claude-code-cache-fix@4.3.0: Suspicious npm security report

Loading npm security reports…

claude-code-cache-fix@4.3.0: Suspicious npm security report | LPM Firewall

proxy/forward-proxy.mjsView file

Lines 4-44javascript

4// ANTHROPIC_BASE_URL. On Claude Code >= 2.1.196 a non-Anthropic base URL

5// disables Remote Control (RC). This transport instead sits in front of the

6// REAL api.anthropic.com as an HTTPS_PROXY: CC's base URL stays

7// api.anthropic.com, so RC keeps working, while we still see and transform

8// /v1/messages.

9//

10// It only MITMs the upstream host (api.anthropic.com), where the cacheable

11// /v1/messages traffic lives, and blind-tunnels every other CONNECT

12// (mcp-proxy.anthropic.com, telemetry, npm, ...) untouched, so RC/MCP and

13// unrelated traffic are unaffected. The decrypted upstream request is fed into

14// the SAME http request handler used by reverse-proxy mode (server.emit

15// ('connection', tlsSocket)), so the entire extension pipeline is reused as-is.

16//

17// Client wiring (ANTHROPIC_BASE_URL stays UNSET):

18// HTTPS_PROXY=http://127.0.0.1:<port> NODE_EXTRA_CA_CERTS=<caPath> claude

19import http from "node:http";

20import https from "node:https";

21import net from "node:net";

22import tls from "node:tls";

23import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, rmSync, chmodSync } from "node:fs";

24import { join } from "node:path";

25import { execFileSync } from "node:child_process";

26import { randomBytes, X509Certificate, createPublicKey } from "node:crypto";

High

Child Process

Package source references child process execution.

proxy/forward-proxy.mjsView on unpkg · L24

27import config from "./config.mjs";

28import { getAgent } from "./upstream.mjs";

29import { discoverBucket } from "./downloads-bucket.mjs";

31function upstreamHost() {

32 try { return new URL(config.upstream).hostname; } catch { return "api.anthropic.com"; }

33}

35// The extra host we MITM (besides the upstream) to accelerate large downloads.

36const DOWNLOADS_HOST = "downloads.claude.ai";

38// Whether download-rewrite is BOTH enabled (opt-in) AND has a usable bucket

39// discovered from the client binary. Only then do we MITM downloads.claude.ai;

40// with no bucket we leave it blind-tunneled, so a discovery miss degrades to

41// the pre-existing (slower but working) path instead of a broken rewrite.

42function downloadRewriteActive() {

43 return config.downloadRewrite && discoverBucket() !== "";

44}

bin/install-service.mjsView file

Lines 25-65javascript

25 upstream: process.env.CACHE_FIX_PROXY_UPSTREAM || "",

26 caFile: process.env.CACHE_FIX_PROXY_CA_FILE || "",

27 rejectUnauthorized: process.env.CACHE_FIX_PROXY_REJECT_UNAUTHORIZED || "",

28 debug: process.env.CACHE_FIX_DEBUG || "",

29 // Hot-reload is opt-in as of v4.0.0 (#196). Capture from env at install

30 // time so the operator can bake `CACHE_FIX_HOT_RELOAD=on` into the

31 // generated unit/plist via `CACHE_FIX_HOT_RELOAD=on cache-fix-proxy

32 // install-service`. Strict "on" match — anything else renders nothing.

33 hotReload: process.env.CACHE_FIX_HOT_RELOAD === "on" ? "on" : "",

34 // Forward-proxy mode (CONNECT + selective MITM) so the SERVICE runs the

35 // proxy in the RC-preserving mode. Baked in at install time via

36 // `CACHE_FIX_FORWARD_PROXY=on cache-fix-proxy install-service`. Strict "on"

37 // match, same as hotReload. Note: clients still wire HTTPS_PROXY +

38 // NODE_EXTRA_CA_CERTS themselves (the service only controls the proxy end).

39 forwardProxy: process.env.CACHE_FIX_FORWARD_PROXY === "on" ? "on" : "",

40 workingDir: resolve(__dirname, ".."),

41 };

42}

44// Validate that a port string is a plain decimal integer in [1, 65535].

45// We render this value into both a systemd Environment= line (safe) AND a

46// /bin/sh -c command in the healthcheck oneshot — DANGEROUS without

47// validation: shell metacharacters or quotes in a port string would let a

High

Shell

Package source references shell execution.

bin/install-service.mjsView on unpkg · L45

48// hostile env var change the executed command. Throw on invalid input so

49// callers report it cleanly via reportFsError.

50function validatePort(raw) {

51 if (typeof raw !== "string" && typeof raw !== "number") {

52 throw new InvalidPortError(`port must be a number or numeric string, got ${typeof raw}`);

53 }

54 const s = String(raw).trim();

55 if (!/^\d+$/.test(s)) {

56 throw new InvalidPortError(`port must be a positive integer (got ${JSON.stringify(raw)})`);

57 }

58 const n = Number(s);

59 if (n < 1 || n > 65535) {

60 throw new InvalidPortError(`port must be in 1..65535 (got ${n})`);

61 }

62 return s;

63}

65class InvalidPortError extends Error {

proxy/extensions/deferred-tools-restore.mjsView file

Lines 1-41javascript

1// deferred-tools-restore — preserve cache prefix across MCP reconnect race.

