registry / AI-agent control-surface risk / bingocode

bingocode

BingoCode - AI-powered coding assistant CLI built on Claude

This report shows the evidence for bingocode@1.1.203. 15 of 18 known versions are blocked or flagged. The newest version, 1.1.205, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package automatically mutates the global Claude skills directory and installs instructions that take effect across Claude responses. This is unconsented install-time control-surface modification.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs postinstall.

Impact

It changes the behavior of a separate AI agent without an explicit setup command.

Mechanism

Install-time global Claude skill injection.

Policy narrative

The package's postinstall hook discovers bundled skills and copies them into the user's global Claude configuration. The installed leanchy skill instructs Claude to apply a communication protocol to every response until disabled. This automatic, persistent modification targets a broad third-party AI-agent control surface and does not require the user to run a package setup command.

AI rationale

The package automatically mutates the global Claude skills directory and installs instructions that take effect across Claude responses. This is unconsented install-time control-surface modification.

Evidence

package.jsonscripts/install-skills.cjs.claude/skills/leanchy/SKILL.md~/.claude/skills/leanchy/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The automatic postinstall hook copies a bundled skill into the user's global Claude configuration.
The copied skill says it is active for every response, creating persistent agent-output control without a user command.
The package also registers a command named claude that can shadow the expected Claude CLI when installed globally.

Evidence against

The install hook makes no network request and copies only the bundled skill file.
No runtime self-dependency is declared in the manifest.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,172 file(s), 30.6 MB of source, external domains: 1.1.1.1, 127.0.0.1, anthropic.com, api-staging.anthropic.com, api.anthropic.com, api.example.com, api.telegram.org, app.corridor.dev, apps.apple.com, artifactory.infra.ant.dev, beacon.claude-ai.staging.ant.dev, clau.de, claude-ai.staging.ant.dev, claude-staging.fedstart.com, claude.ai, claude.com, claude.fedstart.com, cli.github.com, code.claude.com, cognitiveservices.azure.com, docs.anthropic.com, docs.claude.com, downloads.claude.ai, evil.com, example.com, fonts.googleapis.com, git-scm.com, github.com, hooks.example.com, http-intake.logs.us5.datadoghq.com, json.schemastore.org, mcp-proxy-staging.anthropic.com, mcp-proxy.anthropic.com, mcp.example.com, mcp.sentry.dev, mlaas.games.com, open.feishu.cn, platform.claude.com, platform.staging.ant.dev, play.google.com, pypi.tuna.tsinghua.edu.cn, raw.githubusercontent.com, s3-frontend.infra.ant.dev, slack.com, storage.googleapis.com, support.anthropic.com, support.claude.com, tauri.localhost, www.anthropic.com, www.apple.com

Source & flagged code

16 flagged

package.jsonView file

Lines 1-38json

2 "name": "bingocode",

3 "version": "1.1.203",

4 "type": "module",

5 "bin": {

6 "claude": "bin/claude-win.cjs",

7 "claude-linux": "bin/claude",

8 "bingocode": "bin/bingocode-win.cjs",

9 "bingo": "bin/bingo-win.cjs"

10 },

11 "scripts": {

12 "start": "bun run ./bin/bingo-win.cjs",

13 "bingo": "bun run ./bin/bingo-win.cjs",

14 "bingocode": "bun run ./bin/bingocode-win.cjs",

15 "docs:dev": "vitepress dev docs",

16 "docs:build": "vitepress build docs",

17 "docs:preview": "vitepress preview docs",

18 "postinstall": "node scripts/install-skills.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "files": [

21 "bin/",

22 "src/",

23 "scripts/",

24 "stubs/",

25 "config/",

26 ".claude/",

27 "runtime/",

28 "preload.ts",

29 "package.json",

30 "tsconfig.json",

31 "README.md",

32 "bunfig.toml"

33 ],

34 "dependencies": {

35 "@alcalzone/ansi-tokenize": "^0.3.0",

36 "@anthropic-ai/sandbox-runtime": "^0.0.44",

37 "@anthropic-ai/sdk": "^0.80.0",

38 "@aws-sdk/client-bedrock-runtime": "^3.1020.0",

src/utils/powershell/parser.tsView file

Lines 1323-1363typescript

1323 * command names like 'constructor' or '__proto__' must return undefined, not inherited

1324 * Object.prototype properties.

