Loading npm security reports…

ccclub@0.9.3: Malicious npm security report (Block) | LPM Firewall

registry / ccclub / 0.9.3

ccclub@0.9.3

Claude Code and Codex leaderboard among friends for coding agent tokens and costs

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Installing the package mutates an existing Claude Code control file to run ccclub automatically at session end and stop. It also refreshes an existing macOS background agent that repeatedly runs ccclub through npx.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation on a machine with Claude Code settings or the package's existing macOS LaunchAgent.

Impact

Future agent events and login/background execution can fetch and run the specified ccclub release without a separate user command.

Mechanism

Install-time AI-agent hook mutation and background command persistence.

Attack narrative

The postinstall lifecycle runs automatically. If Claude Code settings exist, it inserts ccclub commands for SessionEnd and Stop; those commands use npx with a package version. On macOS, if the ccclub LaunchAgent exists, postinstall replaces and reloads it so it runs npx ccclub sync every 300 seconds and at load. This is unconsented install-time mutation of an AI-agent control surface plus persistent execution.

AI rationale

The package establishes automatic hooks during postinstall in a foreign AI-agent settings file and retains a background npx execution path. These are concrete install-hook and persistence behaviors, not merely an explicit user-command setup.

Evidence

package.jsonscripts/postinstall.cjs~/.claude/settings.json~/Library/LaunchAgents/dev.ccclub.sync.plist

Network endpoints1

registry.npmjs.org

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

7import { createInterface as createInterface2 } from "readline/promises"; L8: import { stdin, stdout } from "process"; L9: import chalk5 from "chalk"; ... L17: import { randomBytes } from "crypto"; L18: import { execSync } from "child_process"; L19: ... L127: var BLOCK_DURATION_MS = BLOCK_DURATION_MIN * 60 * 1e3; L128: var DEFAULT_API_URL = "https://ccclub.dev"; L129: var CLAUDE_PROJECTS_DIR = ".claude/projects"; ... L2551: function getConfigDir() { L2552: return join(homedir(), CCCLUB_CONFIG_DIR); L2553: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = ccclub@0.9.5 matchedPath = dist/index.js matchedIdentity = npm:Y2NjbHVi:0.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

7import { createInterface as createInterface2 } from "readline/promises"; L8: import { stdin, stdout } from "process"; L9: import chalk5 from "chalk"; ... L17: import { randomBytes } from "crypto"; L18: import { execSync } from "child_process"; L19: ... L127: var BLOCK_DURATION_MS = BLOCK_DURATION_MIN * 60 * 1e3; L128: var DEFAULT_API_URL = "https://ccclub.dev"; L129: var CLAUDE_PROJECTS_DIR = ".claude/projects"; ... L2551: function getConfigDir() { L2552: return join(homedir(), CCCLUB_CONFIG_DIR); L2553: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L7

scripts/postinstall.cjsView file

11L12: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L13: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L86: try { L87: fs.writeFileSync(tmp, data); L88: fs.renameSync(tmp, target);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L11

8Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.cjs L8: const os = require("os"); L9: const { execFileSync } = require("child_process"); L10: const pkg = require("../package.json"); L11: L12: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L13: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L34: L35: const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8")); L36: if (!settings.hooks) settings.hooks = {}; ... L139: // init/join/sync's decision, not npm's. L140: if (process.platform !== "darwin") return; L141: if (!fs.existsSync(PLIST_PATH)) return;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.cjsView on unpkg · L8

•matchType = normalized_sha256 matchedPackage = ccclub@0.8.3 matchedPath = scripts/postinstall.cjs matchedIdentity = npm:Y2NjbHVi:0.8.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source & flagged code

9 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "ccclub",

3 "version": "0.9.3",

4 "type": "module",

5 "description": "Claude Code and Codex leaderboard among friends for coding agent tokens and costs",

6 "bin": {

7 "ccclub": "dist/index.js",

8 "ccclub-statusline": "dist/statusline-cli.js"

9 },

10 "files": [

11 "dist",

12 "scripts"

13 ],

14 "scripts": {

15 "build": "tsup",

16 "prepublishOnly": "npm run build",

17 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "dev": "tsx src/index.ts",

19 "test": "vitest run"

20 },

21 "dependencies": {

22 "chalk": "^5.3.0",

23 "cli-table3": "^0.6.5",

24 "commander": "^12.1.0",

25 "glob": "^13.0.6",

26 "ora": "^8.1.0"

27 },

28 "devDependencies": {

29 "@ccclub/shared": "workspace:*",

30 "@types/node": "^22.0.0",

31 "tsup": "^8.3.0",

32 "tsx": "^4.19.0",

33 "typescript": "^5.7.0",

34 "vitest": "^4.0.18"

35 },

36 "keywords": [

37 "claude",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/index.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3// src/index.ts

4import { Command, Option } from "commander";

5

6// src/commands/init.ts

7import { createInterface as createInterface2 } from "readline/promises";

8import

scripts/postinstall.cjsView file

Lines 1-31javascript

1// Runs on every npm install. Re-pins the background entrypoints (Claude Code

2// hooks and, on macOS, the heartbeat LaunchAgent) to the version being

3// installed, so `npm i -g ccclub@latest` upgrades everything in one command.

4// Without the LaunchAgent half, a still-old heartbeat would keep rewriting the

5// hooks back to its own version every 5 minutes until the user ran ccclub.

6const fs = require("fs");

7const