Loading npm security reports…

@twinklerg/ccb@2.8.6: AI-agent control-surface risk | LPM Firewall

registry / @twinklerg/ccb / 2.8.6

@twinklerg/ccb@2.8.6

Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Unconsented postinstall configures a browser-native host and AI browser-control capability. It targets several user browser profiles and Windows registry keys.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install / postinstall

Impact

A package installed as ccb/claude grants a preset browser extension a native host that launches its CLI and exposes browser automation.

Mechanism

automatic Chrome MCP/native-host registration

Policy narrative

On installation, the package launches a Chrome-MCP setup command without user action. Its bundled implementation creates native-messaging manifests for a fixed extension ID across multiple browsers and adds corresponding Windows registry entries, pointing the host at this package CLI. This silently expands browser and AI-agent control capability under the package's Claude-branded commands.

Rationale

The install hook performs concrete, unconsented mutation of broad browser/AI-agent control surfaces, not merely an explicit user-command setup. The absence of observed credential exfiltration does not remove the install-time control-surface risk.

Evidence

package.jsonscripts/setup-chrome-mcp.mjsdist/chunks/setup-BUo8yVEc.jsdist/chunks/common-DPCyrmNk.jsscripts/postinstall.cjs

Network endpoints3

/microsoft/ripgrep-prebuilt/releases/download/v15.0.1

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
scripts/setup-chrome-mcp.mjs invokes register --browser chrome during install.
dist/chunks/setup-BUo8yVEc.js writes a Chrome native-host manifest for a preset extension ID.
dist/chunks/common-DPCyrmNk.js targets Chrome, Brave, Edge, Chromium, Arc, Vivaldi, and Opera native-messaging locations/registry.
The registered host launches this package CLI with --claude-in-chrome-mcp.

Evidence against

Reviewed lifecycle code shows no credential harvesting or direct secret exfiltration.
scripts/postinstall.cjs downloads ripgrep from declared GitHub/mirror URLs for package tooling.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 626 file(s), 10.4 MB of source, external domains: 1.1.1.1, 127.0.0.1, 169.254.169.254, 169.254.170.2, a.co, aka.ms, anthropic.com, api-staging.anthropic.com, api.anthropic.com, api.deepseek.com, app.corridor.dev, apps.apple.com, aws.amazon.com, beacon.claude-ai.staging.ant.dev, clau.de, claude-ai.staging.ant.dev, claude-staging.fedstart.com, claude.ai, claude.com, claude.fedstart.com, cli.github.com, code.claude.com, console.anthropic.com, docs.anthropic.com, docs.aws.amazon.com, docs.claude.com, docs.expo.dev, evil.com, example.com, fonts.googleapis.com, generativelanguage.googleapis.com, ghproxy.net, git-scm.com, github.com, grpc.io, ilinkai.weixin.qq.com, json-schema.org, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.de, login.microsoftonline.us, login.windows-ppe.net, mcp-proxy-staging.anthropic.com, mcp-proxy.anthropic.com, mcp.exa.ai, mcp.sentry.dev, metcoder.dev, novac2c.cdn.weixin.qq.com, opencollective.com, platform.claude.com

Oversized source lightweight scan

dist/chunks/loadAgentsDir-Dt65bOMO.js4.14 MB file, sampled 256 KB

ChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsevil.com

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunks/launchAutofixPr-hMOoN-eW.jsView file

1import{n as e,o as t}from"./chunk-DR8-3Aex.js";import{Rn as n,b as r,t as i,x as a}from"./src-xjrTmKB7.js";import{t as o}from"./jsx-runtime-D-D469L8.js";import{Ct as s,cn as c}from... L2: `)}`,`session_create_failed`),{display:`system`}),null}let l=fe(de(process.cwd())),d=`${a}/${o}#${s}`,f=`refs/pull/${s}/head`,p=`Auto-fix failing CI checks on PR #${s} in ${a}/${o}...

High

Child Process

Package source references child process execution.

dist/chunks/launchAutofixPr-hMOoN-eW.jsView on unpkg · L1

scripts/postinstall.cjsView file

23} = require('fs') L24: const { spawnSync } = require('child_process') L25: const { setDefaultResultOrder } = require('node:dns') L26: const path = require('path') ... L41: const RELEASE_BASE = ( L42: process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE L43: ).replace(/\/$/, '') ... L50: function getPlatformMapping() { L51: const arch = process.arch L52: const platform = process.platform ... L170: } L171: return Buffer.from(await response.arrayBuffer())

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L23

23} = require('fs') L24: const { spawnSync } = require('child_process') L25: const { setDefaultResultOrder } = require('node:dns') L26: const path = require('path') ... L41: const RELEASE_BASE = ( L42: process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE L43: ).replace(/\/$/, '') ... L50: function getPlatformMapping() { L51: const arch = process.arch L52: const platform = process.platform ... L170: } L171: return Buffer.from(await response.arrayBuffer())

