registry / litclaude-ai / 0.3.30

litclaude-ai@0.3.30

Claude Code-native workflow distribution.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 48 file(s), 232 KB of source, external domains: anthropic.com, biomejs.dev, clangd.llvm.org, duckduckgo.com, github.com, litclaude.invalid

Source & flagged code

5 flagged

package.jsonView file

Lines 8-48json

8 "litclaude": "bin/litclaude-ai.js"

9 },

10 "files": [

11 "bin",

12 "docs/agents.md",

13 "docs/hooks.md",

14 "docs/lsp.md",

15 "docs/migration.md",

16 "docs/workflow-compatibility-audit.md",

17 "plugins",

18 "scripts",

19 "README.md",

20 "README_ko-KR.md",

21 "CHANGELOG.md",

22 "cover.png",

23 "generate_cover.py",

24 "RELEASE_CHECKLIST.md",

25 "LICENSE"

26 ],

27 "scripts": {

28 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "test": "node --test test/*.test.mjs",

30 "validate:plugin": "node scripts/validate-plugin.mjs",

31 "doctor": "node scripts/doctor.mjs",

32 "qa:tmux": "bash scripts/qa-claude-plugin-smoke.sh",

33 "qa:portable": "bash scripts/qa-portable-install.sh",

34 "pack:dry-run": "npm pack --dry-run",

35 "scan:legacy-tokens": "node tools/scan-legacy-tokens.mjs",

36 "check:version": "node tools/check-version-lockstep.mjs",

37 "assert:ci": "node tools/assert-ci-workflow.mjs",

38 "pack:payload-guard": "node tools/check-pack-payload.mjs"

39 },

40 "keywords": [

41 "claude-code",

42 "plugin",

43 "ai-agents",

44 "orchestration"

45 ],

46 "author": "LitClaude contributors",

47 "license": "MIT",

48 "homepage": "https://github.com/wjgoarxiv/litclaude#readme",

plugins/litclaude/skills/deep-interview/scripts/render_progress.pyView file

•path = plugins/litclaude/skills/deep-interview/scripts/render_progress.py kind = build_helper sizeBytes = 7185 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/litclaude/skills/deep-interview/scripts/render_progress.pyView on unpkg

plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.pyView file

•path = plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

plugins/litclaude/lib/public-source-reader/barrier-detection.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = litclaude-ai@0.3.29 matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.29 similarity = 0.884 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/litclaude/lib/public-source-reader/barrier-detection.mjsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code