Loading npm security reports…

@tangjianfang/claudecode-statusline: AI-agent control-surface | LPM Firewall

registry / @tangjianfang/claudecode-statusline / 2.0.0

@tangjianfang/claudecode-statusline@2.0.0

Custom status line for Claude Code: shows model, output TPS, token/cost totals, git branch, context usage and prompt-cache health, plus a pricing updater

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic npm installation replaces Claude Code command registrations in global agent settings. The postinstall caller bypasses the installer's overwrite prompts.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation with lifecycle scripts enabled.

Impact

Existing agent status-line commands can be displaced without user consent, causing Claude Code to execute the installed renderer on subsequent status updates.

Mechanism

The postinstall script passes --install --yes; the installer accepts replacement prompts and persists package commands in settings.json.

Policy narrative

During npm installation, the postinstall script launches the status-line installer with automatic confirmation enabled. The installer copies its renderer into the user's .claude directory and replaces existing status-line command registrations in global Claude Code settings. Although the renderer serves the package's advertised purpose, the lifecycle caller removes the consent barrier for modifying another agent's control surface.

AI rationale

Source proves unconsented npm lifecycle mutation of global Claude Code command settings, including replacement of existing commands. This meets the supplied blocking rule independently of credential theft or remote payload execution.

Evidence

package.jsonscripts/postinstall.jsstatusline.js.claude/settings.json.claude/statusline.js.claude/pricing.json.claude/loopctl.js

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node statusline.js --install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

statusline.jsView file

96// Load the pricing table from pricing.json next to this script. After L97: // `--install` that's ~/.claude/pricing.json; run from the repo it's the repo's L98: // ./pricing.json. Best-effort: missing/invalid file → {} (cost falls back to ... L226: async function installStatusLine() { L227: const claudeDir = path.join(os.homedir(), '.claude'); L228: const targetScript = path.join(claudeDir, 'statusline.js'); ... L231: L232: fs.mkdirSync(claudeDir, { recursive: true }); L233: ... L246: if (copyScript) { L247: fs.writeFileSync(targetScript, sourceContent); L248: console.log(`Installed statusline.js to ${targetScript}`);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

statusline.jsView on unpkg · L96

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: subagentstatusline (${currentsubagentcommand}), replace it with ${desiredcommand}?` ); } if (writesubagent) { settings.subagentstatusline = { ...settings.subagentstatusline, type: 'command', command: desiredcommand }; changed = true; } else { console.log('update to subagentstatusline cancelled.'); } } if (changed) { fs.writefilesync(settingspath, json.stringify(settings, null, 2)); console.log(`updated ${settingspath}`); } }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

statusline.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

statusline.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @tangjianfang/cc-statusline@2.0.0 matchedPath = statusline.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

statusline.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 70668cc4c0cabd42 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tangjianfang/cc-statusline@2.0.0 matchedPath = statusline.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

statusline.jsView on unpkg

9L10: const fs = require('fs'); L11: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

statusline.jsView on unpkg · L9

install.shView file

•path = install.sh kind = build_helper sizeBytes = 387 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

pricing-updater.jsView file

•matchType = normalized_sha256 matchedPackage = @tangjianfang/cc-statusline@2.0.0 matchedPath = pricing-updater.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

pricing-updater.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 3-43json

3 "version": "2.0.0",

4 "description": "Custom status line for Claude Code: shows model, output TPS, token/cost totals, git branch, context usage and prompt-cache health, plus a pricing updater",

5 "main": "statusline.js",

6 "bin": {

7 "cc-statusline": "statusline.js",

8 "pricing-updater": "pricing-updater.js"

9 },

10 "files": [

11 "statusline.js",

12 "pricing-updater.js",

13 "pricing.json",

14 "scripts/postinstall.js",

15 "install.bat",

16 "install.sh",

17 "README.md",

18 "LICENSE",

19 "docs/"

20 ],

21 "scripts": {

22 "check": "node --check statusline.js && node --check pricing-updater.js && node --check scripts/postinstall.js",

