registry / bingocode / 1.1.186

bingocode@1.1.186

BingoCode - AI-powered coding assistant CLI built on Claude

AI Security Review

scanned 14h ago · by lpm-firewall-ai

Install-time lifecycle script mutates the user's Claude agent control surface by installing a package-supplied skill into ~/.claude/skills. Runtime launchers also write Bingo config under ~/.claude and may auto-install bun globally.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install runs postinstall; later user runs claude/bingo/bingocode bins

Impact

Package can persist instructions that alter future Claude behavior outside the package install directory.

Mechanism

unconsented AI-agent skill/config installation

Attack narrative

On installation, the package's postinstall script enumerates bundled .claude/skills directories and copies them into the user's Claude config directory. The installed leanchy skill contains global communication and execution protocol instructions, giving the package a persistent agent-control effect beyond normal package runtime. Runtime launchers further seed ~/.claude/bingo settings and can install bun globally.

Rationale

The concrete blocker is the unconsented lifecycle mutation of ~/.claude/skills with package-supplied agent instructions; this is not necessary for a normal npm CLI install and persists outside the package. I did not find credential exfiltration, but the install-time AI-agent control-surface write is sufficient to block.

Evidence

package.jsonscripts/install-skills.cjs.claude/skills/leanchy/SKILL.md.claude/settings.local.jsonconfig/bingo-defaults/settings.jsonbin/bingo-win.cjsbin/claudebin/bingo~/.claude/skills/leanchy/SKILL.md~/.claude/bingo/settings.json.claude/scheduled_tasks.json

Network endpoints3

127.0.0.1:3456api.anthropic.comclaude.ai

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json defines postinstall: node scripts/install-skills.cjs
scripts/install-skills.cjs copies bundled .claude/skills/* into user ~/.claude/skills or CLAUDE_CONFIG_DIR/skills during install
Bundled .claude/skills/leanchy/SKILL.md changes Claude agent behavior and response protocol globally
Package ships .claude/settings.local.json with broad Bash/Read allow rules for a specific Windows npm tree
bin/bingo and bin/bingo-win.cjs auto-install bun via npm install -g bun at runtime if missing
bin launchers write config/bingo-defaults/settings.json into ~/.claude/bingo/settings.json

Evidence against

No install-time network call found in scripts/install-skills.cjs
No credential harvesting or external exfiltration found in inspected postinstall path
Network endpoints are mostly local proxy/official Claude/Anthropic-aligned runtime functionality
Copied skill content is behavioral instruction text, not executable code
Default config contains placeholder token, not a real secret

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,172 file(s), 30.6 MB of source, external domains: 1.1.1.1, 127.0.0.1, anthropic.com, api-staging.anthropic.com, api.anthropic.com, api.example.com, api.telegram.org, app.corridor.dev, apps.apple.com, artifactory.infra.ant.dev, beacon.claude-ai.staging.ant.dev, clau.de, claude-ai.staging.ant.dev, claude-staging.fedstart.com, claude.ai, claude.com, claude.fedstart.com, cli.github.com, code.claude.com, cognitiveservices.azure.com, docs.anthropic.com, docs.claude.com, downloads.claude.ai, evil.com, example.com, fonts.googleapis.com, git-scm.com, github.com, hooks.example.com, http-intake.logs.us5.datadoghq.com, json.schemastore.org, mcp-proxy-staging.anthropic.com, mcp-proxy.anthropic.com, mcp.example.com, mcp.sentry.dev, mlaas.games.com, open.feishu.cn, platform.claude.com, platform.staging.ant.dev, play.google.com, pypi.tuna.tsinghua.edu.cn, raw.githubusercontent.com, s3-frontend.infra.ant.dev, slack.com, storage.googleapis.com, support.anthropic.com, support.claude.com, tauri.localhost, www.anthropic.com, www.apple.com

Source & flagged code

16 flagged

package.jsonView file

Lines 1-38json

2 "name": "bingocode",

3 "version": "1.1.186",

4 "type": "module",

5 "bin": {

6 "claude": "bin/claude-win.cjs",

7 "claude-linux": "bin/claude",

8 "bingocode": "bin/bingocode-win.cjs",

9 "bingo": "bin/bingo-win.cjs"

10 },

11 "scripts": {

12 "start": "bun run ./bin/bingo-win.cjs",

13 "bingo": "bun run ./bin/bingo-win.cjs",

14 "bingocode": "bun run ./bin/bingocode-win.cjs",

15 "docs:dev": "vitepress dev docs",

16 "docs:build": "vitepress build docs",

17 "docs:preview": "vitepress preview docs",

18 "postinstall": "node scripts/install-skills.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "files": [

