registry / AI-agent control-surface risk / @twinklerg/ccb

@twinklerg/ccb

Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal

This report shows the evidence for @twinklerg/ccb@2.8.6. 1 of 2 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The install hook performs concrete, unconsented mutation of broad browser/AI-agent control surfaces, not merely an explicit user-command setup. The absence of observed credential exfiltration does not remove the install-time control-surface risk.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install / postinstall

Impact

A package installed as ccb/claude grants a preset browser extension a native host that launches its CLI and exposes browser automation.

Mechanism

automatic Chrome MCP/native-host registration

Policy narrative

On installation, the package launches a Chrome-MCP setup command without user action. Its bundled implementation creates native-messaging manifests for a fixed extension ID across multiple browsers and adds corresponding Windows registry entries, pointing the host at this package CLI. This silently expands browser and AI-agent control capability under the package's Claude-branded commands.

AI rationale

Evidence

package.jsonscripts/setup-chrome-mcp.mjsdist/chunks/setup-BUo8yVEc.jsdist/chunks/common-DPCyrmNk.jsscripts/postinstall.cjs

Network endpoints3

github.com/microsoft/ripgrep-prebuilt/releases/download/v15.0.1ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v15.0.1clau.de/chrome/reconnect

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
scripts/setup-chrome-mcp.mjs invokes register --browser chrome during install.
dist/chunks/setup-BUo8yVEc.js writes a Chrome native-host manifest for a preset extension ID.
dist/chunks/common-DPCyrmNk.js targets Chrome, Brave, Edge, Chromium, Arc, Vivaldi, and Opera native-messaging locations/registry.
The registered host launches this package CLI with --claude-in-chrome-mcp.

Evidence against

Reviewed lifecycle code shows no credential harvesting or direct secret exfiltration.
scripts/postinstall.cjs downloads ripgrep from declared GitHub/mirror URLs for package tooling.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

17 flagged

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunks/launchAutofixPr-hMOoN-eW.jsView file

1import{n as e,o as t}from"./chunk-DR8-3Aex.js";import{Rn as n,b as r,t as i,x as a}from"./src-xjrTmKB7.js";import{t as o}from"./jsx-runtime-D-D469L8.js";import{Ct as s,cn as c}from... L2: `)}`,`session_create_failed`),{display:`system`}),null}let l=fe(de(process.cwd())),d=`${a}/${o}#${s}`,f=`refs/pull/${s}/head`,p=`Auto-fix failing CI checks on PR #${s} in ${a}/${o}...

High

Child Process

Package source references child process execution.

dist/chunks/launchAutofixPr-hMOoN-eW.jsView on unpkg · L1

scripts/postinstall.cjsView file

23} = require('fs') L24: const { spawnSync } = require('child_process') L25: const { setDefaultResultOrder } = require('node:dns') L26: const path = require('path') ... L41: const RELEASE_BASE = ( L42: process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE L43: ).replace(/\/$/, '') ... L50: function getPlatformMapping() { L51: const arch = process.arch L52: const platform = process.platform ... L170: } L171: return Buffer.from(await response.arrayBuffer())

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L23

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjsView on unpkg · L23

22chmodSync, L23: } = require('fs') L24: const { spawnSync } = require('child_process')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/dist-es-fjXft-jH.jsView file

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as a}from"path";import{createHash as o}fr...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/dist-es-fjXft-jH.jsView on unpkg · L1

dist/chunks/registerProtocol-Blkp2EtJ.jsView file

1import{n as e,r as t}from"./chunk-DR8-3Aex.js";import{n,s as r}from"./envUtils-BWeoiL4Y.js";import{S as i,_ as a,qa as o,so as s}from"./paths-CdLws7BQ.js";import{B as c,U as l,l as... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> ... L35: MimeType=x-scheme-handler/${O}; L36: `;await T.writeFile(P(),t);let n=await m(`xdg-mime`);if(n){let{code:e}=await _(n,[`default`,K,`x-scheme-handler/${O}`],{useCwd:!1});if(e!==0)throw Object.assign(Error(`xdg-mime exi...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunks/registerProtocol-Blkp2EtJ.jsView on unpkg · L1

dist/chunks/esm-CsGLyWmS.jsView file

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from"./src-BaB-bpCj.js";import{a as c,i as... L2: `);super(`${t}\n${n}`),a(this,`errors`,void 0),this.errors=e,this.name=He}},We=class extends Error{constructor(e){super(e.message,e.cause?{cause:e.cause}:void 0),a(this,`scopes`,vo... L3: \r

