registry / AI-agent control-surface risk / @tangjianfang/cc-statusline

@tangjianfang/cc-statusline

Custom status line for Claude Code: shows model, output TPS, token/cost totals, git branch, context usage and prompt-cache health, plus a pricing updater

This report shows the evidence for @tangjianfang/cc-statusline@2.0.0, the only known version.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The source proves automatic install-time mutation of global Claude Code command settings with consent prompts bypassed. This meets the supplied blocking policy for a foreign AI-agent control surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs the package's postinstall lifecycle hook.

Impact

Future Claude Code sessions execute the installed package script through replaced global command registrations; selected Stop hooks are also removed.

Mechanism

Postinstall launches setup with --yes, automatically approves overwrite prompts, and persists statusLine and subagentStatusLine command settings in ~/.claude/settings.json.

Policy narrative

The automatic postinstall hook launches statusline.js with --install and --yes. Setup copies its script into the user's Claude configuration directory and replaces global status command registrations, saving settings.json. The supplied flag bypasses existing-command overwrite prompts. Postinstall additionally removes matching Stop hook registrations. This establishes unconsented install-time mutation of another product's global agent control surface, irrespective of the status display's legitimate purpose.

AI rationale

The source proves automatic install-time mutation of global Claude Code command settings with consent prompts bypassed. This meets the supplied blocking policy for a foreign AI-agent control surface.

Evidence

package.jsonscripts/postinstall.jsstatusline.js~/.claude/settings.json~/.claude/statusline.js~/.claude/pricing.json~/.claude/loopctl.js~/.claude/loop-state.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json automatically executes scripts/postinstall.js after installation.
The postinstall script invokes statusline.js setup with --install and --yes.
The --yes option makes overwrite prompts resolve to approval without user input.
Setup writes command registrations for both status displays into the user's global Claude Code settings.json.
Postinstall also filters Stop hook registrations and saves the modified global settings.

Evidence against

The installed commands implement the package's status display functionality.
The pricing updater fetches pricing data and writes a pricing cache; inspected code does not establish credential exfiltration.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

8 flagged

package.jsonView file

Lines 3-43json

3 "version": "2.0.0",

4 "description": "Custom status line for Claude Code: shows model, output TPS, token/cost totals, git branch, context usage and prompt-cache health, plus a pricing updater",

5 "main": "statusline.js",

6 "bin": {

7 "cc-statusline": "statusline.js",

8 "pricing-updater": "pricing-updater.js"

9 },

10 "files": [

11 "statusline.js",

12 "pricing-updater.js",

13 "pricing.json",

14 "scripts/postinstall.js",

15 "install.bat",

16 "install.sh",

17 "README.md",

18 "LICENSE",

19 "docs/"

20 ],

21 "scripts": {

22 "check": "node --check statusline.js && node --check pricing-updater.js && node --check scripts/postinstall.js",

23 "install": "node statusline.js --install",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "update-pricing": "node pricing-updater.js",

25 "pricing:list": "node pricing-updater.js --list",

26 "demo": "node -e \"process.stdout.write('{}')\" | node statusline.js",

27 "demo:subagent": "node -e \"const s=new Date(Date.now()-5*60*1000).toISOString();process.stdout.write(JSON.stringify({tasks:[{id:'t1',name:'Explore',type:'Explore',status:'running',tokenCount:50000,contextWindowSize:200000,startTime:s,effort:'high'},{id:'t2',name:'fix-bug',type:'general-purpose',status:'completed',tokenCount:120000,contextWindowSize:200000,startTime:s,effort:'medium'}]}))\" | node statusline.js",

28 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

29 },

30 "keywords": [

31 "claude-code",

32 "claude",

33 "anthropic",

34 "statusline",

35 "status-line",

36 "cli",

37 "terminal",

38 "cost",

39 "tokens",

40 "cost-tracking",

41 "token-counter",

42 "tps",

43 "pricing",

statusline.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Claude Code status line: shows model + output tokens/sec (TPS) of the last response,

3// plus session cost/usage context. Also doubles as a subagentStatusLine renderer: when

4// stdin contains a `tasks` array (the shape Claude Code uses for subagent rows) instead

5// of the main session fields, it renders one line per subagent row instead.

6// Claude Code pipes session JSON on stdin, but token/timing data for the main status

7// line is NOT in that JSON, so we parse the transcript file (transcript_path) to

8// compute TPS there. Subagent rows carry their own tokenCount/startTime instead.

10const

install.shView file

•path = install.sh kind = build_helper sizeBytes = 387 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node statusline.js --install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

statusline.jsView file

Findings

1 Critical3 High7 Medium4 Low

CriticalAi Agent Control Hijackstatusline.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationstatusline.js

HighSemantic Analysis Limitedstatusline.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirestatusline.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @tangjianfang/cc-statusline@2.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @tangjianfang/cc-statusline@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 15:39:27.370Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

2.0.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 30, 2026, 3:32 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @tangjianfang

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

More from @tangjianfang

Other AI-agent control-surface risk packages

Source & flagged code