Loading npm security reports…

ccclub@0.9.5: AI-agent control-surface risk | LPM Firewall

registry / ccclub / 0.9.5

ccclub@0.9.5

Claude Code and Codex leaderboard among friends for coding agent tokens and costs

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package mutates an existing Claude Code configuration to add automatic commands. On macOS it can also replace and reload a persistent LaunchAgent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install runs postinstall.

Impact

Claude Code events can automatically invoke a version-pinned package command; the LaunchAgent can invoke it every five minutes.

Mechanism

Install-time AI-agent hook injection and LaunchAgent persistence.

Policy narrative

The manifest invokes scripts/postinstall.cjs during installation. That script edits an existing Claude Code settings file to add SessionEnd and Stop hooks that run npx --yes ccclub@0.9.5 sync --silent. On macOS, when an existing dev.ccclub.sync LaunchAgent is present, it replaces the plist and reloads it; the generated agent runs the same command every 300 seconds. These changes occur without an explicit setup command from the user.

AI rationale

This is an unconsented postinstall mutation of a foreign AI-agent control surface, with persistent automatic command execution. The existence checks limit targets but do not remove the install-time control-surface takeover.

Evidence

package.jsonscripts/postinstall.cjs~/.claude/settings.json~/Library/LaunchAgents/dev.ccclub.sync.plist

Decision evidence

public snapshot

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

7import { createInterface as createInterface2 } from "readline/promises"; L8: import { stdin, stdout } from "process"; L9: import chalk5 from "chalk"; ... L17: import { randomBytes } from "crypto"; L18: import { execSync } from "child_process"; L19: ... L127: var BLOCK_DURATION_MS = BLOCK_DURATION_MIN * 60 * 1e3; L128: var DEFAULT_API_URL = "https://ccclub.dev"; L129: var CLAUDE_PROJECTS_DIR = ".claude/projects"; ... L2551: function getConfigDir() { L2552: return join(homedir(), CCCLUB_CONFIG_DIR); L2553: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = ccclub@0.9.6 matchedPath = dist/index.js matchedIdentity = npm:Y2NjbHVi:0.9.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

7import { createInterface as createInterface2 } from "readline/promises"; L8: import { stdin, stdout } from "process"; L9: import chalk5 from "chalk"; ... L17: import { randomBytes } from "crypto"; L18: import { execSync } from "child_process"; L19: ... L127: var BLOCK_DURATION_MS = BLOCK_DURATION_MIN * 60 * 1e3; L128: var DEFAULT_API_URL = "https://ccclub.dev"; L129: var CLAUDE_PROJECTS_DIR = ".claude/projects"; ... L2551: function getConfigDir() { L2552: return join(homedir(), CCCLUB_CONFIG_DIR); L2553: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L7

scripts/postinstall.cjsView file

13L14: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L15: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L172: try { L173: fs.writeFileSync(tmp, data); L174: fs.renameSync(tmp, target);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L13

10Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.cjs L10: const os = require("os"); L11: const { execFileSync } = require("child_process"); L12: const pkg = require("../package.json"); L13: L14: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L15: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L127: L128: const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8")); L129: if (!settings.hooks) settings.hooks = {}; ... L225: // init/join/sync's decision, not npm's. L226: if (process.platform !== "darwin") return; L227: if (!fs.existsSync(PLIST_PATH)) return;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.cjsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = ccclub@0.9.6 matchedPath = scripts/postinstall.cjs matchedIdentity = npm:Y2NjbHVi:0.9.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source & flagged code

9 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "ccclub",

3 "version": "0.9.5",

4 "type": "module",

5 "description": "Claude Code and Codex leaderboard among friends for coding agent tokens and costs",

6 "bin": {

7 "ccclub": "dist/index.js",

8 "ccclub-statusline": "dist/statusline-cli.js"

9 },

10 "files": [

11 "dist",

12 "scripts"

13 ],

14 "scripts": {

15 "build": "tsup",

16 "prepublishOnly": "npm run build",

17 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "dev": "tsx src/index.ts",

19 "test": "vitest run"

20 },

21 "dependencies": {

22 "chalk": "^5.3.0",

23 "cli-table3": "^0.6.5",

24 "commander": "^12.1.0",

25 "glob": "^13.0.6",

26 "ora": "^8.1.0"

27 },

28 "devDependencies": {

29 "@ccclub/shared": "workspace:*",

30 "@types/node": "^22.0.0",

31 "tsup": "^8.3.0",

32 "tsx": "^4.19.0",

33 "typescript": "^5.7.0",

34 "vitest": "^4.0.18"

35 },

36 "keywords": [

37 "claude",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/index.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3// src/index.ts

4import { Command, Option } from "commander";

5

6// src/commands/init.ts

7import { createInterface as createInterface2 } from "readline/promises";

8import

scripts/postinstall.cjsView file

Lines 1-33javascript

1// Runs on every npm install. Re-pins the background entrypoints (Claude Code

2// hooks and, on macOS, the heartbeat LaunchAgent) to the version being

3// installed, so `npm i -g ccclub@latest` upgrades everything in one command.

4// An already-newer pin is left alone: a leftover older package must not

5// rewrite 0.9.x back to itself. Without the LaunchAgent half, a still-old

6// heartbeat would keep rewriting the hooks back to its own version every 5

7// minutes until the user ran ccclub.

8const fs = require