21 "bin/",

22 "src/",

23 "scripts/",

24 "stubs/",

25 "config/",

26 ".claude/",

27 "runtime/",

28 "preload.ts",

29 "package.json",

30 "tsconfig.json",

31 "README.md",

32 "bunfig.toml"

33 ],

34 "dependencies": {

35 "@alcalzone/ansi-tokenize": "^0.3.0",

36 "@anthropic-ai/sandbox-runtime": "^0.0.44",

37 "@anthropic-ai/sdk": "^0.80.0",

38 "@aws-sdk/client-bedrock-runtime": "^3.1020.0",

src/utils/powershell/parser.tsView file

Lines 1323-1363typescript

1323 * command names like 'constructor' or '__proto__' must return undefined, not inherited

1324 * Object.prototype properties.

1325 */

1326export const COMMON_ALIASES: Record<string, string>

bin/claude-win.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require('node:child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/claude-win.cjsView on unpkg · L2

5const os =

src/utils/imagePaste.tsView file

Lines 1-22typescript

1import { feature } from 'bun:bundle'

2import { randomBytes } from 'crypto'

3import { execa } from 'execa'

4import { basename, extname, isAbsolute, join } from 'path'

High

Shell

Package source references shell execution.

src/utils/imagePaste.tsView on unpkg · L2

5import {

src/utils/plugins/mcpbHandler.tsView file

Lines 1-24typescript

1import type {

2 McpbManifest,

3 McpbUserConfigurationOption,

4} from '@anthropic-ai/mcpb'

5import axios from 'axios'

6import { createHash } from 'crypto'

7import { chmod, writeFile } from 'fs/promises'

src/utils/deepLink/registerProtocol.tsView file

Lines 20-60typescript

20import {

21 type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,

22 logEvent,

23} from 'src/services/analytics/index.js'

24import { logForDebugging } from '../debug.js'

25import { getClaudeConfigHomeDir } from '../envUtils.js'

26import { getErrnoCode } from '../errors.js'

src/utils/ide.tsView file

Lines 1334-1374typescript

1334 })

1335 } else if (isJetBrainsIde(ideType)) {

1336 // Always check installation to populate the sync cache used by status notices

1337 void isIDEExtensionInstalled(ideType).then(async installed => {

1338 if (

1339 installed &&

scripts/install-skills.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * postinstall: copy bundled skills from .claude/skills/ → ~/.claude/skills/

4 *

5 * Rules:

6 * - Skips any skill directory that already exists (never overwrites user edits).

7 * - Silently exits in CI / headless environments where $HOME is unset.

8 * - CJS so it runs on any Node version without flags or transpilation.

9 */

11'use strict'

bin/bingo-win.cjsView file

87L88: // 安装 bun（通过 npm install -g bun） L89: function installBun() { ... L92: try { L93: const npmResult = spawnSync( L94: 'npm.cmd',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bingo-win.cjsView on unpkg · L87

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.185 matchedPath = bin/bingo-win.cjs matchedIdentity = npm:YmluZ29jb2Rl:1.1.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingo-win.cjsView on unpkg

src/utils/vendor/ripgrep/x64-win32/rg.exeView file

•path = src/utils/vendor/ripgrep/x64-win32/rg.exe kind = native_binary sizeBytes = 4266496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/utils/vendor/ripgrep/x64-win32/rg.exeView on unpkg

runtime/win_helper.pyView file

•path = runtime/win_helper.py kind = build_helper sizeBytes = 26350 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/win_helper.pyView on unpkg

bin/bingocode-win.cjsView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.185 matchedPath = bin/bingocode-win.cjs matchedIdentity = npm:YmluZ29jb2Rl:1.1.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingocode-win.cjsView on unpkg

src/main.tsxView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.185 matchedPath = src/main.tsx matchedIdentity = npm:YmluZ29jb2Rl:1.1.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main.tsxView on unpkg

src/tools/SkillTool/SkillTool.tsView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.185 matchedPath = src/tools/SkillTool/SkillTool.ts matchedIdentity = npm:YmluZ29jb2Rl:1.1.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/SkillTool/SkillTool.tsView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skills.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/utils/powershell/parser.tsView file

1343patternName = generic_password severity = medium line = 1343 matchedText = pwd: '...

Medium

Secret Pattern

Package contains a possible secret pattern.

src/utils/powershell/parser.tsView on unpkg · L1343

bin/claude-win.cjsView file

2L3: const { spawn } = require('node:child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/claude-win.cjsView on unpkg · L2

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claude-win.cjsView on unpkg

src/utils/imagePaste.tsView file

2import { randomBytes } from 'crypto' L3: import { execa } from 'execa' L4: import { basename, extname, isAbsolute, join } from 'path'

High

Shell

Package source references shell execution.

src/utils/imagePaste.tsView on unpkg · L2

src/utils/plugins/mcpbHandler.tsView file

4} from '@anthropic-ai/mcpb' L5: import axios from 'axios' L6: import { createHash } from 'crypto' ... L11: import { [redacted] } from '../dxt/helpers.js' L12: import { parseZipModes, unzipFile } from '../dxt/zip.js' L13: import { errorMessage, getErrnoCode, isENOENT, toError } from '../errors.js' ... L92: */ L93: function generateContentHash(data: Uint8Array): string { L94: return createHash('sha256').update(data).digest('hex').substring(0, 16)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/plugins/mcpbHandler.tsView on unpkg · L4

src/utils/deepLink/registerProtocol.tsView file

40// in lockstep — drift here means the check returns a perpetual false. L41: const MACOS_APP_DIR = path.join(os.homedir(), 'Applications', MACOS_APP_NAME) L42: const MACOS_SYMLINK_PATH = path.join( ... L219: L220: switch (process.platform) { L221: case 'darwin': ... L276: case 'win32': { L277: const { stdout, code } = await execFileNoThrow( L278: 'reg',

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/deepLink/registerProtocol.tsView on unpkg · L40

src/utils/ide.tsView file

1354async (isIdeRunningInWindows: boolean, port: number) => { L1355: if (process.env.CLAUDE_CODE_IDE_HOST_OVERRIDE) { L1356: return process.env.CLAUDE_CODE_IDE_HOST_OVERRIDE ... L1364: // Windows, then we must use a different IP address to connect to the extension. L1365: // https://learn.microsoft.com/en-us/windows/wsl/networking L1366: try { L1367: const routeResult = await execa('ip route show | grep -i default', { L1368: shell: true,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/utils/ide.tsView on unpkg · L1354

scripts/install-skills.cjsView file

2Install-time AI-agent control hijack evidence: L2: /** L3: * postinstall: copy bundled skills from .claude/skills/ → ~/.claude/skills/ L4: * ... L20: const pkgRoot = path.resolve(__dirname, '..') L21: const srcSkillsDir = path.join(pkgRoot, '.claude', 'skills') L22: const dstSkillsDir = path.join( L23: process.env.CLAUDE_CONFIG_DIR || path.join(home, '.claude'), L24: 'skills', ... L36: try { L37: fs.mkdirSync(dst, { recursive: true }) L38: const src = path.join(srcSkillsDir, skill) L39: for (const file of fs.readdirSync(src)) { Payload evidence from src/components/mcp/MCPSettings.tsx: L149: if (servers.length === 0 && agentMcpServers.length === 0) { L150: onComplete("No MCP servers configured. Please run /doctor if this is unexpected. Otherwise, run `claude mcp --help` or visit https://code.claude.com/docs/en/mcp to learn more."); L151: } ... L397: } L398: //# sourceMappingURL=data:application/json;charset=utf-8;base64,[redacted]...

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.cjsView on unpkg · L2

bin/bingo-win.cjsView file

87L88: // 安装 bun（通过 npm install -g bun） L89: function installBun() { ... L92: try { L93: const npmResult = spawnSync( L94: 'npm.cmd',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bingo-win.cjsView on unpkg · L87

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingo-win.cjsView on unpkg

src/utils/vendor/ripgrep/x64-win32/rg.exeView file

•path = src/utils/vendor/ripgrep/x64-win32/rg.exe kind = native_binary sizeBytes = 4266496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/utils/vendor/ripgrep/x64-win32/rg.exeView on unpkg

runtime/win_helper.pyView file

•path = runtime/win_helper.py kind = build_helper sizeBytes = 26350 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/win_helper.pyView on unpkg

bin/bingocode-win.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingocode-win.cjsView on unpkg

src/main.tsxView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main.tsxView on unpkg

src/tools/SkillTool/SkillTool.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/SkillTool/SkillTool.tsView on unpkg

Findings

1 Critical10 High7 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-skills.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/claude-win.cjs

HighShellsrc/utils/imagePaste.ts

HighSame File Env Network Executionsrc/utils/ide.ts

HighRuntime Package Installbin/bingo-win.cjs

HighKnown Malware Source Similaritybin/bingo-win.cjs

HighKnown Malware Source Similaritybin/bingocode-win.cjs

HighKnown Malware Source Similaritybin/claude-win.cjs

HighKnown Malware Source Similaritysrc/main.tsx

HighKnown Malware Source Similaritysrc/tools/SkillTool/SkillTool.ts

MediumSecret Patternsrc/utils/powershell/parser.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/utils/deepLink/registerProtocol.ts

MediumShips Native Binarysrc/utils/vendor/ripgrep/x64-win32/rg.exe

MediumShips Build Helperruntime/win_helper.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/utils/plugins/mcpbHandler.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

16 flagged

package.jsonView file

Lines 1-38json

2 "name": "bingocode",

3 "version": "1.1.186",

4 "type": "module",

5 "bin": {

6 "claude": "bin/claude-win.cjs",

7 "claude-linux": "bin/claude",

8 "bingocode": "bin/bingocode-win.cjs",

9 "bingo": "bin/bingo-win.cjs"

10 },

11 "scripts": {

12 "start": "bun run ./bin/bingo-win.cjs",

13 "bingo": "bun run ./bin/bingo-win.cjs",

14 "bingocode": "bun run ./bin/bingocode-win.cjs",

15 "docs:dev": "vitepress dev docs",

16 "docs:build": "vitepress build docs",

17 "docs:preview": "vitepress preview docs",

18 "postinstall": "node scripts/install-skills.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "files": [

21 "bin/",

22 "src/",

23 "scripts/",

24 "stubs/",

25 "config/",

26 ".claude/",

27 "runtime/",

28 "preload.ts",

29 "package.json",

30 "tsconfig.json",

31 "README.md",

32 "bunfig.toml"

33 ],

34 "dependencies": {

35 "@alcalzone/ansi-tokenize": "^0.3.0",

36 "@anthropic-ai/sandbox-runtime": "^0.0.44",

37 "@anthropic-ai/sdk": "^0.80.0",

38 "@aws-sdk/client-bedrock-runtime": "^3.1020.0",

src/utils/powershell/parser.tsView file

Lines 1323-1363typescript

1323 * command names like 'constructor' or '__proto__' must return undefined, not inherited

1324 * Object.prototype properties.

1325 */

1326export const COMMON_ALIASES: Record<string, string>

bin/claude-win.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require('node:child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/claude-win.cjsView on unpkg · L2

5const os =

src/utils/imagePaste.tsView file

Lines 1-22typescript

1import { feature } from 'bun:bundle'

2import { randomBytes } from 'crypto'

3import { execa } from 'execa'

4import { basename, extname, isAbsolute, join } from 'path'

High

Shell

Package source references shell execution.

src/utils/imagePaste.tsView on unpkg · L2

5import {

src/utils/plugins/mcpbHandler.tsView file

Lines 1-24typescript

1import type {

2 McpbManifest,

3 McpbUserConfigurationOption,

4} from '@anthropic-ai/mcpb'

5import axios from 'axios'

6import { createHash } from 'crypto'

7import { chmod, writeFile } from 'fs/promises'

src/utils/deepLink/registerProtocol.tsView file

Lines 20-60typescript

20import {

21 type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,

22 logEvent,

23} from 'src/services/analytics/index.js'

24import { logForDebugging } from '../debug.js'

25import { getClaudeConfigHomeDir } from '../envUtils.js'

26import { getErrnoCode } from '../errors.js'

src/utils/ide.tsView file

Lines 1334-1374typescript

1334 })

1335 } else if (isJetBrainsIde(ideType)) {

1336 // Always check installation to populate the sync cache used by status notices

1337 void isIDEExtensionInstalled(ideType).then(async installed => {

1338 if (

1339 installed &&

scripts/install-skills.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * postinstall: copy bundled skills from .claude/skills/ → ~/.claude/skills/

4 *

5 * Rules:

6 * - Skips any skill directory that already exists (never overwrites user edits).

7 * - Silently exits in CI / headless environments where $HOME is unset.

8 * - CJS so it runs on any Node version without flags or transpilation.

9 */

11'use strict'

bin/bingo-win.cjsView file

87L88: // 安装 bun（通过 npm install -g bun） L89: function installBun() { ... L92: try { L93: const npmResult = spawnSync( L94: 'npm.cmd',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bingo-win.cjsView on unpkg · L87

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingo-win.cjsView on unpkg

src/utils/vendor/ripgrep/x64-win32/rg.exeView file

•path = src/utils/vendor/ripgrep/x64-win32/rg.exe kind = native_binary sizeBytes = 4266496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/utils/vendor/ripgrep/x64-win32/rg.exeView on unpkg

runtime/win_helper.pyView file

•path = runtime/win_helper.py kind = build_helper sizeBytes = 26350 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/win_helper.pyView on unpkg

bin/bingocode-win.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingocode-win.cjsView on unpkg

src/main.tsxView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main.tsxView on unpkg

src/tools/SkillTool/SkillTool.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/SkillTool/SkillTool.tsView on unpkg