claude-code-zanii@2.12.3
Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a concrete unrestricted credential-forwarding sink and automatic agent-extension setup, but the inspected source does not establish covert default theft or a blocking malware chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package runs the setup; creating an SSH session activates the credential-forwarding proxy.
Impact
A configured arbitrary endpoint can receive an Anthropic API key or OAuth token; installation also changes browser-MCP integration without an explicit setup command.
Mechanism
Automatic MCP registration and unrestricted credential-forwarding proxy.
AI rationale
The package contains a concrete unrestricted credential-forwarding sink and automatic agent-extension setup, but the inspected source does not establish covert default theft or a blocking malware chain.
Evidence
package.jsonscripts/setup-chrome-mcp.mjsdist/chunk-82k1q200.jsdist/chunk-hpwpjr53.jsscripts/postinstall.cjs
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The install hook automatically runs the Chrome MCP setup script.
- That setup invokes a bridge CLI to fix permissions and register Chrome.
- The SSH proxy reads an existing Anthropic API key or OAuth access token.
- It constructs the destination from an unrestricted ANTHROPIC_BASE_URL value, forwards the credentials, and sends the request.
- The SSH feature dynamically imports this proxy implementation when a session is created.
- The install hook also downloads and writes an executable ripgrep binary without an integrity check.
Evidence against
- The default SSH destination is the Anthropic API endpoint when the override is absent.
- The local TCP proxy requires a nonce before it forwards a request.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
Source & flagged code
21 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/chunk-5ytsdgrp.jsView file
33(function(AzureAuthorityHosts2) {
L34: AzureAuthorityHosts2["AzureChina"] = "https://login.chinacloudapi.cn";
L35: AzureAuthorityHosts2["AzureGermany"] = "https://login.microsoftonline.de";
...
L199: try {
L200: const oauthErrorResponse = JSON.parse(errorBody);
L201: errorResponse = [redacted](oauthErrorResponse);
...
L212: error: "unknown_error",
L213: errorDescription: `An unknown error has occurred. Response body:
L214:
...
L260: function log(message, ...args) {
L261: process2.stderr.write(`${util.format(message, ...args)}${EOL}`);
L262: }
Findings
4 Critical11 High8 Medium9 Low
CriticalCredential Exfiltrationdist/chunk-qavgce5b.js
CriticalBrowser Credential Phishingdist/chunk-5ytsdgrp.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-qavgce5b.js
CriticalPrevious Version Dangerous Deltadist/chunk-67pvvsfb.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/chunk-41vqejnc.js
HighShelldist/chunk-41vqejnc.js
HighCredential Redirect Persistencedist/chunk-hpwpjr53.js
HighCommand Output Exfiltrationdist/chunk-5ytsdgrp.js
HighSandbox Evasion Gated Capabilitydist/chunk-5ytsdgrp.js
HighCloud Metadata Accessdist/chunk-85bpkyy9.js
Affected versions and remediation
This report applies to claude-code-zanii@2.12.3.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.12.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.