registry / AI-agent control-surface risk / @tyroneross/coding-debugger
@tyroneross/coding-debugger
Coding Debugger for Claude Code and Codex: debugging memory, verdict-first retrieval, root-cause workflows, context compression, and parallel assessment.
This report shows the evidence for @tyroneross/coding-debugger@1.9.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an unconsented install-time mutation of a foreign AI-agent control surface, with persistent automatic execution of another registry package. The absence of observed secret theft does not remove the concrete control-hijack chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall during package installation
Impact
Changes agent behavior, injects commands and instructions, and executes an external package whenever a Claude session ends.
Mechanism
Automatic Claude control-surface writes and persistent npx session hook
Policy narrative
On npm installation, postinstall targets the consumer project and creates Claude memory data, command files, hooks, and CLAUDE.md content. The installed Stop hook runs npx @tyroneross/claude-code-debugger automatically at each session end. The package name differs from the package being fetched and executed, while bundled update material reinforces installing that external latest release and rerunning setup.
AI rationale
This is an unconsented install-time mutation of a foreign AI-agent control surface, with persistent automatic execution of another registry package. The absence of observed secret theft does not remove the concrete control-hijack chain.
Evidence
package.jsondist/src/setup/auto-setup.jsdist/src/setup/create-slash-commands.jsdist/src/setup/inject-claude-md.jsdist/src/setup/configure-hooks.jsdist/cli/index.jscommands/update.md.claude/memory/.claude/commands/.claude/settings.jsonCLAUDE.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The postinstall hook automatically runs setup in the consuming project.
- Setup creates Claude memory directories, installs slash commands, configures hooks, and alters CLAUDE.md without a user command.
- It writes a Claude Stop hook that runs npx for a different package name on every agent session end.
- Bundled update instructions and CLI install @tyroneross/claude-code-debugger@latest and rerun its setup.
Evidence against
- No credential harvesting or direct data exfiltration was found in the inspected JavaScript.
- The CLI update path prompts unless its explicit --yes option is used.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/src/setup/auto-setup.js || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/src/setup/auto-setup.js || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli/index.jsView file
270.action(async (options) => {
L271: const { exec } = await Promise.resolve().then(() => __importStar(require('child_process')));
L272: console.log('\n💬 Claude Code Debugger - Feedback');
High
Child Process
Package source references child process execution.
dist/cli/index.jsView on unpkg · L270Findings
1 Critical6 High4 Medium5 Low
CriticalAi Agent Control Hijackdist/src/setup/auto-setup.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli/index.js
HighShell
HighExternal Ai Agent Control Surface Mutationdist/cli/index.js
HighRuntime Package Installdist/cli/index.js
HighSemantic Analysis Limiteddist/package.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @tyroneross/coding-debugger@1.9.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @tyroneross/coding-debugger@1.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.