registry / ccclub / 0.9.6

ccclub@0.9.6

Claude Code and Codex leaderboard among friends for coding agent tokens and costs

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates an existing Claude Code settings file to add automatic SessionEnd and Stop hooks. Those hooks execute a pinned npx sync command; an existing macOS LaunchAgent may also be repinned and reloaded.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package where ~/.claude/settings.json exists; later Claude session events trigger the hook.

Impact

The package gains automatic execution in Claude Code and can cause background sync behavior without an explicit setup command.

Mechanism

Install-time foreign AI-agent hook injection and persistent version-pinned npx execution.

Policy narrative

The package declares postinstall, which runs scripts/postinstall.cjs during npm installation. When Claude Code settings already exist, the script removes prior ccclub hooks and adds SessionEnd and Stop hooks that execute `npx --yes ccclub@0.9.6 sync --silent`. This is an unconsented mutation of a foreign AI-agent control surface. On macOS, it also updates and reloads an existing five-minute LaunchAgent pointing to the same npx command.

Rationale

The package automatically injects persistent Claude Code hooks during installation, rather than limiting that agent integration to an explicit user command. This meets the install-time foreign AI-agent control-surface mutation block policy.

Evidence

package.jsonscripts/postinstall.cjs~/.claude/settings.json~/Library/LaunchAgents/dev.ccclub.sync.plist~/.ccclub/sync.log

Network endpoints1

ccclub.dev

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The install lifecycle runs a package script automatically after npm installation.
That script rewrites Claude Code SessionEnd and Stop hooks to run a version-pinned npx command.
It writes the modified foreign Claude settings file without an explicit user command.
On macOS it can also reload an existing LaunchAgent that runs the same silent sync every five minutes.

Evidence against

The hook rewrite is conditional on an existing Claude settings file.
Silent sync skips uploads when no ccclub configuration exists.
The manifest has no runtime dependency on ccclub itself.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 259 KB of source, external domains: api.anthropic.com, api2.cursor.sh, ccclub.dev, registry.npmjs.org, www.apple.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-37json

2 "name": "ccclub",

3 "version": "0.9.6",

4 "type": "module",

5 "description": "Claude Code and Codex leaderboard among friends for coding agent tokens and costs",

6 "bin": {

7 "ccclub": "dist/index.js",

8 "ccclub-statusline": "dist/statusline-cli.js"

9 },

10 "files": [

11 "dist",

12 "scripts"

13 ],

14 "scripts": {

15 "build": "tsup",

16 "prepublishOnly": "npm run build",

17 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "dev": "tsx src/index.ts",

19 "test": "vitest run"

20 },

21 "dependencies": {

22 "chalk": "^5.3.0",

23 "cli-table3": "^0.6.5",

24 "commander": "^12.1.0",

25 "glob": "^13.0.6",

26 "ora": "^8.1.0"

27 },

28 "devDependencies": {

29 "@ccclub/shared": "workspace:*",

30 "@types/node": "^22.0.0",

31 "tsup": "^8.3.0",

32 "tsx": "^4.19.0",

33 "typescript": "^5.7.0",

34 "vitest": "^4.0.18"

35 },

36 "keywords": [

37 "claude",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/index.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command, Option } from "commander";

6// src/commands/init.ts

7import { createInterface as createInterface2 } from "readline/promises";

8import { stdin, stdout } from "process";

9import chalk5 from "chalk";

10import ora2 from "ora";

12// src/config.ts

13import { readFile, writeFile, mkdir } from "fs/promises";

14import { join } from "path";

15import { homedir, userInfo } from "os";

16import { existsSync } from "fs";

17import { randomBytes } from "crypto";

18import { execSync } from "child_process";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L7

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L7

20// ../shared/dist/types.js

21var AGENT_SOURCES = ["claude", "codex", "opencode", "amp", "pi", "grok", "cursor", "openclaw"];

22var OPT_IN_SOURCES = ["openclaw", "cursor"];

