claude-code-termux: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

claude-code-termux: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

16const path = require('path'); L17: const { execSync } = require('child_process'); L18: const ui = require('./src/ui');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L16

•matchType = normalized_sha256 matchedPackage = claude-code-termux@1.0.173 matchedPath = postinstall.js matchedIdentity = npm:Y2xhdWRlLWNvZGUtdGVybXV4:1.0.173 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a737bf9cc18d230e signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = claude-code-termux@1.0.173 matchedPath = postinstall.js matchedIdentity = npm:Y2xhdWRlLWNvZGUtdGVybXV4:1.0.173 similarity = 1.000 shingleOverlap = 16 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

bin/claude-termux.jsView file

15L16: const path = require('path'); L17: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-termux.jsView on unpkg · L15

src/auto-update.jsView file

2L3: const { execSync, spawn } = require('child_process'); L4: const fs = require('fs'); L5: const path = require('path'); L6: const https = require('https'); L7: const { logArrow, logStep } = require('./ui'); ... L15: function isAutoUpdateDisabled() { L16: if (process.env.CLAUDE_NO_AUTO_UPDATE === '1') { L17: return true;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/auto-update.jsView on unpkg · L2

93// Use npm install with --force to bypass platform checks for sharp-wasm32 L94: execSync(`npm install -g ${PACKAGE_NAME}@${latestVersion} --force`, { L95: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/auto-update.jsView on unpkg · L93

•matchType = normalized_sha256 matchedPackage = claude-code-termux@1.0.173 matchedPath = src/auto-update.js matchedIdentity = npm:Y2xhdWRlLWNvZGUtdGVybXV4:1.0.173 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auto-update.jsView on unpkg

scripts/download-ripgrep.shView file

•path = scripts/download-ripgrep.sh kind = build_helper sizeBytes = 1314 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-ripgrep.shView on unpkg

src/patches/sharp-fallback.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/patches/sharp-fallback.js#virtual:normalized:round1View on unpkg

scripts/verify-install.jsView file

•matchType = normalized_sha256 matchedPackage = claude-code-termux@1.0.173 matchedPath = scripts/verify-install.js matchedIdentity = npm:Y2xhdWRlLWNvZGUtdGVybXV4:1.0.173 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/verify-install.jsView on unpkg

src/patches/ripgrep-fallback.jsView file

•matchType = normalized_sha256 matchedPackage = claude-code-termux@1.0.173 matchedPath = src/patches/ripgrep-fallback.js matchedIdentity = npm:Y2xhdWRlLWNvZGUtdGVybXV4:1.0.173 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/patches/ripgrep-fallback.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 7-47json

7 "repository": {

8 "type": "git",

9 "url": "https://github.com/findingjimoh/claude-cli-termux.git"

10 },

11 "keywords": [

12 "claude",

13 "anthropic",

14 "ai",

15 "cli",

16 "termux",

17 "android",

18 "arm64",

19 "coding-assistant"

20 ],

21 "bin": {

22 "claude": "./bin/claude-termux.js",

23 "claude-termux": "./bin/claude-termux.js"

24 },

25 "main": "./bin/claude-termux.js",

26 "scripts": {

27 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "test": "node scripts/verify-install.js"

29 },

30 "dependencies": {

31 "@anthropic-ai/claude-code": "^2.1.291"

32 },

33 "engines": {

34 "node": ">=18.0.0 <25.0.0"

35 },

36 "os": [

37 "android",

38 "linux",

39 "darwin",

40 "win32"

41 ],

42 "cpu": [

43 "arm64",

44 "x64",

45 "arm"

46 ]

47}

postinstall.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2

3/**

4 * Claude Code Termux - Post-install Script

5 *

6 * This script runs after npm install to:

7 * 1. Detect if running on Termux/Android

8 * 2. Set up ripgrep binary for ARM64 Android

9 * 3. Ensure Sharp WASM fallback is configured

10 * 4. Create necessary directories and symlinks

11 */

12

bin/claude-termux.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2

3/**

4 * Claude Code Termux Wrapper

5 *

6 * This wrapper applies Termux/Android-specific patches before loading

7 * the official Claude Code CLI. It fixes issues with:

8 * - Sharp module (uses WASM fallback on android-arm64)

9 * - Ripgrep binary (ensures ARM64 binary is available)

10 * - Path resolution (handles Termux's non-standard paths)

11 * - OAuth token storage (provides fallback when keychain unavailable)

src/auto-update.jsView file

Lines 1-22javascript

1'use strict';

2

3const { execSync, spawn } = require('child_process');

4const fs = require('fs');

scripts/download-ripgrep.shView file

•path = scripts/download-ripgrep.sh kind = build_helper sizeBytes = 1314 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-ripgrep.shView on unpkg

src/patches/sharp-fallback.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/patches/sharp-fallback.js#virtual:normalized:round1View on unpkg

scripts/verify-install.jsView file

•matchType = normalized_sha256 matchedPackage = claude-code-termux@1.0.173 matchedPath = scripts/verify-install.js matchedIdentity = npm:Y2xhdWRlLWNvZGUtdGVybXV4:1.0.173 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/verify-install.jsView on unpkg

src/patches/ripgrep-fallback.jsView file

•matchType = normalized_sha256 matchedPackage = claude-code-termux@1.0.173 matchedPath = src/patches/ripgrep-fallback.js matchedIdentity = npm:Y2xhdWRlLWNvZGUtdGVybXV4:1.0.173 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/patches/ripgrep-fallback.jsView on unpkg