registry / @trustbaseai/claude-collab-plugin / 0.3.7

@trustbaseai/claude-collab-plugin@0.3.7

Claude Code plugin layer for @trustbaseai/claude-collab (settings.json hooks, doctor, watch, session)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 57.3 KB of source

Source & flagged code

4 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

Source & flagged code

4 flagged · loading source

bin/claude-collab-plugin.jsView file

61// Fallback: spawn `collab-doctor --version` (or scan its --json for version). L62: const { spawnSync } = require('child_process'); L63: const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

66windowsHide: true, L67: shell: true, L68: });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

15L16: const path = require('path'); L17:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

src/plugin-doctor.jsView file

81// require() resolution issue (cwd can't see packages installed via L82: // `npm install -g`). On Windows we need `shell: true` so the shell L83: // resolves `collab-doctor` to `collab-doctor.cmd` (PATHEXT).

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/plugin-doctor.jsView on unpkg · L81

Findings

3 High3 Medium3 Low

HighChild Processbin/claude-collab-plugin.js

HighShellbin/claude-collab-plugin.js

HighRuntime Package Installsrc/plugin-doctor.js

MediumDynamic Requirebin/claude-collab-plugin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {