@twinklerg/ccb@2.8.5: Suspicious npm security report (Warn)

Loading npm security reports…

@twinklerg/ccb@2.8.5: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged

package.jsonView file

Lines 49-89json

49 "build:vite": "vite build && bun run scripts/post-build.ts",

50 "build:vite:only": "vite build",

51 "build:bun": "bun run build.ts",

52 "dev": "bun run scripts/dev.ts",

53 "dev:inspect": "bun run scripts/dev-debug.ts",

54 "prepublishOnly": "bun run build:vite",

55 "lint": "biome lint .",

56 "lint:fix": "biome lint --fix .",

57 "format": "biome format --write .",

58 "check": "biome check .",

59 "check:fix": "biome check --fix .",

60 "prepare": "husky",

61 "test": "bun test",

62 "test:production": "bun run scripts/production-test.ts",

63 "test:production:offline": "bun run scripts/production-test.ts --offline",

64 "test:production:verbose": "bun run scripts/production-test.ts --verbose",

65 "test:production:bun": "bun run scripts/production-test.ts --bun",

66 "check:bundle": "bun run scripts/check-bundle-integrity.ts",

67 "check:unused": "knip-bun",

68 "health": "bun run scripts/health-check.ts",

69 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L69

70 "docs:dev": "npx mintlify dev",

71 "typecheck": "tsc --noEmit",

72 "precheck": "bun run typecheck && bun run check:fix && bun test",

73 "rcs": "bun run scripts/rcs.ts"

74 },

75 "dependencies": {

76 "@agentclientprotocol/sdk": "^0.19.0",

77 "@claude-code-best/mcp-chrome-bridge": "^3.0.1",

78 "highlight.js": "^11.11.1",

79 "ws": "^8.20.0"

80 },

81 "devDependencies": {

82 "@alcalzone/ansi-tokenize": "^0.3.0",

83 "@ant/claude-for-chrome-mcp": "workspace:*",

84 "@ant/computer-use-input": "workspace:*",

85 "@ant/computer-use-mcp": "workspace:*",

86 "@ant/computer-use-swift": "workspace:*",

87 "@ant/model-provider": "workspace:*",

88 "@anthropic-ai/bedrock-sdk": "^0.29.0",

89 "@anthropic-ai/claude-agent-sdk": "^0.2.114",

dist/chunks/protocolHandler-DRDjncTx.jsView file

Lines 1-13javascript

1import{bc as e,fc as t}from"./paths-DAR0zJ3y.js";import{E as n,O as r,l as i,p as a}from"./debug-CKOm7Hrw.js";import{n as o,t as s}

scripts/postinstall.cjsView file

Lines 2-42javascript

2/**

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

12 */

dist/chunks/dist-es-fjXft-jH.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as

dist/chunks/main-CSZrZE1o.jsView file

Lines 1-29javascript

1import{a as e,i as t,n,o as r,r as i,t as a}from"./chunk-DR8-3Aex.js";import{n as o,t as s}from"./memoize-DNnuA2aU.js";import{c,d as l,f

dist/chunks/esm-CsGLyWmS.jsView file

Lines 1-21javascript

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from

dist/chunks/dist-es-DuAZyxJ02.jsView file

3- ECS container host 169.254.170.2 L4: - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:t})}}}));function y(e){return new t({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,quer... L5: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let l=new URL(t);_(l,e.logger);let d=i.create({requestTimeout:e.timeout??1e3,c...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-w4TqBaJZ.jsView file

•path = dist/chunks/loadAgentsDir-w4TqBaJZ.js kind = oversized_source_file sizeBytes = 4344208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-w4TqBaJZ.jsView on unpkg

dist/chunks/REPL-nTtiK-bJ.jsView file

•matchType = token_shingles matchedPackage = opsfuse-ui@0.1.21 matchedPath = dist/icons.js matchedIdentity = npm:b3BzZnVzZS11aQ:0.1.21 similarity = 0.897 shingleOverlap = 35 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/REPL-nTtiK-bJ.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunks/protocolHandler-DRDjncTx.jsView file

1import{bc as e,fc as t}from"./paths-DAR0zJ3y.js";import{E as n,O as r,l as i,p as a}from"./debug-CKOm7Hrw.js";import{n as o,t as s}from"./which-BmUVj21f.js";import{r as c,t as l}fr... L2: if running then

High

Child Process

Package source references child process execution.

dist/chunks/protocolHandler-DRDjncTx.jsView on unpkg · L1

scripts/postinstall.cjsView file

23} = require('fs') L24: const { spawnSync } = require('child_process') L25: const { setDefaultResultOrder } = require('node:dns') L26: const path = require('path') ... L41: const RELEASE_BASE = ( L42: process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE L43: ).replace(/\/$/, '') ... L50: function getPlatformMapping() { L51: const arch = process.arch L52: const platform = process.platform ... L170: } L171: return Buffer.from(await response.arrayBuffer())

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L23

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjsView on unpkg · L23

22chmodSync, L23: } = require('fs') L24: const { spawnSync } = require('child_process')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/dist-es-fjXft-jH.jsView file

