registry / @tangjianfang/claudecode-statusline / 1.0.2

@tangjianfang/claudecode-statusline@1.0.2

Custom status line for Claude Code: shows model, output TPS, token/cost totals, git branch and context usage, plus an opt-in auto-continue loop and a pricing updater

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 49.6 KB of source, external domains: raw.githubusercontent.com

Source & flagged code

5 flagged

package.jsonView file

Lines 4-44json

4 "description": "Custom status line for Claude Code: shows model, output TPS, token/cost totals, git branch and context usage, plus an opt-in auto-continue loop and a pricing updater",

5 "main": "statusline.js",

6 "bin": {

7 "cc-statusline": "statusline.js",

8 "loopctl": "loopctl.js",

9 "pricing-updater": "pricing-updater.js"

10 },

11 "files": [

12 "statusline.js",

13 "loopctl.js",

14 "pricing-updater.js",

15 "pricing.json",

16 "scripts/postinstall.js",

17 "install.bat",

18 "install-loopctl.bat",

19 "README.md",

20 "LICENSE"

21 ],

22 "scripts": {

23 "check": "node --check statusline.js && node --check loopctl.js && node --check pricing-updater.js && node --check scripts/postinstall.js",

24 "install": "node statusline.js --install && node loopctl.js --install",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "install-statusline": "node statusline.js --install",

26 "install-loopctl": "node loopctl.js --install",

27 "update-pricing": "node pricing-updater.js",

28 "pricing:list": "node pricing-updater.js --list",

29 "presets": "node loopctl.js presets",

30 "demo": "node -e \"process.stdout.write('{}')\" | node statusline.js",

31 "demo:subagent": "node -e \"process.stdout.write(JSON.stringify({tasks:[{id:'t1',name:'Explore',tokenCount:100,startTime:'2026-01-01T00:00:00Z'}]}))\" | node statusline.js",

32 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

33 },

34 "keywords": [

35 "claude-code",

36 "claude",

37 "anthropic",

38 "statusline",

39 "status-line",

40 "cli",

41 "terminal",

42 "cost",

43 "tokens",

44 "auto-continue",

loopctl.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// Turns Claude Code's Stop hook into an opt-in auto-continue loop: while enabled,

3// every time Claude is about to stop, this script blocks the stop and feeds back a

4// "what's next?" prompt instead, up to a configured number of rounds. State lives

5// per-project in <project>/.claude/loop-state.json so it's off by default everywhere

6// and has to be turned on explicitly in each project you want it in.

7//

8// Modes (process.argv):

9// --install copy this file to ~/.claude/loopctl.js and register it as a Stop hook

10// --hook read Claude Code's Stop-hook JSON from stdin, decide whether to continue

install.batView file

•path = install.bat kind = build_helper sizeBytes = 329 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.batView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

@tangjianfang/claudecode-statusline@1.0.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code