Loading npm security reports…

ccclub: AI-agent control-surface risk | LPM Firewall

registry / ccclub / 0.9.7

ccclub@0.9.7

Claude Code and Codex leaderboard among friends for coding agent tokens and costs

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic install hook modifies the user's Claude Code configuration. It installs commands that run ccclub after Claude Code events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm post-install execution when the settings file exists.

Impact

Installing the package can add persistent automatic execution to a third-party AI-agent control surface without an explicit setup command.

Mechanism

The script inserts managed SessionEnd and Stop hooks and writes the Claude Code settings file; it can also update an existing macOS launch agent.

Policy narrative

The package automatically runs a post-install script. When Claude Code configuration is present, that script adds ccclub sync commands to SessionEnd and Stop hooks and saves the modified configuration. This creates automatic execution in a foreign AI-agent control surface during package installation. It also updates an existing macOS launch agent that repeatedly invokes ccclub sync.

AI rationale

The automatic post-install mutation of Claude Code hooks is an unconsented modification of a broad AI-agent control surface. This meets the install-control-surface block policy.

Evidence

package.jsonscripts/postinstall.cjs.claude/settings.jsonLibrary/LaunchAgents/dev.ccclub.sync.plist

Decision evidence

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

7import { createInterface as createInterface2 } from "readline/promises"; L8: import { stdin, stdout } from "process"; L9: import chalk5 from "chalk"; ... L17: import { randomBytes } from "crypto"; L18: import { execSync } from "child_process"; L19: ... L127: var BLOCK_DURATION_MS = BLOCK_DURATION_MIN * 60 * 1e3; L128: var DEFAULT_API_URL = "https://ccclub.dev"; L129: var CLAUDE_PROJECTS_DIR = ".claude/projects"; ... L2551: function getConfigDir() { L2552: return join(homedir(), CCCLUB_CONFIG_DIR); L2553: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = ccclub@0.9.3 matchedPath = dist/index.js matchedIdentity = npm:Y2NjbHVi:0.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5e022d4d9fa07ee9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = ccclub@0.9.6 matchedPath = dist/index.js matchedIdentity = npm:Y2NjbHVi:0.9.6 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

7import { createInterface as createInterface2 } from "readline/promises"; L8: import { stdin, stdout } from "process"; L9: import chalk5 from "chalk"; ... L17: import { randomBytes } from "crypto"; L18: import { execSync } from "child_process"; L19: ... L127: var BLOCK_DURATION_MS = BLOCK_DURATION_MIN * 60 * 1e3; L128: var DEFAULT_API_URL = "https://ccclub.dev"; L129: var CLAUDE_PROJECTS_DIR = ".claude/projects"; ... L2551: function getConfigDir() { L2552: return join(homedir(), CCCLUB_CONFIG_DIR); L2553: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L7

scripts/postinstall.cjsView file

13L14: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L15: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L172: try { L173: fs.writeFileSync(tmp, data); L174: fs.renameSync(tmp, target);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L13

10Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.cjs L10: const os = require("os"); L11: const { execFileSync } = require("child_process"); L12: const pkg = require("../package.json"); L13: L14: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L15: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L127: L128: const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8")); L129: if (!settings.hooks) settings.hooks = {}; ... L225: // init/join/sync's decision, not npm's. L226: if (process.platform !== "darwin") return; L227: if (!fs.existsSync(PLIST_PATH)) return;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.cjsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = ccclub@0.9.5 matchedPath = scripts/postinstall.cjs matchedIdentity = npm:Y2NjbHVi:0.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

dist/statusline-cli.jsView file

•matchType = normalized_sha256 matchedPackage = ccclub@0.9.6 matchedPath = dist/statusline-cli.js matchedIdentity = npm:Y2NjbHVi:0.9.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/statusline-cli.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "ccclub",

3 "version": "0.9.7",

4 "type": "module",

5 "description": "Claude Code and Codex leaderboard among friends for coding agent tokens and costs",

6 "bin": {

7 "ccclub": "dist/index.js",

8 "ccclub-statusline": "dist/statusline-cli.js"

9 },

10 "files": [

11 "dist",

12 "scripts"

13 ],

14 "scripts": {

15 "build": "tsup",

16 "prepublishOnly": "npm run build",

17 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "dev": "tsx src/index.ts",

19 "test": "vitest run"

20 },

21 "dependencies": {

22 "chalk": "^5.3.0",

23 "cli-table3": "^0.6.5",

24 "commander": "^12.1.0",

25 "glob": "^13.0.6",

26 "ora": "^8.1.0"

27 },

28 "devDependencies": {

29 "@ccclub/shared": "workspace:*",

30 "@types/node": "^22.0.0",

31 "tsup": "^8.3.0",

32 "tsx": "^4.19.0",

33 "typescript": "^5.7.0",

34 "vitest": "^4.0.18"

35 },

36 "keywords": [

37 "claude",

dist/index.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3// src/index.ts

4import { Command, Option } from "commander";

5

6// src/commands/init.ts

7import { createInterface as createInterface2 } from "readline/promises";

8import

scripts/postinstall.cjsView file

Lines 1-33javascript

1// Runs on every npm install. Re-pins the background entrypoints (Claude Code

2// hooks and, on macOS, the heartbeat LaunchAgent) to the version being

3// installed, so `npm i -g ccclub@latest` upgrades everything in one command.

4// An already-newer pin is left alone: a leftover older package must not

5// rewrite 0.9.x back to itself. Without the LaunchAgent half, a still-old

6// heartbeat would keep rewriting the hooks back to its own version every 5

7// minutes until the user ran ccclub.

8const fs = require

dist/statusline-cli.jsView file

•matchType = normalized_sha256 matchedPackage = ccclub@0.9.6 matchedPath = dist/statusline-cli.js matchedIdentity = npm:Y2NjbHVi:0.9.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/statusline-cli.jsView on unpkg