registry / claude-code-infinite / 1.0.27
claude-code-infinite@1.0.27
Wrapper for Claude Code CLI
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe default MCP integration gives Claude read access to the user's other session history without per-call approval, leaving a concrete agent capability risk that warrants a warning. The package has no npm install hook beyond a prepublishOnly build step.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run ccc with default settings; the integration can be disabled with CCC_MEMTREE_MCP=0 or constrained through caller configuration and disallow rules.
Impact
Claude can retrieve stored content from other sessions without a separate approval for each tool call. The inspected source does not establish transfer to an unrelated recipient or destructive behavior.
Mechanism
ccc writes a temporary stdio MCP configuration bound to its loopback proxy and passes it to Claude with the MemTree tools allowed. The server exposes session listing, search, and transcript-reading operations.
AI rationale
The default MCP integration gives Claude read access to the user's other session history without per-call approval, leaving a concrete agent capability risk that warrants a warning. The package has no npm install hook beyond a prepublishOnly build step.
Evidence
dist/cli-main.jsdist/memtree-mcp-config.jsdist/memtree-mcp.jsdist/memtree-finder.jsdist/memtree-tools.js
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A normal ccc launch enables and always loads a first-party MemTree MCP server, and passes its tools as allowed tools; callers can disable it with CCC_MEMTREE_MCP=0, supply their own server, or disallow tools.
- The MCP tools can list the user's other sessions and retrieve exact transcript lines; the handlers route calls to search, read, and list operations.
- The flagged memtree-tools.js locations format search and tail results using local arrays and result fields; they do not establish a separate attack.
- package.json declares prepublishOnly as npm run build, with no install lifecycle hook shown.
- The finder source describes session listing and search through owner-only endpoints using the user's key, which does not reach the MCP process.
Evidence against
- The MCP integration is activated when the user runs ccc and has explicit environment and command-line controls.
- The inspected source does not show an npm install-time attack or a transfer of session data to an unrelated recipient.
Behavioral surface
ChildProcess
Source & flagged code
6 flaggeddist/resume-repair-file.jsView file
4import { randomUUID } from "node:crypto";
L5: import { execFileSync } from "node:child_process";
L6: /** Possible writers include Claude binaries and JS runtimes; uncertainty skips repair. */
High
Child Process
Package source references child process execution.
dist/resume-repair-file.jsView on unpkg · L4dist/cli-main.jsView file
69platform === "win32"
L70: ? exec(`${command} "${url}"`, { shell: "cmd.exe" })
L71: : exec(`${command} "${url}"`);
High
511const claudeStartedAt = Date.now();
L512: const child = spawn(claude.command, childArgs, {
L513: env: withClaudeOnPath(claudeChildEnv(process.env, `http://127.0.0.1:${proxy.port}`), claude),
L514: stdio: "inherit",
High
Findings
2 Critical4 High3 Medium5 Low
CriticalDownload Executedist/claude-locate.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitydist/claude-locate.js#virtual:normalized:round1
HighChild Processdist/resume-repair-file.js
HighShelldist/cli-main.js
HighSame File Env Network Executiondist/cli-main.js
HighSemantic Analysis Limiteddist/cc-request.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to claude-code-infinite@1.0.27.
See all versions of claude-code-infinite for other recorded verdicts.
- Review the evidence and your use of claude-code-infinite@1.0.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.