registry / klaudius / 0.17.3

klaudius@0.17.3

⚠ Under review

Scaffold and maintain a Klaudius project — an autonomous web agency pipeline that runs on Claude Code (find, build, deploy, outreach end-to-end).

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 5 file(s), 155 KB of source, external domains: account.microsoft.com, accounts.zoho.com, api.cloudflare.com, api.netlify.com, api.supabase.com, api.telegram.org, api.twilio.com, api.vercel.com, app.fastmail.com, app.netlify.com, console.cloud.google.com, console.twilio.com, dash.cloudflare.com, en.wikipedia.org, klaudius.dev, myaccount.google.com, nodejs.org, places.googleapis.com, registry.npmjs.org, supabase.com, vercel.com, www.python.org, xxxx.supabase.co

Source & flagged code

4 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{a as Q,b as Ke,c as He,d as P,f as Fe,g as Ve}from"./chunk-SZ4KCTSL.js";import{a as ce,b as Ge,c as Be,d as de,e as Ye,i as We}from"./chunk-ZTT5HVYU.js";import{Command as hs}from"commander";import{spawn as ze}from"child_process";import _ from"picocolors";function G(){let e=process.version,n=/^v(\d+)\.(\d+)\.(\d+)/.exec(e);if(!n)return{ok:!1,message:`Could not parse the Node.js version string ("${e}"). Klaudius requires Node.js 22.15 or newer \u2014 install from https://nodejs.org/.`};let s=parseInt(n[1],10),t=parseInt(n[2],10),i=parseInt(n[3],10),a=`${s}.${t}.${i}`;return s<22||s===22&& ...

3`));let n=[];n.push(Bt());let s=await Z();n.push(Yt(s)),n.push(await Wt(s.command)),n.push(await zt()),n.push(await qt());for(let i of n){let a=i.status==="ok"?_.green("\u2713"):_.red("\u2717");console.log(` ${a} ${i.name}${i.detail?_.dim(` \u2014 ${i.detail}`):""}`),i.nextAction&&console.log(` ${_.dim("\u2192")} ${_.cyan(i.nextAction)}`)}console.log();let t=n.filter(i=>i.status==="fail");if(t.length===0){Xt();return}console.log(_.red(_.bold(`${t.length} check${t.length===1?"":"s"} failed \u2014 fix the \u2192 items above, then re-run \

4`)[0]||"ok"}:{name:"pip available",status:"fail",detail:`${n.join(" ")} -m pip not runnable`,nextAction:`Add pip to your Python: \`${n.join(" ")} -m ensurepip --upgrade\` (or reinstall Python from python.org, which bundles pip).`}}async function zt(){let e=process.platform==="win32",n=await _e("npm",["--version"],e);return n.code!==0

5Please share that file so we can trace what happened.`);return t}var Ce="claude-code";function Je(e){if(e==="claude-code"||e==="codex")return e}var Ie="vercel";function Qe(e){if(e==="vercel"||e==="cloudflare"||e==="netlify")return e}function pe(e){let n=[],s=i=>{n.push(""),n.push("# "+"=".repeat(60)),n.push(`# ${i}`),n.push("# "+"=".repeat(60)),n.push("")},t=(i,a)=>{if(a==null||a===""){n.push(`# ${i}=`);return}let l=String(a);if(/[\s"'`$\\#&|<>;()*?\[\]{}!~]/.test

6`)+`

7`}function fe(e){let n={mcpServers:{supabase:{command:"npx",args:["-y","@supabase/mcp-server-supabase@latest",`--project-ref=${e.supabaseProjectRef}`],env:{SUPABASE_ACCESS_TOKEN:e.supabasePat,NODE_OPTIONS:"--use-system-ca"}}}};return JSON.stringify(n,null,2)+`

8`}function me(e){let n=e.supabaseProjectRef,s=Zt(e.supabasePat);return["# Codex MCP config \u2014 generated by `npx klaudius init` / `configure`.","# Edit freely. NEVER commit this file \u2014 .gitignore already excludes it.","# See `.codex/config.toml.example` for the documented format.","","[mcp_servers.supabase]",'command = "npx"',`args = ["-y", "@supabase/mcp-server-supabase@latest", "--project-ref=${n}"]`,`env = { SUPABASE_ACCESS_TOKEN = "${

9`)}function Zt(e){return e.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}var Ze=[{key:"AI_AGENT",value:"claude-code",comment:"Which AI coding agent drives this install. Pre-codex installs were Claude Code by default \u2014 this records that explicitly so `update` re-fetches the matching template tarball and `doctor` checks the right CLI."},{key:"PRICING_TERMS",value:"one-off, no monthly fees"

10`)?"":`

11`,a=["","# "+"=".repeat(60),"# Backfilled by `klaudius update` (new template env keys)","# "+"=".repeat(60)];for(let l of t)a.push(""),l.comment&&a.push(`# ${l.comment}`),a.push(en(l.key,l.value));return e+i+a.join(`

12`)+`

13`}function tn(e){return e.length>=2&&e.startsWith('"')&&e.endsWith('"')?e.slice(1,-1).replace(/\\\\/g,"\\").replace(/\\"/g,'"').replace(/\\\$/g,"$").replace(/\\`/g,"`"):e.length>=2&&e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function

14`)){let t=s.trim();if(!t||t.startsWith("#"))continue;let i=t.indexOf("=");if(i===-1)continue;let a=t.slice(0,i