23 "install": "node statusline.js --install",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "update-pricing": "node pricing-updater.js",

25 "pricing:list": "node pricing-updater.js --list",

26 "demo": "node -e \"process.stdout.write('{}')\" | node statusline.js",

27 "demo:subagent": "node -e \"const s=new Date(Date.now()-5*60*1000).toISOString();process.stdout.write(JSON.stringify({tasks:[{id:'t1',name:'Explore',type:'Explore',status:'running',tokenCount:50000,contextWindowSize:200000,startTime:s,effort:'high'},{id:'t2',name:'fix-bug',type:'general-purpose',status:'completed',tokenCount:120000,contextWindowSize:200000,startTime:s,effort:'medium'}]}))\" | node statusline.js",

28 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

29 },

30 "keywords": [

31 "claude-code",

32 "claude",

33 "anthropic",

34 "statusline",

35 "status-line",

36 "cli",

37 "terminal",

38 "cost",

39 "tokens",

40 "cost-tracking",

41 "token-counter",

42 "tps",

43 "pricing",

statusline.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Claude Code status line: shows model + output tokens/sec (TPS) of the last response,

3// plus session cost/usage context. Also doubles as a subagentStatusLine renderer: when

4// stdin contains a `tasks` array (the shape Claude Code uses for subagent rows) instead

5// of the main session fields, it renders one line per subagent row instead.

6// Claude Code pipes session JSON on stdin, but token/timing data for the main status

7// line is NOT in that JSON, so we parse the transcript file (transcript_path) to

8// compute TPS there. Subagent rows carry their own tokenCount/startTime instead.

9

10const

install.shView file

•path = install.sh kind = build_helper sizeBytes = 387 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

pricing-updater.jsView file

•matchType = normalized_sha256 matchedPackage = @tangjianfang/cc-statusline@2.0.0 matchedPath = pricing-updater.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

pricing-updater.jsView on unpkg

Lines 76-116javascript

76function formatCost(value) {

77 return `$${Number(value || 0).toFixed(2)}`;

78}

79

80// --- Transparent per-model cost estimation ---

81// The status line used to display data.cost.total_cost_usd verbatim, but that

82// value is Claude Code's client-side estimate priced at Anthropic's rates —

83// wrong when you route to a third-party model (e.g. MiniMax via

84// ANTHROPIC_BASE_URL). Instead we compute cost ourselves from the token counts

85// already parsed from the transcript, using a public, editable pricing table.

86//

87// The table lives in `pricing.json` next to this script (one file, the single

88// source of truth — maintained in the repo, shipped to users). All rates are

89// USD per 1,000,000 tokens, shape: { "<model>": { in, out, cacheRead, cacheWrite } }.

90// Keys match first by exact name, then by longest case-insensitive substring

91// (so "claude-sonnet-5-20250514" matches "claude-sonnet-5"). When no entry

92// matches the current model, cost falls back to data.cost.total_cost_usd and is

93// labeled "~cost?:" to flag that it's the untrusted client estimate rather than

94// a self-computed figure. Refresh the file with `node pricing-updater.js`.

95

96// Load the pricing table from pricing.json next to this script. After

97// `--install` that's ~/.claude/pricing.json; run from the repo it's the repo's

98// ./pricing.json. Best-effort: missing/invalid file → {} (cost falls back to

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

statusline.jsView on unpkg · L96

99// the client estimate). Never writes — pricing-updater.js owns updates.

100function loadPricing() {

101 try {

102 const file = path.join(__dirname, 'pricing.json');

103 if (!fs.existsSync(file)) return {};

104 const obj = JSON.parse(fs.readFileSync(file, 'utf8'));

105 return obj && typeof obj === 'object' ? obj : {};

106 } catch {

107 return {};

108 }

109}

110

111// Resolve a pricing entry for a model name: exact match → longest substring

112// match → null (no entry). The longest-match rule prevents a short key from

113// shadowing a more specific one when several keys match.

114function resolvePricing(model, table) {

115 if (!model) return null;

116 if (table[model]) return table[model];