Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

claude-code-panel@0.14.0: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / claude-code-panel / 0.14.0

claude-code-panel@0.14.0

Zero-dependency local dashboard for Claude Code: commands, skills, agents, plugins, workflows, sessions and a ccusage-accurate token usage dashboard

AI Security Review

scanned 14h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Starting the CLI/server automatically modifies shell startup files unless opted out. Future `claude` invocations are routed through a localhost inspector that records sensitive conversation payloads locally.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `claude-code-panel` or `node server.js`.

Impact

Captures Claude Code prompts, tool definitions, messages, responses, and thinking content on the local machine.

Mechanism

Persistent shell wrapper plus localhost Anthropic API inspection proxy.

Rationale

The package implements a documented local inspector, but normal startup silently persists a broad Claude CLI interception hook and records sensitive content. Source shows no install hook, remote payload, or third-party data exfiltration.

Evidence

package.jsonserver.js~/.zshrc~/.zprofile~/.bashrc~/.bash_profile~/.profile~/.config/fish/config.fish~/.claude/panel-captures.jsonl

Network endpoints2

127.0.0.1:4322api.anthropic.com

Decision evidence

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

server.js auto-installs a shell `claude` wrapper on normal startup.
Wrapper redirects Claude Code through a local proxy and persists in shell rc files.
Proxy captures full Claude API requests/responses, including system prompts and tool data, to `~/.claude/panel-captures.jsonl`.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Both HTTP servers bind only to 127.0.0.1.
Only observed upstream endpoint is package-aligned `api.anthropic.com`; no third-party exfiltration.
Shell mutation has documented opt-out and uninstall commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 87.0 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged · loading source

server.jsView file

10*/ L11: const http = require('http'); L12: const https = require('https'); ... L17: L18: const PORT = process.env.PORT || 4321; L19: const PROXY_PORT = process.env.PROXY_PORT || Number(PORT) + 1; ... L29: if (process.env.CCP_RC_FILE) return process.env.CCP_RC_FILE.split(',').filter(Boolean); // 测试用 L30: const home = os.homedir(); L31: const targets = new Set(); ... L33: const candidates = [ L34: '.zshrc', '.zprofile', // zsh（macOS 默认） L35: '.bashrc', '.bash_profile', // bash

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

server.jsView on unpkg · L10

10Trigger-reachable chain: manifest.main -> server.js L10: */ L11: const http = require('http'); L12: const https = require('https'); ... L17: L18: const PORT = process.env.PORT || 4321; L19: const PROXY_PORT = process.env.PROXY_PORT || Number(PORT) + 1; ... L29: if (process.env.CCP_RC_FILE) return process.env.CCP_RC_FILE.split(',').filter(Boolean); // 测试用 L30: const home = os.homedir(); L31: const targets = new Set(); ... L33: const candidates = [ L34: '.zshrc', '.zprofile', // zsh（macOS 默认） L35: '.bashrc', '.bash_profile', // bash

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg · L10

scripts/gen-demo-data.pyView file

•path = scripts/gen-demo-data.py kind = build_helper sizeBytes = 19617 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/gen-demo-data.pyView on unpkg

Findings

2 Critical4 Medium4 Low

CriticalPersistence Backdoorserver.js

CriticalTrigger Reachable Dangerous Capabilityserver.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/gen-demo-data.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

92%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Author13days

Maintainerswuchupeng

Version0.14.0

PublishedJul 20, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size71.1 KB

Files7

Keywordsclaudeclaude-codedashboardpanelccusagetoken-usageskillsslash-commands

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → server.jsbin → claude-code-panel

Runtimenode >=18

Artifact223 KB · 7 files1 signature(s)

Install lifecycleNo install hooks · other: start

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

3 flagged

server.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * Claude Panel — 管理个人 Claude 资源的本地面板服务

4 * 零依赖，直接 `node server.js` 启动。

5 *

6 * 管理的资源：

7 * - 命令 ~/.claude/commands/<name>.md

8 * - Skill ~/.claude/skills/<name>/SKILL.md

9 * - Agent ~/.claude/agents/<name>.md

10 */

11const http = require('http');

12const https = require('https');

13const zlib = require('zlib');

14const fs = require('fs');

15const path = require('path');

16const os = require('os');

17

18const PORT = process.env.PORT || 4321;

19const PROXY_PORT = process.env.PROXY_PORT || Number(PORT) + 1;

20

21// ---------- CLI 子命令：把 Inspector 代理装进 shell ----------

22// 写入一个 claude() 包装函数：调用时探测代理端口，通了才走代理、不通就直连，

23// 保证面板没开时 Claude Code 照常工作（不会因指向死端口而失败）。

24const RC_START = '# >>> claude-code-panel >>>';

25const RC_END = '# <<< claude-code-panel <<<';

26

27// 覆盖所有 shell：返回所有应当写入的 rc 文件（已存在的，加上当前 shell 的默认文件）

28function detectRcFiles() {

29 if (process.env.CCP_RC_FILE) return process.env.CCP_RC_FILE.split(',').filter(Boolean); // 测试用

30 const home = os.homedir();

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

server.jsView on unpkg · L10

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg · L10

scripts/gen-demo-data.pyView file

•path = scripts/gen-demo-data.py kind = build_helper sizeBytes = 19617 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/gen-demo-data.pyView on unpkg