registry / claude-code-zanii / 2.8.6
claude-code-zanii@2.8.6
Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package performs unprompted postinstall browser-extension setup and binary download, creating a meaningful lifecycle risk. The behavior appears aligned with its advertised CLI features and no concrete malicious chain was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install runs the postinstall lifecycle hook.
Impact
It changes browser-integration state without an explicit setup command and introduces a downloaded executable.
Mechanism
Automatic browser bridge registration and package-local binary download.
AI rationale
The package performs unprompted postinstall browser-extension setup and binary download, creating a meaningful lifecycle risk. The behavior appears aligned with its advertised CLI features and no concrete malicious chain was found.
Evidence
package.jsonscripts/postinstall.cjsscripts/setup-chrome-mcp.mjsdist/vendor/ripgrep
Network endpoints2
github.com/microsoft/ripgrep-prebuilt/releases/download/v15.0.1ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v15.0.1
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Postinstall automatically launches Chrome MCP setup.
- Setup registers a Chrome bridge and changes permissions without an explicit user command.
- Postinstall downloads and installs a ripgrep executable from release URLs.
Evidence against
- The browser setup is package-aligned and can be disabled with an environment flag.
- The downloaded binary is specifically named and installed under the package vendor directory.
- No source inspected shows credential harvesting, exfiltration, or arbitrary remote code execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
Source & flagged code
17 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/chunk-5ytsdgrp.jsView file
33(function(AzureAuthorityHosts2) {
L34: AzureAuthorityHosts2["AzureChina"] = "https://login.chinacloudapi.cn";
L35: AzureAuthorityHosts2["AzureGermany"] = "https://login.microsoftonline.de";
...
L199: try {
L200: const oauthErrorResponse = JSON.parse(errorBody);
L201: errorResponse = [redacted](oauthErrorResponse);
...
L212: error: "unknown_error",
L213: errorDescription: `An unknown error has occurred. Response body:
L214:
...
L260: function log(message, ...args) {
L261: process2.stderr.write(`${util.format(message, ...args)}${EOL}`);
L262: }
Findings
1 Critical9 High9 Medium9 Low
CriticalBrowser Credential Phishingdist/chunk-5ytsdgrp.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/chunk-zgmzaj9r.js
HighShelldist/chunk-pfxrg89f.js
HighCommand Output Exfiltrationdist/chunk-5ytsdgrp.js
HighSandbox Evasion Gated Capabilitydist/chunk-5ytsdgrp.js
HighCloud Metadata Accessdist/chunk-85bpkyy9.js
HighInstall Named Payload Filescripts/postinstall.cjs
HighCross File Remote Execution Contextdist/chunk-85jranwb.js
HighSemantic Analysis Limiteddist/chunk-85bpkyy9.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
Affected versions and remediation
This report applies to claude-code-zanii@2.8.6.
See all versions of claude-code-zanii for other recorded verdicts.
- Review the evidence and your use of claude-code-zanii@2.8.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.