its SHA256SUMS file from a remotely configurable release location, accepts redirects, extracts the archive into .ccb-release, then runs the archive's install.sh through bash. Because the expected checksum is supplied by the same remote location and is not pinned in the reviewed package, it does not authenticate the downloaded code. This creates automatic remote code execution in the install environment.

AI rationale

This package has a concrete install-time remote payload execution path. The same-origin checksum check does not constrain a compromised or substituted release response, so the automatic postinstall behavior warrants blocking.

Evidence

package.jsonbin/ccb-npm-install.js.ccb-install.lock.ccb-release

Network endpoints1

/SeemSeam/claude_codex_bridge/releases/download/v8.6.15

Source & flagged code

5 flagged

package.jsonView file

Lines 34-72json

34 ],

35 "bin": {

36 "ccb": "bin/ccb.js",

37 "ask": "bin/ask.js",

38 "autonew": "bin/autonew.js",

39 "ctx-transfer": "bin/ctx-transfer.js"

40 },

41 "files": [

42 "bin/ccb.js",

43 "bin/ask.js",

44 "bin/autonew.js",

45 "bin/ctx-transfer.js",

46 "bin/ccb-npm-install.js",

47 "bin/ccb-npm-runner.js",

48 "README.md",

49 "README/*.md",

50 "LICENSE",

51 "VERSION"

52 ],

53 "scripts": {

54 "postinstall": "node bin/ccb-npm-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 "pack:check": "npm pack --dry-run"

56 },

57 "engines": {

58 "node": ">=18"

59 },

60 "os": [

61 "linux",

62 "darwin"

63 ],

64 "cpu": [

65 "x64",

66 "arm64"

67 ],

68 "publishConfig": {

69 "access": "public"

70 }

71}

72

bin/ask.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2"use strict";

3

4require("./ccb-npm-runner").run("ask");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ask.jsView on unpkg · L3

5

bin/ccb-npm-install.jsView file

•matchType = normalized_sha256 matchedPackage = @seemseam/ccb@8.6.16 matchedPath = bin/ccb-npm-install.js matchedIdentity = npm:QHNlZW1zZWFtL2NjYg:8.6.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ccb-npm-install.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 04a58e456c447292 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @seemseam/ccb@8.6.16 matchedPath = bin/ccb-npm-install.js matchedIdentity = npm:QHNlZW1zZWFtL2NjYg:8.6.16 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/ccb-npm-install.jsView on unpkg

bin/ccb-npm-runner.jsView file

•matchType = normalized_sha256 matchedPackage = @seemseam/ccb@8.6.16 matchedPath = bin/ccb-npm-runner.js matchedIdentity = npm:QHNlZW1zZWFtL2NjYg:8.6.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ccb-npm-runner.jsView on unpkg