registry / claude-station / 1.1.0

claude-station@1.1.0

Local web dashboard to browse, search, edit and resume Claude Code sessions. Zero npm dependencies, zero build step.

AI Security Review

scanned 17h ago · by lpm-firewall-ai

The runtime HTTP server has no authentication and binds without an explicit loopback host. It can expose Claude session content and permit writes to CLAUDE.md or session archive/deletion operations to reachable peers.

Static reason

No blocking static signals were detected.

Trigger

Run the claude-station CLI; a network client reaches its HTTP server.

Impact

Sensitive session disclosure and remote modification of Claude instruction files; destructive session operations are available.

Mechanism

Unauthenticated broadly bound local dashboard API

Rationale

The package is not overtly malicious and has no install-time behavior, but its server binding and unauthenticated sensitive API create a concrete security vulnerability.

Evidence

bin/cli.mjssrc/server.mjssrc/scanner.mjssrc/indexer.mjs~/.claude/projects/~/.claude/CLAUDE.md<project>/CLAUDE.md~/.claude/session-index.json

Network endpoints1

localhost:<port>

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence with false-positive risk.

claude-station@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code