registry / @trustbaseai/claude-collab-plugin / 0.2.0

@trustbaseai/claude-collab-plugin@0.2.0

Claude Code plugin layer for @trustbaseai/claude-collab (settings.json hooks, doctor, watch, session)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 41.8 KB of source

Source & flagged code

4 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

Source & flagged code

4 flagged · loading source

bin/claude-collab-plugin.jsView file

61// Fallback: spawn `collab-doctor --version` (or scan its --json for version). L62: const { spawnSync } = require('child_process'); L63: const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

66windowsHide: true, L67: shell: true, L68: });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

15L16: const path = require('path'); L17:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

src/plugin-doctor.jsView file

81// require() resolution issue (cwd can't see packages installed via L82: // `npm install -g`). On Windows we need `shell: true` so the shell L83: // resolves `collab-doctor` to `collab-doctor.cmd` (PATHEXT).

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/plugin-doctor.jsView on unpkg · L81

Findings

3 High2 Medium3 Low

HighChild Processbin/claude-collab-plugin.js

HighShellbin/claude-collab-plugin.js

HighRuntime Package Installsrc/plugin-doctor.js

MediumDynamic Requirebin/claude-collab-plugin.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {