litclaude-ai@0.3.40: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

litclaude-ai@0.3.40: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/qa-uiux-visual-qa-scenarios.mjsView file

83const fixtureBytes = await bounded(fixturesRoot, "scenarios.json"); L84: const strict = await import(pathToFileURL(join(installedRoot, "lib/strict-json.mjs")).href); L85: const tui = await import(pathToFileURL(

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/qa-uiux-visual-qa-scenarios.mjsView on unpkg · L83

plugins/litclaude/skills/deep-interview/scripts/render_progress.pyView file

•path = plugins/litclaude/skills/deep-interview/scripts/render_progress.py kind = build_helper sizeBytes = 7185 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/litclaude/skills/deep-interview/scripts/render_progress.pyView on unpkg

plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.pyView file

•path = plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

plugins/litclaude/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/litclaude/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg

bin/update-notifier.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = litclaude-ai@0.3.30 matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.30 similarity = 0.788 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/update-notifier.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 10-50json

10 "files": [

11 "bin",

12 "docs/agents.md",

13 "docs/hooks.md",

14 "docs/lsp.md",

15 "docs/migration.md",

16 "docs/native-goal-surface.md",

17 "docs/rules.md",

18 "docs/workflow-compatibility-audit.md",

19 "plugins",

20 "scripts",

21 "README.md",

22 "README_ko-KR.md",

23 "CHANGELOG.md",

24 "cover.png",

25 "generate_cover.py",

26 "RELEASE_CHECKLIST.md",

27 "LICENSE"

28 ],

29 "scripts": {

30 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "test": "node --test test/*.test.mjs",

32 "validate:plugin": "node scripts/validate-plugin.mjs",

33 "doctor": "node scripts/doctor.mjs",

34 "qa:tmux": "bash scripts/qa-claude-plugin-smoke.sh",

35 "qa:portable": "bash scripts/qa-portable-install.sh",

36 "qa:matrix": "node scripts/qa-negative-gate-matrix.mjs",

37 "qa:matrix-negative-control": "node scripts/qa-negative-gate-matrix.mjs --negative-control",

38 "qa:tamper": "node scripts/qa-installed-tamper-repair.mjs",

39 "qa:behaviors": "node scripts/qa-real-surface-behaviors.mjs",

40 "qa:real-surface": "npm run qa:matrix && npm run qa:tamper && npm run qa:behaviors",

41 "pack:dry-run": "npm pack --dry-run",

42 "scan:legacy-tokens": "node tools/scan-legacy-tokens.mjs",

43 "check:version": "node tools/check-version-lockstep.mjs",

44 "assert:ci": "node tools/assert-ci-workflow.mjs",

45 "pack:payload-guard": "node tools/check-pack-payload.mjs",

46 "gen:runtime-closures": "node tools/gen-canonical-runtime-closures.mjs",

47 "check:runtime-closures": "node tools/gen-canonical-runtime-closures.mjs --check",

48 "gen:skill-resources": "node tools/gen-canonical-skill-resources.mjs",

49 "check:skill-resources": "node tools/gen-canonical-skill-resources.mjs --check"

50 },

scripts/qa-uiux-visual-qa-scenarios.mjsView file

Lines 63-103javascript

63 return result;

64}

65

66async function bounded(root, name, maximum = 1024 * 1024) {

plugins/litclaude/skills/deep-interview/scripts/render_progress.pyView file

•path = plugins/litclaude/skills/deep-interview/scripts/render_progress.py kind = build_helper sizeBytes = 7185 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/litclaude/skills/deep-interview/scripts/render_progress.pyView on unpkg

plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.pyView file

•path = plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

plugins/litclaude/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/litclaude/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg

bin/update-notifier.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = litclaude-ai@0.3.30 matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.30 similarity = 0.788 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/update-notifier.mjsView on unpkg