registry / create-claude-cabinet / 0.48.0

create-claude-cabinet@0.48.0

⚠ Under review

Claude Cabinet — opinionated process scaffolding for Claude Code projects

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 122 file(s), 1.42 MB of source, external domains: a.com, b.com, evil.com, example.com, schema.org, secure.example.com, www.apple.com, x.com

Source & flagged code

8 flagged

lib/db-setup.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const fs = require('fs');

High

Child Process

Package source references child process execution.

lib/db-setup.jsView on unpkg · L1

3const path = require('path');

4const metadata = require('./metadata');

6// Substrings that identify a better-sqlite3 native-module ABI mismatch —

7// the compiled .node binary was built under a different Node than the one

8// running `pib-db.mjs init`. Node surfaces this as an ERR_DLOPEN_FAILED

9// with a NODE_MODULE_VERSION line; field reports during consumer walks

10// also showed the shorter "native module version mismatch" phrasing.

11const ABI_MISMATCH_SIGNATURES = [

12 'NODE_MODULE_VERSION',

13 'different Node.js version',

14 'was compiled against',

15 'native module version mismatch',

16 'ERR_DLOPEN_FAILED',

17];

19function isAbiMismatch(text) {

20 const s = String(text || '');

21 return ABI_MISMATCH_SIGNATURES.some((sig) => s.includes(sig));

Lines 91-131javascript

91 // reinstall case; skipping means a no-migration release never loads

92 // better-sqlite3, so a stale native binary can't wall the install with an

93 // ABI-mismatch error it never needed to risk.

94 const existingMeta = metadata.read(projectDir) || {};

95 if (

96 shouldSkipInit({

97 dbExists: fs.existsSync(dbPath),

98 recordedVersion: existingMeta.dbSchemaVersion,

templates/engagement/secure-input.mjsView file

Lines 88-128javascript

88 if (err.code === 'ENOENT') throw new DialogUnavailableError('linux');

89 if (err.status === 1) throw new DialogCancelledError();

90 throw err;

91 }

bin/create-claude-cabinet.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

3const { run } = require('../lib/cli');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create-claude-cabinet.jsView on unpkg · L2

5run().catch(err => {

6 console.error(

lib/mux-setup.jsView file

Lines 3-43javascript

3 *

4 * First user-level module in CC. Unlike project-scoped templates that

5 * copy to .claude/ and scripts/, mux installs to

templates/mux/config/mux-server.pyView file

•path = templates/mux/config/mux-server.py kind = build_helper sizeBytes = 11142 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/mux/config/mux-server.pyView on unpkg

templates/mux/__tests__/mux-fail-loud.fixture.shView file

•path = templates/mux/__tests__/mux-fail-loud.fixture.sh kind = payload_in_excluded_dir sizeBytes = 14274 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/mux/__tests__/mux-fail-loud.fixture.shView on unpkg

Source & flagged code

8 flagged · loading source

lib/db-setup.jsView file

1const { execSync } = require('child_process'); L2: const fs = require('fs');

High

Child Process

Package source references child process execution.

lib/db-setup.jsView on unpkg · L1

111log(' Installing better-sqlite3...'); L112: exec('npm install better-sqlite3', { cwd: projectDir, stdio: 'pipe' }); L113: results.push('Installed better-sqlite3');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/db-setup.jsView on unpkg · L111

templates/engagement/secure-input.mjsView file

108L109: async function captureViaPowerShell(prompt) { L110: const escaped = prompt.replace(/'/g, "''");

High

Shell

Package source references shell execution.

templates/engagement/secure-input.mjsView on unpkg · L108

bin/create-claude-cabinet.jsView file

2L3: const { run } = require('../lib/cli'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create-claude-cabinet.jsView on unpkg · L2

lib/mux-setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = create-claude-cabinet@0.47.0 matchedIdentity = npm:Y3JlYXRlLWNsYXVkZS1jYWJpbmV0:0.47.0 similarity = 0.767 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/mux-setup.jsView on unpkg

