registry / @sigloch/graphcode / 0.3.0

@sigloch/graphcode

@0.3.0

Claude Code Sidecar Harness — Graph Operations + MCP Tools + Hook System

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit CLI setup mutates the current project's Claude Code configuration and installs local hooks. No install-time mutation or exfiltration was found.

Static reason

No blocking static signals were detected.

Trigger

User runs graphcode init or graphcode update.

Impact

Can constrain Claude Code reads and writes in the initialized project.

Mechanism

First-party Claude Code skill and PreToolUse-hook scaffolding.

Rationale

The package has a real agent-control surface when explicitly scaffolded, so it warrants a warning under policy. Source inspection found no unconsented install-time activation, exfiltration, remote execution, or malicious payload.

Evidence

package.jsondist/cli.jsdist/scaffold.js.claude/settings.json.claude/hooks/deny-graph-write.sh.claude/hooks/deny-stale-prose-read.shdist/viewer/host.js.claude/hooks/deny-binary-source.sh.claude/skills.mcp.json.graphcode/

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Benign with low false-positive risk.

Evidence for warning

dist/scaffold.js: explicit init/update installs Claude PreToolUse hooks and settings into the current project.
The shipped hooks can block Claude Read/Edit/Write tool calls based on paths/content.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
dist/cli.js invokes scaffolding only for explicit graphcode init/update commands.
No external network endpoint, credential harvesting, shell execution, eval, or remote payload loading found.
Hooks are local guardrails; host binds to loopback and serves GET-only routes.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 749 KB of source, external domains: 127.0.0.1

Source & flagged code

2 flagged

.claude/hooks/deny-stale-prose-read.shView file

•path = .claude/hooks/deny-stale-prose-read.sh kind = payload_in_excluded_dir sizeBytes = 1483 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/deny-stale-prose-read.shView on unpkg

•path = .claude/hooks/deny-stale-prose-read.sh kind = build_helper sizeBytes = 1483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/deny-stale-prose-read.shView on unpkg

Source & flagged code

2 flagged · loading source

.claude/hooks/deny-stale-prose-read.shView file

•path = .claude/hooks/deny-stale-prose-read.sh kind = payload_in_excluded_dir sizeBytes = 1483 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/deny-stale-prose-read.shView on unpkg

•path = .claude/hooks/deny-stale-prose-read.sh kind = build_helper sizeBytes = 1483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/deny-stale-prose-read.shView on unpkg

Findings

1 High4 Medium4 Low

HighPayload In Excluded Dir.claude/hooks/deny-stale-prose-read.sh

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.claude/hooks/deny-stale-prose-read.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

node >=22

Artifact911 KB · 106 files1 signature(s)

Install lifecycleNo install hooks · other: build, bundle, lint, prepack +7

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

2 flagged

.claude/hooks/deny-stale-prose-read.shView file

•path = .claude/hooks/deny-stale-prose-read.sh kind = payload_in_excluded_dir sizeBytes = 1483 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/deny-stale-prose-read.shView on unpkg

•path = .claude/hooks/deny-stale-prose-read.sh kind = build_helper sizeBytes = 1483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/deny-stale-prose-read.shView on unpkg