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjsView on unpkg · L23

22chmodSync, L23: } = require('fs') L24: const { spawnSync } = require('child_process')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/dist-es-fjXft-jH.jsView file

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as a}from"path";import{createHash as o}fr...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/dist-es-fjXft-jH.jsView on unpkg · L1

dist/chunks/registerProtocol-Blkp2EtJ.jsView file

1import{n as e,r as t}from"./chunk-DR8-3Aex.js";import{n,s as r}from"./envUtils-BWeoiL4Y.js";import{S as i,_ as a,qa as o,so as s}from"./paths-CdLws7BQ.js";import{B as c,U as l,l as... L2: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> ... L35: MimeType=x-scheme-handler/${O}; L36: `;await T.writeFile(P(),t);let n=await m(`xdg-mime`);if(n){let{code:e}=await _(n,[`default`,K,`x-scheme-handler/${O}`],{useCwd:!1});if(e!==0)throw Object.assign(Error(`xdg-mime exi...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunks/registerProtocol-Blkp2EtJ.jsView on unpkg · L1

dist/chunks/esm-CsGLyWmS.jsView file

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from"./src-BaB-bpCj.js";import{a as c,i as... L2: `);super(`${t}\n${n}`),a(this,`errors`,void 0),this.errors=e,this.name=He}},We=class extends Error{constructor(e){super(e.message,e.cause?{cause:e.cause}:void 0),a(this,`scopes`,vo... L3: \r

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/chunks/esm-CsGLyWmS.jsView on unpkg · L1

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from"./src-BaB-bpCj.js";import{a as c,i as... L2: `);super(`${t}\n${n}`),a(this,`errors`,void 0),this.errors=e,this.name=He}},We=class extends Error{constructor(e){super(e.message,e.cause?{cause:e.cause}:void 0),a(this,`scopes`,vo... L3: \r

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/esm-CsGLyWmS.jsView on unpkg · L1

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from"./src-BaB-bpCj.js";import{a as c,i as... L2: `);super(`${t}\n${n}`),a(this,`errors`,void 0),this.errors=e,this.name=He}},We=class extends Error{constructor(e){super(e.message,e.cause?{cause:e.cause}:void 0),a(this,`scopes`,vo... L3: \r

High

dist/chunks/dist-es-DuAZyxJ02.jsView file

3- ECS container host 169.254.170.2 L4: - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:t})}}}));function y(e){return new t({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,quer... L5: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let l=new URL(t);_(l,e.logger);let d=i.create({requestTimeout:e.timeout??1e3,c...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

dist/chunks/bridgeMain-Cdp3R7Br.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @twinklerg/ccb@2.8.5 matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.5 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-Cdp3R7Br.jsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-Cdp3R7Br.js spawns dist/chunks/debug-CKOm7Hrw.js; helper contains network access plus dynamic code execution. L1: import{d as e,s as t,u as n}from"./envUtils-BWeoiL4Y.js";import{Cn as r,In as i,Ln as a,t as o}from"./src-xjrTmKB7.js";import{Fs as s,M as c,Ns as l,Ps as u,S as d,l as f,z as p}fr... L2: `).filter(e=>e.length>0)}function Le(e){let t=e.write??(e=>process.stdout.write(e)),n=e.verbose,a=0,o=`idle`,s=`Ready`,c=``,d=``,f=``,p=``,m=``,h=``,g=null,_=[],v=!1,b=null,x=0,S=0... L3: `)){if(i.length===0){n++;continue}let e=r(i);n+=Math.max(1,Math.ceil(e/t))}return e.endsWith(` L4: `)&&n--,n}function M(e){t(e),a+=j(e)}function P(){a<=0||(y(`[bridge:ui] clearStatusLines count=${a}`),t(`\x1b[${a}A`),t(`\x1B[J`),a=0)}function F(e){P(),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-Cdp3R7Br.jsView on unpkg · L1

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-Dt65bOMO.jsView file

•path = dist/chunks/loadAgentsDir-Dt65bOMO.js kind = oversized_source_file sizeBytes = 4344204 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-Dt65bOMO.jsView on unpkg

dist/chunks/REPL-DPOsR0Mc.jsView file

•matchType = token_shingles matchedPackage = opsfuse-ui@0.1.21 matchedPath = dist/icons.js matchedIdentity = npm:b3BzZnVzZS11aQ:0.1.21 similarity = 0.897 shingleOverlap = 35 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/REPL-DPOsR0Mc.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 49-89json

