registry / @specship/specship-darwin-x64 / 0.12.1

@specship/specship-darwin-x64@0.12.1

SpecShip self-contained bundle for darwin-x64

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious install-time attack surface. The package is an AI/code-intelligence CLI that can user-invoked install SpecShip into Claude Code with MCP, permissions, hooks, commands, and an agent.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs specship with no args or specship install; optional watcher fallback can add git hooks.

Impact

Adds SpecShip MCP/tools and auto-sync behavior to Claude/project configuration; residual agent extension lifecycle risk but not unconsented npm lifecycle hijack.

Mechanism

User-invoked Claude Code extension and local sync hook setup

Policy narrative

A user-invoked install path modifies Claude Code control surfaces for SpecShip: MCP server registration, auto-allowed SpecShip MCP tools, optional status line, slash commands, a SpecShip subagent, and sync hooks. These are package-aligned and reversible, with prompts or explicit flags; there is no npm lifecycle trigger or evidence of exfiltration or remote payload execution.

Rationale

Static inspection confirms risky agent-extension behavior, but it is activated by explicit CLI use rather than npm install and is aligned to the package's advertised SpecShip/Claude functionality. Downgrade to warn for agent extension lifecycle risk instead of blocking as malicious.

Evidence

package.jsonbin/specshiplib/dist/bin/specship.jslib/dist/installer/index.jslib/dist/installer/targets/claude.jslib/dist/installer/targets/shared.jslib/dist/sync/git-hooks.jslib/dist/health/smoke-check.js~/.claude.json./.mcp.json~/.claude/settings.json./.claude/settings.json~/.claude/commands/specship/*.md./.claude/commands/specship/*.md~/.claude/agents/specship-explorer.md./.claude/agents/specship-explorer.md./CLAUDE.md.git/hooks/post-commit.git/hooks/post-merge.git/hooks/post-checkout

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

lib/dist/installer/targets/claude.js writes Claude MCP config, permissions, hooks, commands, and an agent during user-invoked install.
lib/dist/installer/targets/claude.js can add auto-sync Claude hooks: PostToolUse and SessionStart run specship sync commands.
lib/dist/sync/git-hooks.js can install marked git hooks to run specship sync in the background when watcher fallback is chosen.

Evidence against

package.json has no npm lifecycle scripts, so behavior is not triggered by package install.
lib/dist/bin/specship.js runs installer only when the specship CLI is invoked with no args or via specship install.
MCP config is package-aligned: command specship args serve --mcp, no remote payload or @latest registration observed.
Claude commands/agent files are copied from package assets and scoped to specship names.
No credential harvesting or exfiltration endpoints found in inspected installer/CLI paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 207 file(s), 2.55 MB of source, external domains: 127.0.0.1, claude.ai, docs.claude.com, github.com

Source & flagged code

8 flagged

lib/dist/health/smoke-check.jsView file

Lines 36-76javascript

36 };

37 return ownKeys(o);

38 };

39 return function (mod) {

40 if (mod && mod.__esModule) return mod;

41 var result = {};

42 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

43 __setModuleDefault(result, mod);

44 return result;

45 };

46})();

47Object.defineProperty(exports, "__esModule", { value: true });

48exports.probeBackend = probeBackend;

49exports.probeFts5 = probeFts5;

50exports.probeMcpBoot = probeMcpBoot;

51exports.probeIndexQueryable = probeIndexQueryable;

52exports.runSmokeCheck = runSmokeCheck;

53exports.doctorExitCode = doctorExitCode;

54const fs = __importStar(require("fs"));

55const os = __importStar(require("os"));

56const path = __importStar(require("path"));

57const child_process_1 = require("child_process");

58const sqlite_adapter_1 = require("../db/sqlite-adapter");

High

Child Process

Package source references child process execution.

lib/dist/health/smoke-check.jsView on unpkg · L56

59const directory_1 = require("../directory");

60const FTS5_REMEDIATION = 'Use the published bundle (node 24 with FTS5) or, when running from source, ' +

61 '`npm install --save-dev better-sqlite3` so FTS5 works on a host Node built without it.';

62/** Open a throwaway SQLite db, hand it to `fn`, then clean up the file + WAL/SHM. */

63function withTempDb(fn) {

64 const tmp = path.join(os.tmpdir(), `specship-smoke-${process.pid}-${process.hrtime.bigint()}.db`);

65 let created;

66 try {

67 created = (0, sqlite_adapter_1.createDatabase)(tmp);

68 return fn(created);

69 }

70 finally {

71 try {

72 created?.db.close();

73 }

74 catch {

75 /* best effort */

76 }

lib/dist/bin/specship.jsView file

Lines 227-267javascript

227 const files = fs.readdirSync(path.join(claudeRoot, slug), { withFileTypes: true });

228 for (const f of files) {

229 if (!f.isFile() || !f.name.toLowerCase().

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1 = require("fs");

Medium

lib/dist/designer/cdp-ensure.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

lib/dist/installer/index.jsView file

Lines 105-145javascript

105 // only have one target to write.

106 if (opts.target !== undefined

107 && !['claude', 'auto', 'all'].includes(opts.target)) {

108 throw new Error(`Unknown --target value "${opts.target

nodeView file

•path = node kind = native_binary sizeBytes = 122894848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

nodeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

Source & flagged code

8 flagged · loading source

lib/dist/health/smoke-check.jsView file

56const path = __importStar(require("path")); L57: const child_process_1 = require("child_process"); L58: const sqlite_adapter_1 = require("../db/sqlite-adapter");

High

Child Process

Package source references child process execution.

lib/dist/health/smoke-check.jsView on unpkg · L56

lib/dist/bin/specship.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @specship/specship-darwin-x64@0.11.8 matchedIdentity = npm:[redacted]:0.11.8 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/dist/bin/specship.jsView on unpkg

247// eslint-disable-next-line @typescript-eslint/no-implied-eval L248: const importESM = new Function('specifier', 'return import(specifier)'); L249: // Block SpecShip on Node.js 25.x — V8's turboshaft WASM JIT has a Zone

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/dist/bin/specship.jsView on unpkg · L247

lib/dist/ui/shimmer-worker.jsView file

2Object.defineProperty(exports, "__esModule", { value: true }); L3: const worker_threads_1 = require("worker_threads"); L4: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/dist/ui/shimmer-worker.jsView on unpkg · L2

lib/dist/designer/cdp-ensure.jsView file

9const node_path_1 = __importDefault(require("node:path")); L10: const node_child_process_1 = require("node:child_process"); L11: const cross_platform_1 = require("./cross-platform"); L12: const cdp_env_1 = require("./cdp-env"); L13: const PORT = process.env.DESIGNER_CDP || '9222'; L14: const PROFILE = node_path_1.default.join(node_os_1.default.homedir(), '.chrome-designer-profile'); ... L17: try { L18: const res = await fetch(`http://127.0.0.1:${PORT}/json/version`, { signal: AbortSignal.timeout(1500) }); L19: return res.ok;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/dist/designer/cdp-ensure.jsView on unpkg · L9

lib/dist/installer/index.jsView file

125try { L126: (0, child_process_1.execSync)('npm install -g @specship/specship', { stdio: 'pipe', windowsHide: true }); L127: s.stop('Installed specship CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dist/installer/index.jsView on unpkg · L125

nodeView file

•path = node kind = native_binary sizeBytes = 122894848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

nodeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg

Findings

1 Critical4 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltalib/dist/bin/specship.js

HighChild Processlib/dist/health/smoke-check.js

HighShell

HighSame File Env Network Executionlib/dist/designer/cdp-ensure.js

HighRuntime Package Installlib/dist/installer/index.js

MediumDynamic Requirelib/dist/ui/shimmer-worker.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarynode

MediumShips Wasm Modulelib/dist/extraction/wasm/tree-sitter-scala.wasm

MediumStructural Risk Force Deep Review

LowEvallib/dist/bin/specship.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

lib/dist/health/smoke-check.jsView file

Lines 36-76javascript

36 };

37 return ownKeys(o);

38 };

39 return function (mod) {

40 if (mod && mod.__esModule) return mod;

41 var result = {};

42 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

43 __setModuleDefault(result, mod);

44 return result;

45 };

46})();

47Object.defineProperty(exports, "__esModule", { value: true });

48exports.probeBackend = probeBackend;

49exports.probeFts5 = probeFts5;

50exports.probeMcpBoot = probeMcpBoot;

51exports.probeIndexQueryable = probeIndexQueryable;

52exports.runSmokeCheck = runSmokeCheck;

53exports.doctorExitCode = doctorExitCode;

54const fs = __importStar(require("fs"));

55const os = __importStar(require("os"));

56const path = __importStar(require("path"));

57const child_process_1 = require("child_process");

58const sqlite_adapter_1 = require("../db/sqlite-adapter");

High

Child Process

Package source references child process execution.

lib/dist/health/smoke-check.jsView on unpkg · L56

59const directory_1 = require("../directory");

60const FTS5_REMEDIATION = 'Use the published bundle (node 24 with FTS5) or, when running from source, ' +

61 '`npm install --save-dev better-sqlite3` so FTS5 works on a host Node built without it.';

62/** Open a throwaway SQLite db, hand it to `fn`, then clean up the file + WAL/SHM. */

63function withTempDb(fn) {

64 const tmp = path.join(os.tmpdir(), `specship-smoke-${process.pid}-${process.hrtime.bigint()}.db`);

65 let created;

66 try {

67 created = (0, sqlite_adapter_1.createDatabase)(tmp);

68 return fn(created);

69 }

70 finally {

71 try {

72 created?.db.close();

73 }

74 catch {

75 /* best effort */

76 }

lib/dist/bin/specship.jsView file

Lines 227-267javascript

227 const files = fs.readdirSync(path.join(claudeRoot, slug), { withFileTypes: true });

228 for (const f of files) {

229 if (!f.isFile() || !f.name.toLowerCase().

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1 = require("fs");

Medium

lib/dist/designer/cdp-ensure.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

lib/dist/installer/index.jsView file

Lines 105-145javascript

105 // only have one target to write.

106 if (opts.target !== undefined

107 && !['claude', 'auto', 'all'].includes(opts.target)) {

108 throw new Error(`Unknown --target value "${opts.target

nodeView file

•path = node kind = native_binary sizeBytes = 122894848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

nodeView on unpkg

lib/dist/extraction/wasm/tree-sitter-scala.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-scala.wasm kind = wasm_module sizeBytes = 4958320 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-scala.wasmView on unpkg