2//

3// PROBLEM (mirrored from preload.mjs ~429-518):

4// On `claude --continue`, if MCP servers haven't finished reconnecting before

5// CC fires the first post-resume request, the

6// <system-reminder>The following deferred tools are now available via ToolSearch…</system-reminder>

7// block at msg[0] (or wherever the attachment lands post-compaction) shrinks

8// dramatically. ~40 tools collapse to a handful of CC built-ins, and CC

9// injects a trailing

10// "The following deferred tools are no longer available (their MCP server

11// disconnected). Do not search for them — ToolSearch will return no match:"

12// notice. That block change at the root of the message array busts the cache

13// at the very top — the entire ~940K prompt re-caches.

14//

15// FIX: Persist the clean (no-UNAVAILABLE-marker) form of the block. On a

16// subsequent request where the block has shrunk and contains the UNAVAILABLE

17// marker, substitute the persisted full bytes. Restore only if the snapshot

18// is STRICTLY LONGER than the current block — never downgrade to a stale

19// shorter snapshot.

20//

21// SNAPSHOT KEY (proxy-specific adaptation):

22// Preload uses process.cwd() because each preload runs in the CC process,

23// where cwd identifies the project. The proxy is a long-lived daemon; its

Low

Weak Crypto

Package source references weak cryptographic algorithms.

proxy/extensions/deferred-tools-restore.mjsView on unpkg · L21

24// cwd is shared across all CC sessions on the host. To key per-project, the

25// proxy parses the cwd OUT of the system prompt content (CC injects

26// " - Primary working directory: <path>" in the # Environment section) and

27// keys on sha1("cwd:" + that path). Verified empirically against CC v2.1.117.

28//

29// FAIL-OPEN: If the cwd marker is absent (CC format drift, missing system

30// prompt), the extension no-ops the request entirely. Result: status quo

31// cache-bust, never silently restores the wrong block.

33import {

34 mkdir as _mkdir,

35 readFile as _readFile,

36 writeFile as _writeFile,

37 rename as _rename,

38} from "node:fs/promises";

39import { join } from "node:path";

40import { createHash } from "node:crypto";

41import { claudeHome } from "../claude-home.mjs";

bin/claude-via-proxy.mjsView file

Lines 187-227javascript

187 // Forward-proxy wiring. Leave ANTHROPIC_BASE_URL UNSET (that is exactly what

188 // keeps Remote Control enabled) and route claude through the proxy as an

189 // HTTPS proxy, trusting the MITM CA it generated on startup. Resolve the CA

190 // dir from the SAME inputs as the proxy's config.caDir, in the same order:

191 // CACHE_FIX_CA_DIR wins, else ${CLAUDE_CONFIG_DIR||~/.claude}/cache-fix-ca.

192 // (Reading only CLAUDE_CONFIG_DIR here would ignore a CACHE_FIX_CA_DIR

193 // override and point claude at the wrong — or absent — CA than the one the

194 // spawned proxy actually generated.)

195 const caDir = process.env.CACHE_FIX_CA_DIR ||

196 join(process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude"), "cache-fix-ca");

197 const caPem = join(caDir, "ca.pem");

198 if (!existsSync(caPem)) {

199 process.stderr.write(

200 `--remote-control: proxy MITM CA not found at ${caPem}. The proxy should ` +

201 `generate it on startup in forward-proxy mode; check for an openssl ` +

202 `failure in the proxy output above.\n`,

203 );

204 cleanup();

205 process.exit(1);

206 }

207 const proxyUrl = `http://127.0.0.1:${actualPort}`;

208 claudeEnv = { ...process.env };

209 delete claudeEnv.ANTHROPIC_BASE_URL;

210 claudeEnv.HTTPS_PROXY = proxyUrl;

211 claudeEnv.https_proxy = proxyUrl;

212 claudeEnv.NODE_EXTRA_CA_CERTS = caPem;

213} else {

214 claudeEnv = {

215 ...process.env,

216 ANTHROPIC_BASE_URL: `http://127.0.0.1:${actualPort}`,

217 };

218}

219

220const spawnOpts = { stdio: ["inherit", "pipe", "pipe"], env: claudeEnv };

221if (process.env.CACHE_FIX_CLAUDE_CMD) {

222 const parts = process.env.CACHE_FIX_CLAUDE_CMD.split(" ");

223 claudeProc = spawn(parts[0], [...parts.slice(1), ...claudeArgs], spawnOpts);

224} else {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-via-proxy.mjsView on unpkg · L207

225 claudeProc = spawn("claude", claudeArgs, spawnOpts);

226}

227

claude-code-cache-fix@4.3.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code