23L24: const CC_HOME = path.join(os.homedir(), '.claude-cabinet'); L25: const GLOBAL_MANIFEST_PATH = path.join(CC_HOME, 'global-manifest.json'); ... L70: try { L71: const m = JSON.parse(fs.readFileSync(GLOBAL_MANIFEST_PATH, 'utf8')); L72: // Guard shape drift: manifest.files is indexed unconditionally below. ... L111: L112: const ccVersion = require('../package.json').version; L113: const templateDir = TEMPLATE_DIR; ... L190: L191: if (process.platform === 'darwin') { L192: setupDarwinIntegration({ dryRun, results });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/mux-setup.jsView on unpkg · L23

templates/mux/config/mux-server.pyView file

•path = templates/mux/config/mux-server.py kind = build_helper sizeBytes = 11142 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/mux/config/mux-server.pyView on unpkg

templates/mux/__tests__/mux-fail-loud.fixture.shView file

•path = templates/mux/__tests__/mux-fail-loud.fixture.sh kind = payload_in_excluded_dir sizeBytes = 14274 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/mux/__tests__/mux-fail-loud.fixture.shView on unpkg

Findings

1 Critical4 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltalib/mux-setup.js

HighChild Processlib/db-setup.js

HighShelltemplates/engagement/secure-input.mjs

HighRuntime Package Installlib/db-setup.js

HighPayload In Excluded Dirtemplates/mux/__tests__/mux-fail-loud.fixture.sh

MediumDynamic Requirebin/create-claude-cabinet.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/mux-setup.js

MediumShips Build Helpertemplates/mux/config/mux-server.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

lib/db-setup.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const fs = require('fs');

High

Child Process

Package source references child process execution.

lib/db-setup.jsView on unpkg · L1

3const path = require('path');

4const metadata = require('./metadata');

6// Substrings that identify a better-sqlite3 native-module ABI mismatch —

7// the compiled .node binary was built under a different Node than the one

8// running `pib-db.mjs init`. Node surfaces this as an ERR_DLOPEN_FAILED

9// with a NODE_MODULE_VERSION line; field reports during consumer walks

10// also showed the shorter "native module version mismatch" phrasing.

11const ABI_MISMATCH_SIGNATURES = [

12 'NODE_MODULE_VERSION',

13 'different Node.js version',

14 'was compiled against',

15 'native module version mismatch',

16 'ERR_DLOPEN_FAILED',

17];

19function isAbiMismatch(text) {

20 const s = String(text || '');

21 return ABI_MISMATCH_SIGNATURES.some((sig) => s.includes(sig));

Lines 91-131javascript

91 // reinstall case; skipping means a no-migration release never loads

92 // better-sqlite3, so a stale native binary can't wall the install with an

93 // ABI-mismatch error it never needed to risk.

94 const existingMeta = metadata.read(projectDir) || {};

95 if (

96 shouldSkipInit({

97 dbExists: fs.existsSync(dbPath),

98 recordedVersion: existingMeta.dbSchemaVersion,

templates/engagement/secure-input.mjsView file

Lines 88-128javascript

88 if (err.code === 'ENOENT') throw new DialogUnavailableError('linux');

89 if (err.status === 1) throw new DialogCancelledError();

90 throw err;

91 }

bin/create-claude-cabinet.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

3const { run } = require('../lib/cli');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create-claude-cabinet.jsView on unpkg · L2

5run().catch(err => {

6 console.error(

lib/mux-setup.jsView file

Lines 3-43javascript

3 *

4 * First user-level module in CC. Unlike project-scoped templates that

5 * copy to .claude/ and scripts/, mux installs to

templates/mux/config/mux-server.pyView file

•path = templates/mux/config/mux-server.py kind = build_helper sizeBytes = 11142 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/mux/config/mux-server.pyView on unpkg

templates/mux/__tests__/mux-fail-loud.fixture.shView file

•path = templates/mux/__tests__/mux-fail-loud.fixture.sh kind = payload_in_excluded_dir sizeBytes = 14274 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/mux/__tests__/mux-fail-loud.fixture.shView on unpkg