Loading npm security reports…

ccclub@0.8.3: AI-agent control-surface risk | LPM Firewall

registry / ccclub / 0.8.3

ccclub@0.8.3

Claude Code and Codex leaderboard among friends for coding agent tokens and costs

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the existing Claude Code control configuration without an explicit user command. It installs silent ccclub sync hooks and can repin/reload an existing macOS persistence agent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation when ~/.claude/settings.json exists; existing LaunchAgent on macOS

Impact

Claude Code session events execute ccclub sync, which collects and uploads usage data; macOS execution can recur through launchd.

Mechanism

postinstall hook injection and LaunchAgent repinning

Policy narrative

Installing the package invokes a postinstall script. Where Claude Code is configured, it rewrites the user’s Claude settings to execute a version-pinned ccclub sync command on SessionEnd and Stop. On macOS it also refreshes and reloads an existing ccclub LaunchAgent configured to run every five minutes. The resulting sync path uploads collected coding-agent usage to the configured ccclub API.

Rationale

This is unconsented install-time mutation of a foreign AI-agent control surface, meeting the block policy even though the hook is guarded and package-branded. The source also establishes silent recurring synchronization and upload behavior.

Evidence

package.jsonscripts/postinstall.cjsdist/index.js~/.claude/settings.json~/Library/LaunchAgents/dev.ccclub.sync.plist~/.ccclub/sync.log

Network endpoints

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = ccclub@0.8.2 matchedPath = dist/index.js matchedIdentity = npm:Y2NjbHVi:0.8.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = be56a4c54af6385e signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = ccclub@0.8.2 matchedPath = dist/index.js matchedIdentity = npm:Y2NjbHVi:0.8.2 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

7import { createInterface as createInterface2 } from "readline/promises"; L8: import { stdin, stdout } from "process"; L9: import chalk5 from "chalk"; ... L17: import { randomBytes } from "crypto"; L18: import { execSync } from "child_process"; L19: ... L125: var BLOCK_DURATION_MS = BLOCK_DURATION_MIN * 60 * 1e3; L126: var DEFAULT_API_URL = "https://ccclub.dev"; L127: var CLAUDE_PROJECTS_DIR = ".claude/projects"; ... L2535: function getConfigDir() { L2536: return join(homedir(), CCCLUB_CONFIG_DIR); L2537: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L7

scripts/postinstall.cjsView file

11L12: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L13: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L86: try { L87: fs.writeFileSync(tmp, data); L88: fs.renameSync(tmp, target);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L11

8Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.cjs L8: const os = require("os"); L9: const { execFileSync } = require("child_process"); L10: const pkg = require("../package.json"); L11: L12: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L13: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L34: L35: const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8")); L36: if (!settings.hooks) settings.hooks = {}; ... L139: // init/join/sync's decision, not npm's. L140: if (process.platform !== "darwin") return; L141: if (!fs.existsSync(PLIST_PATH)) return;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.cjsView on unpkg · L8

•matchType = normalized_sha256 matchedPackage = ccclub@0.8.2 matchedPath = scripts/postinstall.cjs matchedIdentity = npm:Y2NjbHVi:0.8.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity