Loading npm security reports…

litclaude-ai@0.4.3: Malicious npm security report (Block) | LPM Firewall

registry / litclaude-ai / 0.4.3

litclaude-ai@0.4.3

Claude Code-native workflow distribution.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A global npm install automatically modifies the user's Claude Code plugin and settings surface. Later management commands can fetch a newer package version and execute that version's install flow.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global npm installation triggers postinstall; later interactive install, update, or doctor commands can trigger the updater.

Impact

The package can persist a plugin and alter Claude Code permissions, registry, marketplace, HUD, and settings without an explicit setup command.

Mechanism

Automatic Claude configuration mutation and same-package version-selected npm execution.

Attack narrative

On a global npm install, postinstall invokes the package's install command. That command copies and enables a Claude plugin, changes the Claude registry and marketplace, and updates global settings. The package also maintains an update mechanism that runs npm with a selected release of litclaude-ai and invokes that release's install command, creating a nested lifecycle path that can replace the Claude control surface.

Rationale

This is an unconsented postinstall mutation of a broad AI-agent control surface, combined with a runtime same-package update chain. The source establishes the complete install-hook abuse path even though it does not show secret theft.

Evidence

package.jsonscripts/postinstall.mjsbin/litclaude-ai.jsplugins/litclaude/lib/automatic-update.mjs~/.claude/plugins/cache/litclaude-ai~/.claude/plugins/installed_plugins.json

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/qa-uiux-visual-qa-scenarios.mjsView file

83const fixtureBytes = await bounded(fixturesRoot, "scenarios.json"); L84: const strict = await import(pathToFileURL(join(installedRoot, "lib/strict-json.mjs")).href); L85: const tui = await import(pathToFileURL(

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/qa-uiux-visual-qa-scenarios.mjsView on unpkg · L83

plugins/litclaude/skills/deep-interview/scripts/render_progress.pyView file

•path = plugins/litclaude/skills/deep-interview/scripts/render_progress.py kind = build_helper sizeBytes = 7185 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/litclaude/skills/deep-interview/scripts/render_progress.pyView on unpkg

plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.pyView file

•path = plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/litclaude/vendor/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

bin/litclaude-ai.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/litclaude-ai.js#virtual:normalized:round1View on unpkg

plugins/litclaude/lib/automatic-update.mjsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = plugins/litclaude/lib/automatic-update.mjs matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/litclaude/lib/automatic-update.mjsView on unpkg

bin/update-notifier.mjsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = bin/update-notifier.mjs matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/update-notifier.mjsView on unpkg

plugins/litclaude/skills/lsp-setup/scripts/verify-lsp.tsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = plugins/litclaude/skills/lsp-setup/scripts/verify-lsp.ts matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/litclaude/skills/lsp-setup/scripts/verify-lsp.tsView on unpkg

scripts/qa-negative-gate-matrix.mjsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = scripts/qa-negative-gate-matrix.mjs matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/qa-negative-gate-matrix.mjsView on unpkg

plugins/litclaude/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/litclaude/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg

scripts/inspect-agent-tools.mjsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = scripts/inspect-agent-tools.mjs matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inspect-agent-tools.mjsView on unpkg

scripts/qa-installed-tamper-repair.mjsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = scripts/qa-installed-tamper-repair.mjs matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/qa-installed-tamper-repair.mjsView on unpkg

plugins/litclaude/lib/public-source-reader/barrier-detection.mjsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = plugins/litclaude/lib/public-source-reader/barrier-detection.mjs matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/litclaude/lib/public-source-reader/barrier-detection.mjsView on unpkg

plugins/litclaude/lib/public-source-reader/guard.mjsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = plugins/litclaude/lib/public-source-reader/guard.mjs matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/litclaude/lib/public-source-reader/guard.mjsView on unpkg

plugins/litclaude/lib/skill-loop/hook-runtime.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = litclaude-ai@0.3.43 matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.43 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/litclaude/lib/skill-loop/hook-runtime.mjsView on unpkg