registry / cac-windows / 1.0.23

cac-windows@1.0.23

Claude Code Windows environment manager — identity isolation, fingerprint spoofing, timezone alignment.

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 54.1 KB of source, external domains: cac.nextmind.space, github.com, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

Lines 2-42json

2 "name": "cac-windows",

3 "version": "1.0.23",

4 "description": "Claude Code Windows environment manager — identity isolation, fingerprint spoofing, timezone alignment.",

5 "bin": {

6 "cac": "cac"

7 },

8 "files": [

9 "cac",

10 "cac.ps1",

11 "cac.cmd",

12 "cac-dns-guard.js",

13 "fingerprint-hook.js",

14 "relay.js",

15 "scripts/postinstall.js",

16 "scripts/patch-cli.js",

17 "scripts/cleanup.ps1",

18 "README.md",

19 "LICENSE"

20 ],

21 "scripts": {

22 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "keywords": [

25 "claude",

26 "claude-code",

27 "anthropic",

28 "privacy",

29 "proxy",

30 "telemetry",

31 "fingerprint",

32 "windows",

33 "powershell",

34 "timezone",

35 "cloak",

36 "cli"

37 ],

38 "author": "234150476",

39 "license": "MIT",

40 "repository": {

41 "type": "git",

42 "url": "git+https://github.com/234150476/cac-windows.git"

fingerprint-hook.jsView file

Lines 1-27javascript

1// This file is injected via NODE_OPTIONS="--require /path/to/fingerprint-hook.js"

2// It monkey-patches Node.js system APIs to return spoofed device identifiers.

3// Reads from CAC_HOSTNAME, CAC_MAC, CAC_MACHINE_ID, CAC_USERNAME env vars.

4// Works on macOS, Linux, and Windows.

6const os = require('os');

7const fs

scripts/postinstall.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2var path = require('path');

3var fs = require('fs');

5var pkgDir = path.join(__dirname,

cac.ps1View file

•path = cac.ps1 kind = build_helper sizeBytes = 36994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cac.ps1View on unpkg

cac-dns-guard.jsView file

•matchType = normalized_sha256 matchedPackage = cac-windows@1.0.11 matchedPath = cac-dns-guard.js matchedIdentity = npm:Y2FjLXdpbmRvd3M:1.0.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cac-dns-guard.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code