registry / cac-windows / 1.0.4

cac-windows@1.0.4

Claude Code Windows environment manager — identity isolation, fingerprint spoofing, timezone alignment.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 46.7 KB of source, external domains: cac.nextmind.space, github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 1-40json

2 "name": "cac-windows",

3 "version": "1.0.4",

4 "description": "Claude Code Windows environment manager — identity isolation, fingerprint spoofing, timezone alignment.",

5 "bin": {

6 "cac": "cac"

7 },

8 "files": [

9 "cac",

10 "cac.ps1",

11 "cac.cmd",

12 "cac-dns-guard.js",

13 "fingerprint-hook.js",

14 "relay.js",

15 "scripts/postinstall.js",

16 "README.md",

17 "LICENSE"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 },

22 "keywords": [

23 "claude",

24 "claude-code",

25 "anthropic",

26 "privacy",

27 "proxy",

28 "telemetry",

29 "fingerprint",

30 "windows",

31 "powershell",

32 "timezone",

33 "cloak",

34 "cli"

35 ],

36 "author": "234150476",

37 "license": "MIT",

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/234150476/cac-windows.git"

scripts/postinstall.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2var path = require('path');

3var fs = require('fs');

5var pkgDir = path.join(__dirname,

cac.ps1View file

•path = cac.ps1 kind = build_helper sizeBytes = 34876 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cac.ps1View on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code