15`+B.bold(B.cyan(e))),detail:e=>console.log(B.dim(" "+e))};var ln="https://registry.npmjs.org/klaudius/latest";async function cn(e=1500){let n=new AbortController,s=setTimeout(()=>n.abort(),e);try{let t=await fetch(ln,{signal:n.signal,headers:{accept:"application/json"}});if(!t.ok)return null;let i=await t.json();return typeof i.version=="string"?i.version:null}catch{return null}finally{clearTimeout(s)}}function dn(e,n){let s=a=>a.split("-")[0].split(".").map(l=>Number.parseInt(l,10)),t=s(e),i=s(n);if(t.length<3||i.length<3)return!1;for(let a=0;a<3;a++){if(Number.isNaN(t[a])||Number.isNaN(i[a ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L1

16 \u2022 The app password is wrong, expired, or for a different provider.

17 \u2022 The email address doesn't match the account that issued the password.

18 \u2022 2FA is required but no app-specific password was generated.`:t.includes("etimedout")||t.includes("timeout")?`${n} server didn't respond in time. Check the host/port, or your network.`:t.includes("enotfound")||t.includes("getaddrinfo")?`${n} host could not be resolved. Check the host setting.`:`${n} check failed: ${s}`}async

19`+n;return bn.some(t=>t.test(s))}function yt(e){return new Promise(n=>setTimeout(n,e))}function Tn(e,n,s){return new Promise(t=>{let i=s.shell?xe([e,...n].join(" "),{cwd:s.cwd,stdio:["ignore","pipe","pipe"],shell:!0,env:s.env??process.env}):xe(e,n,{cwd:s.cwd,stdio:["ignore","pipe","pipe"],shell:!1,env:s.env??process.env}),a="",l="";i.stdout?.on("data",c=>{let p=c.toString();a+=p,process.stdout.write(p)}),i.stderr?.on("data",c=>{let p=c.toString();l+=p,process.stderr.write(p)}),i.on("close",c=>t({code:c??1,stdout:a,stderr:l})),i.on("error",c=>t({code:1,stdout:a,stderr:l+c.message}))})}async fun ...

20${e.stdout??""}`;return Cn.find(t=>t.pattern.test(n))?.hint}async function Sn(e){let n=["supabase<2.26","python-dotenv","requests","httpx","Pillow","truststore"],s

21`,"utf-8")}var Et="0.17.3",b=5;function Y(e,n){o.blank(),o.error(`${e} validation failed ${b} times in a row. Pausing setup so you don't get stuck in a loop.`),o.detail(`Last error: ${n}`),o.blank(),o.detail("Your credentials are saved in `.env`. Two ways forward:"),o.detail(" \u2022 Open `.env` in any text editor, fix the value, re-run `npx klaudius@latest init` and pick Resume."),o.detail(" \u2022 Or email hello@klaudius.dev with the error above and we'll dig in."),o.blank(),process.exit(1)}async function bt(e){let n=e.target??".",s=$n(n)?n:Nn(process.cwd(),n),t=jn(s);t&&(o.error("

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = klaudius@0.17.2 matchedIdentity = npm:a2xhdWRpdXM:0.17.2 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/bin.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.jsView on unpkg

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin.jsView on unpkg · L1

1#!/usr/bin/env node L2: import{a as Q,b as Ke,c as He,d as P,f as Fe,g as Ve}from"./chunk-SZ4KCTSL.js";import{a as ce,b as Ge,c as Be,d as de,e as Ye,i as We}from"./chunk-ZTT5HVYU.js";import{Command as hs... L3: `));let n=[];n.push(Bt());let s=await Z();n.push(Yt(s)),n.push(await Wt(s.command)),n.push(await zt()),n.push(await qt());for(let i of n){let a=i.status==="ok"?_.green("\u2713"):_.... ... L13: `}function tn(e){return e.length>=2&&e.startsWith('"')&&e.endsWith('"')?e.slice(1,-1).replace(/\\\\/g,"\\").replace(/\\"/g,'"').replace(/\\\$/g,"$").replace(/\\`/g,"`"):e.length>=2... L14: `)){let t=s.trim();if(!t||t.startsWith("#"))continue;let i=t.indexOf("=");if(i===-1)continue;let a=t.slice(0,i).trim(),l=tn(t.slice(i+1).trim());n[a]=l}return n}function tt(e){let ... L15: `+B.bold(B.cyan(e))),detail:e=>console.log(B.dim(" "+e))};var ln="https://registry.npmjs.org/klaudius/latest";async function cn(e=1500){let n=new AbortController,s=setTimeout(()=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L1

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/bin.js

HighChild Processdist/bin.js

HighSame File Env Network Executiondist/bin.js

HighCommand Output Exfiltrationdist/bin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

6`)+`

10`)?"":`

12`)+`

14`)){let t=s.trim();if(!t||t.startsWith("#"))continue;let i=t.indexOf("=");if(i===-1)continue;let a=t.slice(0,i

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L1

16 \u2022 The app password is wrong, expired, or for a different provider.

17 \u2022 The email address doesn't match the account that issued the password.

20${e.stdout??""}`;return Cn.find(t=>t.pattern.test(n))?.hint}async function Sn(e){let n=["supabase<2.26","python-dotenv","requests","httpx","Pillow","truststore"],s

Long lines were clipped for display.

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.jsView on unpkg