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as a}from"path";import{createHash as o}fr...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/dist-es-fjXft-jH.jsView on unpkg · L1

dist/chunks/main-CSZrZE1o.jsView file

9- too many long flags`):Error(`${n} L10: - unrecognised flag format`)}if(t===void 0&&n===void 0)throw Error(`option creation failed due to no flags found in '${e}'.`);return{shortFlag:t,longFlag:n}}e.Option=n,e.DualOption... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerComma... ... L18: `),this.outputHelp({error:!0}));let n=t||{},r=n.exitCode||1,i=n.code||`commander.error`;this._exit(r,i,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in o.env... L19: Expecting one of '${n.join(`', '`)}'`);let r=`${e}Help`;return this.on(r,e=>{let n;n=typeof t==`function`?t({error:e.error,command:e.command}):t,n&&e.write(`${n}\n`)}),this}_output...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/main-CSZrZE1o.jsView on unpkg · L9

1import{a as e,i as t,n,o as r,r as i,t as a}from"./chunk-DR8-3Aex.js";import{n as o,t as s}from"./memoize-DNnuA2aU.js";import{c,d as l,f as u,o as d,p as f,s as p,u as m}from"./env... L2: `)}displayWidth(e){return r(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe... ... L9: - too many long flags`):Error(`${n} L10: - unrecognised flag format`)}if(t===void 0&&n===void 0)throw Error(`option creation failed due to no flags found in '${e}'.`);return{shortFlag:t,longFlag:n}}e.Option=n,e.DualOption... L11: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerComma...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/esm-CsGLyWmS.jsView file

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from"./src-BaB-bpCj.js";import{a as c,i as... L2: `);super(`${t}\n${n}`),a(this,`errors`,void 0),this.errors=e,this.name=He}},We=class extends Error{constructor(e){super(e.message,e.cause?{cause:e.cause}:void 0),a(this,`scopes`,vo... L3: \r

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/chunks/esm-CsGLyWmS.jsView on unpkg · L1

dist/chunks/dist-es-DuAZyxJ02.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-w4TqBaJZ.jsView file

•path = dist/chunks/loadAgentsDir-w4TqBaJZ.js kind = oversized_source_file sizeBytes = 4344208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-w4TqBaJZ.jsView on unpkg

dist/chunks/REPL-nTtiK-bJ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/REPL-nTtiK-bJ.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 49-89json

49 "build:vite": "vite build && bun run scripts/post-build.ts",

50 "build:vite:only": "vite build",

51 "build:bun": "bun run build.ts",

52 "dev": "bun run scripts/dev.ts",

53 "dev:inspect": "bun run scripts/dev-debug.ts",

54 "prepublishOnly": "bun run build:vite",

55 "lint": "biome lint .",

56 "lint:fix": "biome lint --fix .",

57 "format": "biome format --write .",

58 "check": "biome check .",

59 "check:fix": "biome check --fix .",

60 "prepare": "husky",

61 "test": "bun test",

62 "test:production": "bun run scripts/production-test.ts",

63 "test:production:offline": "bun run scripts/production-test.ts --offline",

64 "test:production:verbose": "bun run scripts/production-test.ts --verbose",

65 "test:production:bun": "bun run scripts/production-test.ts --bun",

66 "check:bundle": "bun run scripts/check-bundle-integrity.ts",

67 "check:unused": "knip-bun",

68 "health": "bun run scripts/health-check.ts",

69 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L69

70 "docs:dev": "npx mintlify dev",

71 "typecheck": "tsc --noEmit",

72 "precheck": "bun run typecheck && bun run check:fix && bun test",

73 "rcs": "bun run scripts/rcs.ts"

74 },

75 "dependencies": {

76 "@agentclientprotocol/sdk": "^0.19.0",

77 "@claude-code-best/mcp-chrome-bridge": "^3.0.1",

78 "highlight.js": "^11.11.1",

79 "ws": "^8.20.0"

80 },

81 "devDependencies": {

82 "@alcalzone/ansi-tokenize": "^0.3.0",

83 "@ant/claude-for-chrome-mcp": "workspace:*",

84 "@ant/computer-use-input": "workspace:*",

85 "@ant/computer-use-mcp": "workspace:*",

86 "@ant/computer-use-swift": "workspace:*",

87 "@ant/model-provider": "workspace:*",

88 "@anthropic-ai/bedrock-sdk": "^0.29.0",

89 "@anthropic-ai/claude-agent-sdk": "^0.2.114",

dist/chunks/protocolHandler-DRDjncTx.jsView file

Lines 1-13javascript

1import{bc as e,fc as t}from"./paths-DAR0zJ3y.js";import{E as n,O as r,l as i,p as a}from"./debug-CKOm7Hrw.js";import{n as o,t as s}

scripts/postinstall.cjsView file

Lines 2-42javascript

2/**

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

12 */

dist/chunks/dist-es-fjXft-jH.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as

dist/chunks/main-CSZrZE1o.jsView file

Lines 1-29javascript

1import{a as e,i as t,n,o as r,r as i,t as a}from"./chunk-DR8-3Aex.js";import{n as o,t as s}from"./memoize-DNnuA2aU.js";import{c,d as l,f

dist/chunks/esm-CsGLyWmS.jsView file

Lines 1-21javascript

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from

dist/chunks/dist-es-DuAZyxJ02.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-w4TqBaJZ.jsView file

•path = dist/chunks/loadAgentsDir-w4TqBaJZ.js kind = oversized_source_file sizeBytes = 4344208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-w4TqBaJZ.jsView on unpkg

dist/chunks/REPL-nTtiK-bJ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/REPL-nTtiK-bJ.jsView on unpkg

@twinklerg/ccb@2.8.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code