49 "build:vite": "vite build && bun run scripts/post-build.ts",

50 "build:vite:only": "vite build",

51 "build:bun": "bun run build.ts",

52 "dev": "bun run scripts/dev.ts",

53 "dev:inspect": "bun run scripts/dev-debug.ts",

54 "prepublishOnly": "bun run build:vite",

55 "lint": "biome lint .",

56 "lint:fix": "biome lint --fix .",

57 "format": "biome format --write .",

58 "check": "biome check .",

59 "check:fix": "biome check --fix .",

60 "prepare": "husky",

61 "test": "bun test",

62 "test:production": "bun run scripts/production-test.ts",

63 "test:production:offline": "bun run scripts/production-test.ts --offline",

64 "test:production:verbose": "bun run scripts/production-test.ts --verbose",

65 "test:production:bun": "bun run scripts/production-test.ts --bun",

66 "check:bundle": "bun run scripts/check-bundle-integrity.ts",

67 "check:unused": "knip-bun",

68 "health": "bun run scripts/health-check.ts",

69 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L69

70 "docs:dev": "npx mintlify dev",

71 "typecheck": "tsc --noEmit",

72 "precheck": "bun run typecheck && bun run check:fix && bun test",

73 "rcs": "bun run scripts/rcs.ts"

74 },

75 "dependencies": {

76 "@agentclientprotocol/sdk": "^0.19.0",

77 "@claude-code-best/mcp-chrome-bridge": "^3.0.1",

78 "highlight.js": "^11.11.1",

79 "ws": "^8.20.0"

80 },

81 "devDependencies": {

82 "@alcalzone/ansi-tokenize": "^0.3.0",

83 "@ant/claude-for-chrome-mcp": "workspace:*",

84 "@ant/computer-use-input": "workspace:*",

85 "@ant/computer-use-mcp": "workspace:*",

86 "@ant/computer-use-swift": "workspace:*",

87 "@ant/model-provider": "workspace:*",

88 "@anthropic-ai/bedrock-sdk": "^0.29.0",

89 "@anthropic-ai/claude-agent-sdk": "^0.2.114",

dist/chunks/launchAutofixPr-hMOoN-eW.jsView file

Lines 1-18javascript

1import{n as e,o as t}from"./chunk-DR8-3Aex.js";import{Rn as n,b as r,t as i,x as a}from"./src-xjrTmKB7.js";import{t as o}from"./jsx-runtime-D-D469L8.js"

scripts/postinstall.cjsView file

Lines 2-42javascript

2/**

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

12 */

dist/chunks/dist-es-fjXft-jH.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as

dist/chunks/registerProtocol-Blkp2EtJ.jsView file

Lines 1-21javascript

1import{n as e,r as t}from"./chunk-DR8-3Aex.js";import{n,s as r}from"./envUtils-BWeoiL4Y.js";import{S as i,_ as a,qa as o,so as s}from"./paths-CdLws7BQ.js"

dist/chunks/esm-CsGLyWmS.jsView file

Lines 1-21javascript

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from

dist/chunks/dist-es-DuAZyxJ02.jsView file

3- ECS container host 169.254.170.2 L4: - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:t})}}}));function y(e){return new t({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,quer... L5: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let l=new URL(t);_(l,e.logger);let d=i.create({requestTimeout:e.timeout??1e3,c...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

dist/chunks/bridgeMain-Cdp3R7Br.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @twinklerg/ccb@2.8.5 matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.5 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunks/bridgeMain-Cdp3R7Br.jsView on unpkg

1Cross-file remote execution chain: dist/chunks/bridgeMain-Cdp3R7Br.js spawns dist/chunks/debug-CKOm7Hrw.js; helper contains network access plus dynamic code execution. L1: import{d as e,s as t,u as n}from"./envUtils-BWeoiL4Y.js";import{Cn as r,In as i,Ln as a,t as o}from"./src-xjrTmKB7.js";import{Fs as s,M as c,Ns as l,Ps as u,S as d,l as f,z as p}fr... L2: `).filter(e=>e.length>0)}function Le(e){let t=e.write??(e=>process.stdout.write(e)),n=e.verbose,a=0,o=`idle`,s=`Ready`,c=``,d=``,f=``,p=``,m=``,h=``,g=null,_=[],v=!1,b=null,x=0,S=0... L3: `)){if(i.length===0){n++;continue}let e=r(i);n+=Math.max(1,Math.ceil(e/t))}return e.endsWith(` L4: `)&&n--,n}function M(e){t(e),a+=j(e)}function P(){a<=0||(y(`[bridge:ui] clearStatusLines count=${a}`),t(`\x1b[${a}A`),t(`\x1B[J`),a=0)}function F(e){P(),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-Cdp3R7Br.jsView on unpkg · L1

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-Dt65bOMO.jsView file

•path = dist/chunks/loadAgentsDir-Dt65bOMO.js kind = oversized_source_file sizeBytes = 4344204 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-Dt65bOMO.jsView on unpkg

dist/chunks/REPL-DPOsR0Mc.jsView file

•matchType = token_shingles matchedPackage = opsfuse-ui@0.1.21 matchedPath = dist/icons.js matchedIdentity = npm:b3BzZnVzZS11aQ:0.1.21 similarity = 0.897 shingleOverlap = 35 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/REPL-DPOsR0Mc.jsView on unpkg