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/chunks/esm-CsGLyWmS.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/esm-CsGLyWmS.jsView on unpkg · L1

High

dist/chunks/dist-es-DuAZyxJ02.jsView file

3- ECS container host 169.254.170.2 L4: - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:t})}}}));function y(e){return new t({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,quer... L5: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let l=new URL(t);_(l,e.logger);let d=i.create({requestTimeout:e.timeout??1e3,c...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

dist/chunks/bridgeMain-Cdp3R7Br.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @twinklerg/ccb@2.8.5 matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.5 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-Cdp3R7Br.jsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-Cdp3R7Br.js spawns dist/chunks/debug-CKOm7Hrw.js; helper contains network access plus dynamic code execution. L1: import{d as e,s as t,u as n}from"./envUtils-BWeoiL4Y.js";import{Cn as r,In as i,Ln as a,t as o}from"./src-xjrTmKB7.js";import{Fs as s,M as c,Ns as l,Ps as u,S as d,l as f,z as p}fr... L2: `).filter(e=>e.length>0)}function Le(e){let t=e.write??(e=>process.stdout.write(e)),n=e.verbose,a=0,o=`idle`,s=`Ready`,c=``,d=``,f=``,p=``,m=``,h=``,g=null,_=[],v=!1,b=null,x=0,S=0... L3: `)){if(i.length===0){n++;continue}let e=r(i);n+=Math.max(1,Math.ceil(e/t))}return e.endsWith(` L4: `)&&n--,n}function M(e){t(e),a+=j(e)}function P(){a<=0||(y(`[bridge:ui] clearStatusLines count=${a}`),t(`\x1b[${a}A`),t(`\x1B[J`),a=0)}function F(e){P(),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-Cdp3R7Br.jsView on unpkg · L1

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-Dt65bOMO.jsView file

•path = dist/chunks/loadAgentsDir-Dt65bOMO.js kind = oversized_source_file sizeBytes = 4344204 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-Dt65bOMO.jsView on unpkg

dist/chunks/REPL-DPOsR0Mc.jsView file

•matchType = token_shingles matchedPackage = opsfuse-ui@0.1.21 matchedPath = dist/icons.js matchedIdentity = npm:b3BzZnVzZS11aQ:0.1.21 similarity = 0.897 shingleOverlap = 35 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/REPL-DPOsR0Mc.jsView on unpkg

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunks/launchAutofixPr-hMOoN-eW.jsView file

Findings

2 Critical10 High9 Medium9 Low

CriticalBrowser Credential Phishingdist/chunks/esm-CsGLyWmS.js

CriticalPrevious Version Dangerous Deltadist/chunks/bridgeMain-Cdp3R7Br.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunks/launchAutofixPr-hMOoN-eW.js

HighShell

HighSame File Env Network Executiondist/chunks/esm-CsGLyWmS.js

HighCommand Output Exfiltrationdist/chunks/esm-CsGLyWmS.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs

HighCloud Metadata Accessdist/chunks/dist-es-DuAZyxJ02.js

HighInstall Named Payload Filescripts/postinstall.cjs

HighCross File Remote Execution Contextdist/chunks/bridgeMain-Cdp3R7Br.js

Affected versions and remediation

This report applies to @twinklerg/ccb@2.8.6.

The versions list below shows the verdict for each recorded version.

Avoid installing @twinklerg/ccb@2.8.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-08 05:31:08.748Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

2.8.6latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 8, 2026, 5:12 AM 2.8.5SuspiciousAgent extension lifecycle riskWarnPublishedAug 8, 2026, 2:18 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code