registry / luckiest-co / 1.0.47
luckiest-co@1.0.47
Luckiest for Claude Code: plan, go, finish. Your luckiest.co skills and tribe, inside Claude.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe package has no npm install lifecycle hook, and the settings hook for CLI installs requires opt-in. Source inspection ties the remaining flagged operations to explicit product utilities or first-party usage reporting, with no confirmed attack behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
There is no automatic npm install trigger; the CLI usage hook is registered only for a global install after consent or explicit opt-in.
Impact
No malicious effect was established from the inspected source.
Mechanism
The optional hook reports Luckiest skill usage metadata to the package's API. Other flagged network and process operations support explicit package functions.
AI rationale
The package has no npm install lifecycle hook, and the settings hook for CLI installs requires opt-in. Source inspection ties the remaining flagged operations to explicit product utilities or first-party usage reporting, with no confirmed attack behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and its only lifecycle-adjacent script is prepublishOnly version validation; no npm install hook is declared.
- The CLI registers the usage hook only for global installs after a prompt or explicit opt-in; unattended installs default to skipping it.
- The usage hook filters for Luckiest skills and sends skill metadata and hashed identifiers to the package's API for usage reporting.
- Flagged shell and package-manager operations belong to explicitly invoked helpers, including graph rendering and a video QA helper that uses npx only when its optional dependency is absent.
- The update hook checks a public plugin manifest at most weekly and displays a notice when a newer version is found.
- The brainstorming server defaults to loopback, and the trend helper fetches public X pages and bundles to discover query IDs.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
12 flaggedbin/sync-plugin-repo.jsView file
6L7: const { execFileSync } = require('child_process');
L8: const fs = require('fs');
High
Child Process
Package source references child process execution.
bin/sync-plugin-repo.jsView on unpkg · L6skills/video-studio/scripts/qa.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = luckiest-co@1.0.41
matchedIdentity = npm:bHVja2llc3QtY28:1.0.41
similarity = 0.976
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
skills/video-studio/scripts/qa.mjsView on unpkg690passes = prompts.map((p, i) => {
L691: const r = spawnSync(opt("--cmd"), { shell: true, input: p, encoding: "utf8", maxBuffer: 1 << 26 });
L692: writeFileSync(join(out, `pass${i + 1}.txt`), (r.stdout ?? "") + (r.stderr ?? ""));
Findings
1 Critical9 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltaskills/video-studio/scripts/qa.mjs
HighChild Processbin/sync-plugin-repo.js
HighShellskills/video-studio/scripts/qa.mjs
HighSame File Env Network Executionbin/install.js
HighExternal Ai Agent Control Surface Mutationhooks/update-notice.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighRuntime Package Installskills/video-studio/scripts/qa.mjs
HighSemantic Analysis Limitedskills/coder-brainstorming/scripts/server.cjs#virtual:normalized:round1
HighKnown Malware Source Similarityskills/coder-writing-skills/render-graphs.js
HighKnown Malware Source Similarityskills/trends/scripts/lib/vendor/bird-search/lib/runtime-query-ids.js
Affected versions and remediation
This report applies to luckiest-co@1.0.47.
See all versions of luckiest-co for other recorded verdicts.
- Review the evidence and your use of luckiest-co@1.0.47 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.