23var DEFAULT_SOURCES = AGENT_SOURCES.filter((source) => !OPT_IN_SOURCES.includes(source));

24var UNRANKED_SOURCES = ["openclaw"];

25function isRankedSource(source) {

26 return !UNRANKED_SOURCES.includes(source ?? "claude");

27}

scripts/postinstall.cjsView file

Lines 1-33javascript

1// Runs on every npm install. Re-pins the background entrypoints (Claude Code

2// hooks and, on macOS, the heartbeat LaunchAgent) to the version being

3// installed, so `npm i -g ccclub@latest` upgrades everything in one command.

4// An already-newer pin is left alone: a leftover older package must not

5// rewrite 0.9.x back to itself. Without the LaunchAgent half, a still-old

6// heartbeat would keep rewriting the hooks back to its own version every 5

7// minutes until the user ran ccclub.

8const fs = require("fs");

9const path = require("path");

10const os = require("os");

11const { execFileSync } = require("child_process");

12const pkg = require("../package.json");

14const settingsPath = path.join(os.homedir(), ".claude", "settings.json");

15const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L13

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.cjsView on unpkg · L10

16const LEGACY_HOOK_COMMANDS = new Set([

17 "ccclub sync --silent",

18 "npx ccclub sync --silent",

19 "npx --yes ccclub sync --silent",

20 "npx ccclub@latest sync --silent",

21 "npx --yes ccclub@latest sync --silent",

22]);

23const VERSIONED_HOOK_COMMAND = /^npx --yes ccclub@[0-9A-Za-z][0-9A-Za-z.+-]* sync --silent$/u;

24const HOOK_EVENTS = ["SessionEnd", "Stop"];

26const PLIST_NAME = "dev.ccclub.sync";

27const PLIST_PATH = path.join(os.homedir(), "Library", "LaunchAgents", `${PLIST_NAME}.plist`);

29// Anchored to the plist ProgramArguments entry and the npx hook command only;

30// see the note on PINNED_PACKAGE in src/pin-version.ts.

31const PINNED_PACKAGE =

32 /<string>ccclub@([0-9A-Za-z][0-9A-Za-z.+-]*)<\/string>|npx --yes ccclub@([0-9A-Za-z][0-9A-Za-z.+-]*) sync/;

33const VERSION = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

7import { createInterface as createInterface2 } from "readline/promises"; L8: import { stdin, stdout } from "process"; L9: import chalk5 from "chalk"; ... L17: import { randomBytes } from "crypto"; L18: import { execSync } from "child_process"; L19: ... L127: var BLOCK_DURATION_MS = BLOCK_DURATION_MIN * 60 * 1e3; L128: var DEFAULT_API_URL = "https://ccclub.dev"; L129: var CLAUDE_PROJECTS_DIR = ".claude/projects"; ... L2551: function getConfigDir() { L2552: return join(homedir(), CCCLUB_CONFIG_DIR); L2553: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L7

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L7

scripts/postinstall.cjsView file

13L14: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L15: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L172: try { L173: fs.writeFileSync(tmp, data); L174: fs.renameSync(tmp, target);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L13

10Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.cjs L10: const os = require("os"); L11: const { execFileSync } = require("child_process"); L12: const pkg = require("../package.json"); L13: L14: const settingsPath = path.join(os.homedir(), ".claude", "settings.json"); L15: const HOOK_COMMAND = `npx --yes ccclub@${pkg.version} sync --silent`; ... L127: L128: const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8")); L129: if (!settings.hooks) settings.hooks = {}; ... L225: // init/join/sync's decision, not npm's. L226: if (process.platform !== "darwin") return; L227: if (!fs.existsSync(PLIST_PATH)) return;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/postinstall.cjsView on unpkg · L10

Findings

1 Critical4 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/index.js

HighTrigger Reachable Persistencescripts/postinstall.cjs

HighSemantic Analysis Limitedpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings