claudeputer@1.1.55: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

claudeputer@1.1.55: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/happy-dev.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

dist/index-8Tz_MPF6.cjsView file

11658L11659: const execAsync = util.promisify(child_process.exec); L11660: const CLIENT_ID = "681255809395-[redacted].apps.googleusercontent.com";

High

Shell

Package source references shell execution.

dist/index-8Tz_MPF6.cjsView on unpkg · L11658

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-8Tz_MPF6.cjs: var node_readline = require('node:readline'); this.claudeEnvVars = opts.claudeEnvVars; this.claudeArgs = opts.claudeArgs; this.claudeGoalStatusCallbacks = []; metadata?.claudeSessionId ?? this.sessionId, for (const callback of this.claudeGoalStatusCallbacks) { this.claudeGoalStatusCallbacks.push(callback); if (!this.claudeArgs) return;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-8Tz_MPF6.cjsView on unpkg

6Cross-file remote execution chain: dist/index-8Tz_MPF6.cjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L6: var persistence = require('./types-TS9NsN6x.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L440: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L441: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L442: return node_path.join(claudeConfigDir, "projects", projectId); ... L456: try { L457: const parsed = JSON.parse(v); L458: return typeof parsed.uuid === "string" && pars

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-8Tz_MPF6.cjsView on unpkg · L6

6Trigger-reachable persistence chain: manifest.main -> dist/index.cjs -> dist/index-8Tz_MPF6.cjs L6: var persistence = require('./types-TS9NsN6x.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L440: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L441: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L442: return node_path.join(claudeConfigDir, "projects", projectId); ... L456: try { L457: const parsed = JSON.parse(v); L458: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index-8Tz_MPF6.cjsView on unpkg · L6

6var persistence = require('./types-TS9NsN6x.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L440: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L441: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L442: return node_path.join(claudeConfigDir, "projects", projectId); ... L456: try { L457: const parsed = JSON.parse(v); L458: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-8Tz_MPF6.cjsView on unpkg · L6

dist/runGemini-DTCwbYaU.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/runGemini-DFaFvFE0.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-DTCwbYaU.cjsView on unpkg

2L3: var ink = require('ink'); L4: var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runGemini-DTCwbYaU.cjsView on unpkg · L2

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-CtkWJT8o.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-CtkWJT8o.mjsView on unpkg

dist/config-jUsegtME.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/config-PxyM2qqi.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-jUsegtME.cjsView on unpkg

scripts/env-wrapper.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/env-wrapper.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

scripts/ripgrep_launcher.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/ripgrep_launcher.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-DEx8iYB9.mjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/config-lCTXWyPR.mjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DEx8iYB9.mjsView on unpkg

dist/index.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/index.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 40 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/lib.cjsView file

•matchType = normalized_sha256 matchedPackage = claudeputer@1.1.41 matchedPath = dist/lib.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.cjsView on unpkg

dist/runOpenClaw-6IlhzYbc.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/runOpenClaw-BriywXHV.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runOpenClaw-6IlhzYbc.cjsView on unpkg

scripts/statusline_forwarder.cjsView file

•matchType = normalized_sha256 matchedPackage = claudeputer@1.1.41 matchedPath = scripts/statusline_forwarder.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/statusline_forwarder.cjsView on unpkg

scripts/claude_local_launcher.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/claude_local_launcher.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/index.mjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/index.mjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 40 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

dist/lib.mjsView file

•matchType = normalized_sha256 matchedPackage = claudeputer@1.1.41 matchedPath = dist/lib.mjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg