Loading npm security reports…

@tangjianfang/cc-statusline@2.0.0: AI-agent control-surface risk | LPM Firewall

registry / @tangjianfang/cc-statusline / 2.0.0

@tangjianfang/cc-statusline@2.0.0

Custom status line for Claude Code: shows model, output TPS, token/cost totals, git branch, context usage and prompt-cache health, plus a pricing updater

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic npm installation changes the user's global Claude Code command configuration without interactive consent. Existing status command registrations can be replaced.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs the package's postinstall lifecycle hook.

Impact

Future Claude Code sessions execute the installed package script through replaced global command registrations; selected Stop hooks are also removed.

Mechanism

Postinstall launches setup with --yes, automatically approves overwrite prompts, and persists statusLine and subagentStatusLine command settings in ~/.claude/settings.json.

Policy narrative

The automatic postinstall hook launches statusline.js with --install and --yes. Setup copies its script into the user's Claude configuration directory and replaces global status command registrations, saving settings.json. The supplied flag bypasses existing-command overwrite prompts. Postinstall additionally removes matching Stop hook registrations. This establishes unconsented install-time mutation of another product's global agent control surface, irrespective of the status display's legitimate purpose.

AI rationale

The source proves automatic install-time mutation of global Claude Code command settings with consent prompts bypassed. This meets the supplied blocking policy for a foreign AI-agent control surface.

Evidence

package.jsonscripts/postinstall.jsstatusline.js~/.claude/settings.json~/.claude/statusline.js~/.claude/pricing.json~/.claude/loopctl.js~/.claude/loop-state.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node statusline.js --install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

statusline.jsView file

96// Load the pricing table from pricing.json next to this script. After L97: // `--install` that's ~/.claude/pricing.json; run from the repo it's the repo's L98: // ./pricing.json. Best-effort: missing/invalid file → {} (cost falls back to ... L226: async function installStatusLine() { L227: const claudeDir = path.join(os.homedir(), '.claude'); L228: const targetScript = path.join(claudeDir, 'statusline.js'); ... L231: L232: fs.mkdirSync(claudeDir, { recursive: true }); L233: ... L246: if (copyScript) { L247: fs.writeFileSync(targetScript, sourceContent); L248: console.log(`Installed statusline.js to ${targetScript}`);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

statusline.jsView on unpkg · L96

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: subagentstatusline (${currentsubagentcommand}), replace it with ${desiredcommand}?` ); } if (writesubagent) { settings.subagentstatusline = { ...settings.subagentstatusline, type: 'command', command: desiredcommand }; changed = true; } else { console.log('update to subagentstatusline cancelled.'); } } if (changed) { fs.writefilesync(settingspath, json.stringify(settings, null, 2)); console.log(`updated ${settingspath}`); } }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

statusline.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

statusline.jsView on unpkg

9L10: const fs = require('fs'); L11: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

statusline.jsView on unpkg · L9

install.shView file

•path = install.sh kind = build_helper sizeBytes = 387 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 3-43json

3 "version": "2.0.0",

4 "description": "Custom status line for Claude Code: shows model, output TPS, token/cost totals, git branch, context usage and prompt-cache health, plus a pricing updater",

5 "main": "statusline.js",

6 "bin": {

7 "cc-statusline": "statusline.js",

8 "pricing-updater": "pricing-updater.js"

9 },

10 "files": [

11 "statusline.js",

12 "pricing-updater.js",

13 "pricing.json",

14 "scripts/postinstall.js",

15 "install.bat",

16 "install.sh",

17 "README.md",

18 "LICENSE",

19 "docs/"

20 ],

21 "scripts": {

22 "check": "node --check statusline.js && node --check pricing-updater.js && node --check scripts/postinstall.js",

23 "install": "node statusline.js --install",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "update-pricing": "node pricing-updater.js",

25 "pricing:list": "node pricing-updater.js --list",

26 "demo": "node -e \"process.stdout.write('{}')\" | node statusline.js",

27 "demo:subagent": "node -e \"const s=new Date(Date.now()-5*60*1000).toISOString();process.stdout.write(JSON.stringify({tasks:[{id:'t1',name:'Explore',type:'Explore',status:'running',tokenCount:50000,contextWindowSize:200000,startTime:s,effort:'high'},{id:'t2',name:'fix-bug',type:'general-purpose',status:'completed',tokenCount:120000,contextWindowSize:200000,startTime:s,effort:'medium'}]}))\" | node statusline.js",

28 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

29 },

30 "keywords": [

31 "claude-code",

32 "claude",

33 "anthropic",

34 "statusline",

35 "status-line",

36 "cli",

37 "terminal",

38 "cost",

39 "tokens",

40 "cost-tracking",

41 "token-counter",

42 "tps",

43 "pricing",

statusline.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Claude Code status line: shows model + output tokens/sec (TPS) of the last response,

3// plus session cost/usage context. Also doubles as a subagentStatusLine renderer: when

4// stdin contains a `tasks` array (the shape Claude Code uses for subagent rows) instead

5// of the main session fields, it renders one line per subagent row instead.

6// Claude Code pipes session JSON on stdin, but token/timing data for the main status

7// line is NOT in that JSON, so we parse the transcript file (transcript_path) to

8// compute TPS there. Subagent rows carry their own tokenCount/startTime instead.

9

10const

install.shView file

•path = install.sh kind = build_helper sizeBytes = 387 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Lines 76-116javascript

76function formatCost(value) {

77 return `$${Number(value || 0).toFixed(2)}`;

78}

79

80// --- Transparent per-model cost estimation ---

81// The status line used to display data.cost.total_cost_usd verbatim, but that

82// value is Claude Code's client-side estimate priced at Anthropic's rates —

83// wrong when you route to a third-party model (e.g. MiniMax via

84// ANTHROPIC_BASE_URL). Instead we compute cost ourselves from the token counts

85// already parsed from the transcript, using a public, editable pricing table.

86//

87// The table lives in `pricing.json` next to this script (one file, the single

88// source of truth — maintained in the repo, shipped to users). All rates are

89// USD per 1,000,000 tokens, shape: { "<model>": { in, out, cacheRead, cacheWrite } }.

90// Keys match first by exact name, then by longest case-insensitive substring

91// (so "claude-sonnet-5-20250514" matches "claude-sonnet-5"). When no entry

92// matches the current model, cost falls back to data.cost.total_cost_usd and is

93// labeled "~cost?:" to flag that it's the untrusted client estimate rather than

94// a self-computed figure. Refresh the file with `node pricing-updater.js`.

95

96// Load the pricing table from pricing.json next to this script. After

97// `--install` that's ~/.claude/pricing.json; run from the repo it's the repo's

98// ./pricing.json. Best-effort: missing/invalid file → {} (cost falls back to

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

statusline.jsView on unpkg · L96

99// the client estimate). Never writes — pricing-updater.js owns updates.

100function loadPricing() {

101 try {

102 const file = path.join(__dirname, 'pricing.json');

103 if (!fs.existsSync(file)) return {};

104 const obj = JSON.parse(fs.readFileSync(file, 'utf8'));

105 return obj && typeof obj === 'object' ? obj : {};

106 } catch {

107 return {};

108 }

109}

110

111// Resolve a pricing entry for a model name: exact match → longest substring

112// match → null (no entry). The longest-match rule prevents a short key from

113// shadowing a more specific one when several keys match.

114function resolvePricing(model, table) {

115 if (!model) return null;

116 if (table[model]) return table[model];