registry / claude-code-zanii / 2.14.7
claude-code-zanii@2.14.7
⚠ Under reviewReverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest shows a prepare hook but no npm install hook. Because the bundled native modules remain materially unresolved, the source review cannot establish that the package is clean or malicious.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Loading an audio-capture module on a supported platform.
Impact
Their behavior cannot be determined from the inspected evidence.
Mechanism
Available offline analysis could not fully inspect the native modules.
AI rationale
The manifest shows a prepare hook but no npm install hook. Because the bundled native modules remain materially unresolved, the source review cannot establish that the package is clean or malicious.
Evidence
.lpm-inspection-9nA8Nn/0-90714588603d.txt.lpm-inspection-9nA8Nn/1-a5e6cc22c531.txt.lpm-inspection-9nA8Nn/2-983860892f4b.txt.lpm-inspection-9nA8Nn/3-2a8267f4a1fc.txt.lpm-inspection-9nA8Nn/4-64d636ca4acc.txt.lpm-inspection-9nA8Nn/5-691c724e516c.txtdist/vendor/audio-capture/x64-darwin/audio-capture.nodedist/vendor/audio-capture/arm64-darwin/audio-capture.nodedist/vendor/audio-capture/arm64-win32/audio-capture.nodedist/vendor/audio-capture/x64-linux/audio-capture.nodedist/vendor/audio-capture/arm64-linux/audio-capture.node
Decision evidence
public snapshotAI called this Manual Review at 99.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json lists a prepare hook that runs Husky.
- The bundled audio-capture native modules have unresolved behavior: offline analysis could not inspect several formats, and the bounded Windows analysis left call targets uninspected.
Evidence against
- The inspected package manifest does not list an npm install lifecycle hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
32 flaggeddist/chunk-2qbc1xfa.jsView file
•matchType = normalized_sha256
matchedPackage = claude-code-zanii@2.14.4
matchedPath = dist/chunk-rhj0dnby.js
matchedIdentity = npm:Y2xhdWRlLWNvZGUtemFuaWk:2.14.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-2qbc1xfa.jsView on unpkg10126patternName = generic_password
severity = medium
line = 10126
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-2qbc1xfa.jsView on unpkg · L10126dist/chunk-6m5ere2q.jsView file
156init_process();
L157: import { execSync } from "child_process";
L158: import { existsSync, readFileSync } from "fs";
High
Findings
3 Critical24 High7 Medium8 Low
CriticalCredential Exfiltrationdist/chunk-kz7jpfzt.js
CriticalBrowser Credential Phishingdist/chunk-mnrth8b3.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-kz7jpfzt.js
HighChild Processdist/chunk-6m5ere2q.js
HighShelldist/chunk-kz7jpfzt.js
HighEvaldist/chunk-g3t50fmn.js
HighCredential Redirect Persistencedist/chunk-d0h0fat6.js
HighCommand Output Exfiltrationdist/chunk-mnrth8b3.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs
HighCloud Metadata Accessdist/chunk-mnrth8b3.js
HighInstall Named Payload Filescripts/postinstall.cjs
Affected versions and remediation
This report applies to claude-code-zanii@2.14.7.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.14.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.