1325 */

1326export const

bin/claude-win.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require('node:child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/claude-win.cjs

src/utils/imagePaste.tsView file

Lines 1-22typescript

1import { feature } from 'bun:bundle'

2import { randomBytes } from 'crypto'

3import { execa } from 'execa'

4import { basename, extname, isAbsolute, join } from 'path'

High

Shell

Package source references shell execution.

src/utils/imagePaste.ts

src/utils/plugins/mcpbHandler.tsView file

Lines 1-24typescript

1import type {

2 McpbManifest,

3 McpbUserConfigurationOption,

4} from '@anthropic-ai/mcpb'

5import axios from 'axios'

6import { createHash } from 'crypto'

src/entrypoints/tray-only.tsView file

Lines 1-30typescript

1/**

2 * tray-only.ts — 背景托盘入口（无 UI，系统托盘守护进程）

3 *

4 * 使用 systray2 渲染原生托盘图标，启动服务器，处理退出请求。

5 * 关闭所有 CLI 时，服务器继续运行直到用户右键 Exit 退出。

6 */

7import SysTray from 'systray2';

8import path from 'path'

src/utils/ide.tsView file

Lines 1334-1374typescript

1334 })

1335 } else if (isJetBrainsIde(ideType)) {

1336 // Always check installation to populate the sync cache used by status notices

1337 void isIDEExtensionInstalled(ideType).then(async installed => {

scripts/install-skills.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * postinstall: copy bundled skills from .claude/skills/ → ~/.claude/skills/

4 *

5 * Rules:

6 * - Skips any skill directory that already exists (never overwrites user edits).

7 * - Silently exits in CI / headless environments where $HOME is unset.

8 * - CJS so it runs on any Node version without flags or transpilation.

9 */

11'use strict'

src/utils/vendor/ripgrep/x64-win32/rg.exeView file

•path = src/utils/vendor/ripgrep/x64-win32/rg.exe kind = native_binary sizeBytes = 4266496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/utils/vendor/ripgrep/x64-win32/rg.exeView on unpkg

runtime/win_helper.pyView file

•path = runtime/win_helper.py kind = build_helper sizeBytes = 26350 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/win_helper.pyView on unpkg

src/components/ValidationErrorsList.tsxView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/components/ValidationErrorsList.tsxView on unpkg

bin/bingo-win.cjsView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.202 matchedPath = bin/bingo-win.cjs matchedIdentity = npm:YmluZ29jb2Rl:1.1.202 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingo-win.cjsView on unpkg

src/upstreamproxy/upstreamproxy.tsView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.202 matchedPath = src/upstreamproxy/upstreamproxy.ts matchedIdentity = npm:YmluZ29jb2Rl:1.1.202 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/upstreamproxy/upstreamproxy.tsView on unpkg

bin/bingocode-win.cjsView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.202 matchedPath = bin/bingocode-win.cjs matchedIdentity = npm:YmluZ29jb2Rl:1.1.202 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingocode-win.cjsView on unpkg

src/main.tsxView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.202 matchedPath = src/main.tsx matchedIdentity = npm:YmluZ29jb2Rl:1.1.202 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main.tsxView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skills.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/utils/powershell/parser.tsView file

1343patternName = generic_password severity = medium line = 1343 matchedText = pwd: '...

Medium

Secret Pattern

Package contains a possible secret pattern.

src/utils/powershell/parser.tsView on unpkg · L1343

bin/claude-win.cjsView file

2L3: const { spawn } = require('node:child_process'); L4: const path = require('path');

High

Findings

1 Critical10 High7 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-skills.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/claude-win.cjs

HighShellsrc/utils/imagePaste.ts

HighSame File Env Network Executionsrc/utils/ide.ts

HighSemantic Analysis Limitedsrc/components/ValidationErrorsList.tsx

HighKnown Malware Source Similaritybin/bingo-win.cjs

HighKnown Malware Source Similaritysrc/upstreamproxy/upstreamproxy.ts

HighKnown Malware Source Similaritybin/bingocode-win.cjs

HighKnown Malware Source Similaritybin/claude-win.cjs

HighKnown Malware Source Similaritysrc/main.tsx

Affected versions and remediation

This report applies to bingocode@1.1.203.

The versions list below shows the verdict for each recorded version.

Avoid installing bingocode@1.1.203. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-28 20:03:01.479Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

18 known versions

1.1.205latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 14, 2026, 6:49 AM 1.1.204SuspiciousAgent extension lifecycle riskWarnPublishedSep 14, 2026, 5:23 AM 1.1.203shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 17, 2026, 6:51 AM 1.1.202MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 13, 2026, 2:48 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages