bingocode@1.1.205

BingoCode - AI-powered coding assistant CLI built on Claude

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source inspection confirms an automatic postinstall write of a bundled Claude skill, with no guard against overwriting an existing skill. This is a guarded-scope extension lifecycle risk warranting a warning; the inspected source does not establish a broader malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm runs its postinstall hook.

Impact

The bundled skill can change Claude’s response behavior when active, and an existing skill with the same name can be overwritten.

Mechanism

The script copies files from the package’s .claude/skills directory into the user’s Claude skills directory without checking whether the destination skill already exists.

AI rationale

Evidence

package.jsonscripts/install-skills.cjs.claude/skills/leanchy/SKILL.md~/.claude/skills/leanchy/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/install-skills.cjs from postinstall.
The installer copies bundled skill files into the user’s Claude skills directory, including over existing files.
The bundled skill directs Claude’s response style while active.
The plugin handler is called by the plugin install command; it is separate from the postinstall installer.
The headless print path installs configured plugins during a CLI run.
The indicated init and insights locations describe user-facing project guidance and skill usage.
The plugin manager location loads installed plugins for display.
The inspected binary and utility locations begin with launch or import setup; those excerpts do not establish additional attack behavior.

Evidence against

The install hook copies one bundled skill directory; inspected code does not show network transfer or execution of the skill during installation.
The remaining cited locations do not establish a broader agent configuration write or a separate malicious chain.

Behavioral surface

Source

ChildProcess

Source & flagged code

16 flagged

package.jsonView file

Lines 1-38json

2 "name": "bingocode",

3 "version": "1.1.205",

4 "type": "module",

5 "bin": {

6 "claude": "bin/claude-win.cjs",

7 "claude-linux": "bin/claude",

8 "bingocode": "bin/bingocode-win.cjs",

9 "bingo": "bin/bingo-win.cjs"

10 },

11 "scripts": {

12 "start": "bun run ./bin/bingo-win.cjs",

13 "bingo": "bun run ./bin/bingo-win.cjs",

14 "bingocode": "bun run ./bin/bingocode-win.cjs",

15 "docs:dev": "vitepress dev docs",

16 "docs:build": "vitepress build docs",

17 "docs:preview": "vitepress preview docs",

18 "postinstall": "node scripts/install-skills.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "files": [

21 "bin/",

22 "src/",

23 "scripts/",

24 "stubs/",

25 "config/",

26 ".claude/",

27 "runtime/",

28 "preload.ts",

29 "package.json",

30 "tsconfig.json",

31 "README.md",

32 "bunfig.toml"

33 ],

34 "dependencies": {

35 "@alcalzone/ansi-tokenize": "^0.3.0",

36 "@anthropic-ai/sandbox-runtime": "^0.0.44",

37 "@anthropic-ai/sdk": "^0.80.0",

38 "@aws-sdk/client-bedrock-runtime": "^3.1020.0",

src/utils/powershell/parser.tsView file

Lines 1323-1363typescript

1323 * command names like 'constructor' or '__proto__' must return undefined, not inherited

1324 * Object.prototype properties.

1325 */

1326export const

bin/claude-win.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require('node:child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/claude-win.cjs

src/utils/imagePaste.tsView file

Lines 1-22typescript

1import { feature } from 'bun:bundle'

2import { randomBytes } from 'crypto'

3import { execa } from 'execa'

4import { basename, extname, isAbsolute, join } from 'path'

High

Shell

Package source references shell execution.

src/utils/imagePaste.ts

src/utils/plugins/mcpbHandler.tsView file

Lines 1-24typescript

1import type {

2 McpbManifest,

3 McpbUserConfigurationOption,

4} from '@anthropic-ai/mcpb'

5import axios from 'axios'

6import { createHash } from 'crypto'

src/entrypoints/tray-only.tsView file

Lines 1-30typescript

1/**

2 * tray-only.ts — 背景托盘入口（无 UI，系统托盘守护进程）

3 *

4 * 使用 systray2 渲染原生托盘图标，启动服务器，处理退出请求。

5 * 关闭所有 CLI 时，服务器继续运行直到用户右键 Exit 退出。

6 */

7import SysTray from 'systray2';

8import path from 'path'

src/utils/ide.tsView file

Lines 1334-1374typescript

1334 })

1335 } else if (isJetBrainsIde(ideType)) {

1336 // Always check installation to populate the sync cache used by status notices

1337 void isIDEExtensionInstalled(ideType).then(async installed => {

scripts/install-skills.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * postinstall: copy bundled skills from .claude/skills/ → ~/.claude/skills/

4 *

5 * Rules:

6 * - Skips any skill directory that already exists (never overwrites user edits).

7 * - Silently exits in CI / headless environments where $HOME is unset.

8 * - CJS so it runs on any Node version without flags or transpilation.

9 */

11'use strict'

src/utils/vendor/ripgrep/x64-win32/rg.exeView file

•path = src/utils/vendor/ripgrep/x64-win32/rg.exe kind = native_binary sizeBytes = 4266496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/utils/vendor/ripgrep/x64-win32/rg.exeView on unpkg

runtime/win_helper.pyView file

•path = runtime/win_helper.py kind = build_helper sizeBytes = 26350 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/win_helper.pyView on unpkg

bin/claudeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/claudeView on unpkg

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.203 matchedPath = bin/claude matchedIdentity = npm:YmluZ29jb2Rl:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claudeView on unpkg

bin/bingo-win.cjsView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.203 matchedPath = bin/bingo-win.cjs matchedIdentity = npm:YmluZ29jb2Rl:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingo-win.cjsView on unpkg

bin/bingocode-win.cjsView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.203 matchedPath = bin/bingocode-win.cjs matchedIdentity = npm:YmluZ29jb2Rl:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingocode-win.cjsView on unpkg

bin/bingoView file

•matchType = normalized_sha256 matchedPackage = bingocode@1.1.203 matchedPath = bin/bingo matchedIdentity = npm:YmluZ29jb2Rl:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bingoView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skills.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/utils/powershell/parser.tsView file

1343patternName = generic_password severity = medium line = 1343

Medium

Secret Pattern

Package contains a possible secret pattern.

src/utils/powershell/parser.tsView on unpkg · L1343

bin/claude-win.cjsView file

2L3: const { spawn } = require('node:child_process'); L4: const path = require('path');

High

Child Process

Findings

1 Critical10 High7 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-skills.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/claude-win.cjs

HighShellsrc/utils/imagePaste.ts

HighSame File Env Network Executionsrc/utils/ide.ts

HighSemantic Analysis Limitedbin/claude

HighKnown Malware Source Similaritybin/bingo-win.cjs

HighKnown Malware Source Similaritybin/bingocode-win.cjs

HighKnown Malware Source Similaritybin/claude-win.cjs

HighKnown Malware Source Similaritybin/claude

HighKnown Malware Source Similaritybin/bingo

MediumSecret Pattern

Affected versions and remediation

This report applies to bingocode@1.1.205.

See all versions of bingocode for other recorded verdicts.

Review the evidence and your use of bingocode@1.1.205 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 14:07:32.267Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.