claude-switcher-core@1.0.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

claude-switcher-core@1.0.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/core.jsView file

3L4: const fs = require('node:fs'); L5: const os = require('node:os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/core.jsView on unpkg · L3

lib/shell-integration.jsView file

2Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js -> lib/shell-integration.js L2: // Lógica de configurar/remover a integração de cada shell (fish, bash, L3: // zsh, PowerShell). Compartilhada entre scripts/postinstall.js, L4: // scripts/preuninstall.js e bin/core.js — pra não duplicar a mesma coisa ... L36: const candidates = new Set(); L37: const docs = path.join(os.homedir(), 'Documents'); L38: candidates.add(path.join(docs, 'WindowsPowerShell', 'Microsoft.PowerShell_profile.ps1')); L39: candidates.add(path.join(docs, 'PowerShell', 'Microsoft.PowerShell_profile.ps1')); L40: if (process.platform === 'win32') { L41: for (const exe of ['pwsh', 'powershell']) { ... L43: if (!res.error && res.status === 0) { L44: const p = (res.stdout || '').trim(); L45: if (

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/shell-integration.jsView on unpkg · L2

2// Lógica de configurar/remover a integração de cada shell (fish, bash, L3: // zsh, PowerShell). Compartilhada entre scripts/postinstall.js, L4: // scripts/preuninstall.js e bin/core.js — pra não duplicar a mesma coisa ... L36: const candidates = new Set(); L37: const docs = path.join(os.homedir(), 'Documents'); L38: candidates.add(path.join(docs, 'WindowsPowerShell', 'Microsoft.PowerShell_profile.ps1')); L39: candidates.add(path.join(docs, 'PowerShell', 'Microsoft.PowerShell_profile.ps1')); L40: if (process.platform === 'win32') { L41: for (const exe of ['pwsh', 'powershell']) { ... L43: if (!res.error && res.status === 0) { L44: const p = (res.stdout || '').trim(); L45: if (p) candidates.add(p);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/shell-integration.jsView on unpkg · L2

shell/claude-switcher.shView file

•path = shell/claude-switcher.sh kind = build_helper sizeBytes = 1499 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shell/claude-switcher.shView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 4-31json

4 "description": "Troca de conta do Claude Code (Claude CLI) — núcleo compartilhado pelos wrappers de fish, bash/zsh e PowerShell.",

5 "license": "MIT",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/ArthurViniciusBA1/claude-code-multi-account.git"

9 },

10 "homepage": "https://github.com/ArthurViniciusBA1/claude-code-multi-account",

11 "bin": {

12 "claude-switcher-core": "bin/core.js"

13 },

14 "files": [

15 "bin",

16 "lib",

17 "scripts",

18 "functions",

19 "conf.d",

20 "shell",

21 "powershell"

22 ],

23 "scripts": {

24 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "preuninstall": "node scripts/preuninstall.js"

26 },

27 "engines": {

28 "node": ">=18"

29 }

30}

31

bin/core.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

3

4const fs = require('node:fs');

5const os = require('node:os');

lib/shell-integration.jsView file

Lines 1-22javascript

1'use strict';

2// Lógica de configurar/remover a integração de cada shell (fish, bash,

3// zsh, PowerShell). Compartilhada entre scripts/postinstall.js,

4// scripts/preuninstall.js e bin/core.js — pra não duplicar a mesma coisa

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/shell-integration.jsView on unpkg · L2

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/shell-integration.jsView on unpkg · L2

5// em três lugares.

6

shell/claude-switcher.shView file

•path = shell/claude-switcher.sh kind = build_helper sizeBytes = 1499 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shell/claude-switcher.shView on unpkg