registry / claude-code-zanii / 2.14.8
claude-code-zanii@2.14.8
Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no automatic install hook, and the inspected postinstall helper downloads the package’s ripgrep asset from its official release host. Publisher-hosted search and artifact endpoints are present, but the reviewed source did not establish an attack or automatic credential diversion.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
CLI use; search and artifact endpoints are relevant when their respective features are used.
Impact
No automatic credential theft, unrelated collection, or harmful install behavior was established.
Mechanism
OAuth production traffic uses Anthropic’s API host; the inspected install helper downloads ripgrep from its official release host.
AI rationale
The manifest has no automatic install hook, and the inspected postinstall helper downloads the package’s ripgrep asset from its official release host. Publisher-hosted search and artifact endpoints are present, but the reviewed source did not establish an attack or automatic credential diversion.
Network endpoints4
github.com/microsoft/ripgrep-prebuiltapi.anthropic.comtavily.claude-code-best.wincloud-artifacts.claude-code-best.win
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest defines prepublishOnly as a build step and prepare as Husky; it has no install or postinstall lifecycle hook.
- The postinstall script’s default download host is the official GitHub release path for microsoft/ripgrep-prebuilt.
- The OAuth production API base URL is https://api.anthropic.com.
Evidence against
- Runtime code includes publisher-owned Tavily search and artifact service endpoints, used by those features.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
32 flaggeddist/chunk-1kwz07na.jsView file
•matchType = normalized_sha256
matchedPackage = claude-code-zanii@2.14.4
matchedPath = dist/chunk-rhj0dnby.js
matchedIdentity = npm:Y2xhdWRlLWNvZGUtemFuaWk:2.14.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-1kwz07na.jsView on unpkg10126patternName = generic_password
severity = medium
line = 10126
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-1kwz07na.jsView on unpkg · L10126dist/chunk-hq40zj2w.jsView file
50// node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
L51: import { exec } from "child_process";
L52: import { promisify } from "util";
Findings
3 Critical24 High7 Medium8 Low
CriticalCredential Exfiltrationdist/chunk-dw0x4tgb.js
CriticalBrowser Credential Phishingdist/chunk-mnrth8b3.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-dw0x4tgb.js
HighChild Processdist/chunk-hq40zj2w.js
HighShelldist/chunk-dw0x4tgb.js
HighEvaldist/chunk-mg9fgvjg.js
HighCredential Redirect Persistencedist/chunk-mcbqa5rg.js
HighCommand Output Exfiltrationdist/chunk-mnrth8b3.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs
HighCloud Metadata Accessdist/chunk-q6deb5bx.js
HighInstall Named Payload Filescripts/postinstall.cjs
Affected versions and remediation
This report applies to claude-code-zanii@2.14.8.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.14.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.