claude-team-tracker@1.2.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

claude-team-tracker@1.2.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

28if (ttyFd !== undefined) { L29: const { spawnSync } = require('child_process'); L30: const binPath = require.resolve('../bin/claude-tracker.js');

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L28

3L4: const { configExists, getConfig } = require('../lib/config'); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L3

bin/claude-tracker.jsView file

6Trigger-reachable persistence chain: manifest.bin -> bin/claude-tracker.js L6: if (major < 12 || (major === 12 && minor < 10)) { L7: process.stderr.write( L8: 'claude-team-tracker requires Node.js >= 12.10.0\n' + L9: 'Current version: ' + process.versions.node + '\n' + L10: 'Install a newer version: https://github.com/nvm-sh/nvm\n' L11: ); ... L17: const os = require('os'); L18: const { execSync } = require('child_process'); L19: ... L68: const config = getConfig(); L69: const pkg = require('../package.json'); L70: console.log('\nClaude Tracker v' + pkg.version);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/claude-tracker.jsView on unpkg · L6

6if (major < 12 || (major === 12 && minor < 10)) { L7: process.stderr.write( L8: 'claude-team-tracker requires Node.js >= 12.10.0\n' + L9: 'Current version: ' + process.versions.node + '\n' + L10: 'Install a newer version: https://github.com/nvm-sh/nvm\n' L11: ); ... L17: const os = require('os'); L18: const { execSync } = require('child_process'); L19: ... L68: const config = getConfig(); L69: const pkg = require('../package.json'); L70: console.log('\nClaude Tracker v' + pkg.version);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/claude-tracker.jsView on unpkg · L6

lib/setup.jsView file

138fs.writeFileSync(plistPath, plist, 'utf8'); L139: try { execSync(`launchctl unload "${plistPath}" 2>/dev/null`); } catch (_) {} L140: execSync(`launchctl load "${plistPath}"`); ... L145: // KeepAlive=true relaunches the daemon on its own clean exit. L146: if (!process.env.CT_SKIP_SERVICE_RESTART) { L147: try { execSync(`launchctl unload "${pollPlistPath}" 2>/dev/null`); } catch (_) {} ... L152: async function pollForApproval(serverUrl, code) { L153: const axios = require('axios'); L154: const maxWait = 10 * 60 * 1000;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/setup.jsView on unpkg · L138

•matchType = previous_version_dangerous_delta matchedPackage = claude-team-tracker@1.2.2 matchedIdentity = npm:Y2xhdWRlLXRlYW0tdHJhY2tlcg:1.2.2 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/setup.jsView on unpkg

lib/config.jsView file

5const os = require('os'); L6: const { spawnSync } = require('child_process'); L7: const crypto = require('crypto'); L8: L9: const CONFIG_DIR = path.join(os.homedir(), '.claude-tracker'); L10: const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json'); ... L22: const DEFAULTS = { L23: server_url: 'https://tracker.clawodoo.com', L24: sync_interval_minutes: 10, ... L30: } L31: return Object.assign({}, DEFAULTS, JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'))); L32: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/config.jsView on unpkg · L5