registry / @seemseam/ccb / 8.7.1

@seemseam/ccb@8.7.1

Lightweight multi-agent TUI and stable cross-provider collaboration layer for Codex, Claude, Gemini, Grok, Kimi, and other CLI agents.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed attack was identified in the inspected source. The package downloads and bootstraps its own release through a transparent installer.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall or invocation of a packaged CLI command.

Impact

Installs and launches the package runtime; inspected code establishes no credential exfiltration or broad agent control mutation.

Mechanism

Downloads a versioned release and checksums, verifies the archive, extracts it, and runs runtime bootstrap with package-local installation settings.

AI rationale

The inspected executable source implements package-aligned release installation and CLI forwarding without concrete malicious behavior. Downloaded release code is outside this snapshot, which limits confidence but does not independently establish an attack.

Evidence

.ccb-release.ccb-install.lock

Network endpoints1

github.com/SeemSeam/claude_codex_bridge/releases/download/v${version}

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

@seemseam/ccb@8.7.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code