registry / claude-code-zanii / 2.10.0
claude-code-zanii@2.10.0
Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a real automatic lifecycle risk, but the inspected source shows same-vendor Chrome bridge setup and a package-scoped ripgrep installer rather than a concrete malicious payload or credential-exfiltration path. It should be warned on rather than blocked.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm install or another package-manager installation that runs postinstall.
Impact
It changes a browser/MCP integration and adds a remotely obtained executable to the installed package, creating a supply-chain and agent-extension trust risk.
Mechanism
Automatic agent-extension registration and unchecked executable download.
AI rationale
This is a real automatic lifecycle risk, but the inspected source shows same-vendor Chrome bridge setup and a package-scoped ripgrep installer rather than a concrete malicious payload or credential-exfiltration path. It should be warned on rather than blocked.
Evidence
package.jsonscripts/postinstall.cjsscripts/setup-chrome-mcp.mjsscripts/run-parallel.mjsdist/vendor/ripgrep
Network endpoints2
github.comghproxy.net
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package runs two installers automatically after npm installation.
- The Chrome installer invokes a bundled dependency to fix permissions and register a Chrome MCP bridge without a user command.
- The other installer downloads an executable from a primary host or proxy mirror and installs it without a visible checksum verification.
Evidence against
- No runtime dependency on this package itself is declared.
- The inspected lifecycle scripts do not collect or transmit credentials.
- The downloaded executable is placed under the package's ripgrep vendor directory, and the installer does not execute it.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsPossibleObfuscation
Source & flagged code
22 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/chunk-5ytsdgrp.jsView file
33(function(AzureAuthorityHosts2) {
L34: AzureAuthorityHosts2["AzureChina"] = "https://login.chinacloudapi.cn";
L35: AzureAuthorityHosts2["AzureGermany"] = "https://login.microsoftonline.de";
...
L199: try {
L200: const oauthErrorResponse = JSON.parse(errorBody);
L201: errorResponse = [redacted](oauthErrorResponse);
...
L212: error: "unknown_error",
L213: errorDescription: `An unknown error has occurred. Response body:
L214:
...
L260: function log(message, ...args) {
L261: process2.stderr.write(`${util.format(message, ...args)}${EOL}`);
L262: }
Findings
4 Critical11 High9 Medium9 Low
CriticalCredential Exfiltrationdist/chunk-8xyts7j0.js
CriticalBrowser Credential Phishingdist/chunk-5ytsdgrp.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-8xyts7j0.js
CriticalPrevious Version Dangerous Deltadist/chunk-67pvvsfb.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/chunk-c17f0h2s.js
HighShelldist/chunk-pfxrg89f.js
HighCredential Redirect Persistencedist/chunk-edqz4152.js
HighCommand Output Exfiltrationdist/chunk-5ytsdgrp.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs
HighCloud Metadata Accessdist/chunk-85bpkyy9.js
Affected versions and remediation
This report applies to claude-code-zanii@2.10.0.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.