registry / commandcode-api-proxy / 0.1.3

commandcode-api-proxy@0.1.3

OpenAI-compatible API proxy for Command Code. Use your Command Code subscription from any OpenAI client.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `commandcode-api-proxy --setup-claude-code` or `--setup-opencode`; proxy networking occurs when the CLI is started.

Impact

The Claude settings file suppresses dangerous-mode permission prompts when the user later launches Claude with that file; OpenCode config adds a local proxy provider.

Mechanism

explicit agent-config setup and local API proxying

Rationale

The package is not concretely malicious, but its explicit Claude setup configures an agent to bypass a safety confirmation. Policy calls for a warning for explicit user-command agent configuration mutation.

Evidence

package.jsondist/proxy.jsdist/auth.jsdist/config.jsdist/upstream.jsdist/setup/claude-code.jsdist/setup/opencode.js~/.config/commandcode-api-proxy/auth.json~/.config/commandcode-api-proxy/claude-settings.json~/.config/opencode/opencode.jsonopencode.json

Network endpoints3

registry.npmjs.org/command-code/latest

commandcode-api-proxy@0.1.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code