registry / moodline / 0.3.23

moodline@0.3.23

Statusline divertida e informativa para CLIs de IA (Claude Code, GitHub Copilot CLI e mais): barra de contexto em gradiente, emoji-humor, git, custo e trocadilhos de dev.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface was found. The package is a user-invoked AI CLI statusline installer that mutates Claude/Copilot user settings and installs its own copied engine, which creates agent extension lifecycle risk but not unconsented install-time hijack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs moodline init/enable/config/coauthor/update/watch or installed statusLine refresh executes the copied engine

Impact

Can alter user-level Claude/Copilot statusline configuration and run moodline-core on statusline refresh; no evidence of credential theft, remote payload execution, or install-time mutation.

Mechanism

Explicit user-command agent statusline setup and update checks

Rationale

Source inspection shows explicit user-invoked setup of first-party statusline integrations for Claude/Copilot, with no lifecycle hook or hidden install-time control-surface mutation. Because it writes AI-agent configuration and drops a Claude command template, the appropriate firewall action is warn rather than block.

Evidence

package.jsonbin/moodline.jslib/install.mjslib/moodline-core.mjslib/jdi.mjslib/commands/moodline.command.md~/.claude/settings.json~/.copilot/settings.json~/.claude/moodline/moodline-core.mjs~/.copilot/moodline/moodline-core.mjs~/.claude/commands/moodline.md

Network endpoints3

registry.npmjs.org/moodline/latestregistry.npmjs.org/jdi-cli/latest127.0.0.1:4096/session

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

lib/install.mjs writes user-level ~/.claude/settings.json and ~/.copilot/settings.json statusLine commands
lib/install.mjs copies engine files into ~/.claude/moodline and ~/.copilot/moodline and may write ~/.claude/commands/moodline.md
lib/commands/moodline.command.md is a Claude command template allowed to run moodline commands
bin/moodline.js update invokes npm global install, but only from explicit moodline update command
lib/moodline-core.mjs spawns detached --update-check and fetches npm registry update metadata

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks
Agent settings mutation is reached through explicit user commands such as init, enable, config, coauthor, or uninstall
No credential harvesting or exfiltration logic found
Network use is update/ad metadata to registry.npmjs.org and localhost OpenCode watch when user invokes watch
child_process use is bounded to absolute node/npm/git paths with shell:false or fixed git args
No eval/vm/Function, native binary loading, or destructive project-file behavior found

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 78.2 KB of source, external domains: 127.0.0.1, registry.npmjs.org

Source & flagged code

3 flagged

bin/moodline.jsView file

Lines 1-68javascript

1#!/usr/bin/env node

2// moodline — instalador/CLI. Escopo de instalacao SEMPRE global (user-level).

3//

4// moodline init wizard interativo (logo animado + seletor de CLIs/features)

5// moodline enable [--all] liga a statusline (Claude Code / Copilot CLI)

6// moodline disable [--all] desliga (mantem config; re-enable instantaneo)

7// moodline doctor mostra estado

8// moodline uninstall [--purge] remove a statusLine (e o engine com --purge)

9// moodline render le JSON no stdin e imprime a barra (teste)

10// moodline watch [experimental] poller pro OpenCode

11// moodline --help|--version

13import { readFileSync, existsSync } from 'node:fs';

14import { spawnSync } from 'node:child_process';

15import { join, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

bin/moodline.jsView on unpkg · L13

16import { fileURLToPath } from 'node:url';

17import { render, ADAPTERS, attachGit, loadConfig, fromOpenCode, cmpVer, coauthorState } from '../lib/moodline-core.mjs';

18import * as ui from '../lib/ui.mjs';

19import { printLogo, smallLogo } from '../lib/logo.mjs';

20import * as install from '../lib/install.mjs';

21import { validatePackageName, sanitizeForLog } from '../lib/sanitize.mjs';

23const C = ui.C;

24const HERE = dirname(fileURLToPath(import.meta.url));

25const PKG = JSON.parse(readFileSync(join(HERE, '..', 'package.json'), 'utf8'));

27// ---- seguranca (validacao/sanitizacao centralizadas em ../lib/sanitize.mjs) ----

28const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;

30// Resolve o npm-cli.js por caminho ABSOLUTO a partir do node em execucao (process.execPath),

31// sem consultar o PATH. Cobre os layouts comuns (npm oficial no Windows e <prefix>/lib no POSIX/nvm).

32function npmCliPath() {

33 const exeDir = dirname(process.execPath);

34 const candidates = [

35 join(exeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'), // Windows: <node>\node_modules\npm

36 join(exeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'), // POSIX: <prefix>/lib/node_modules/npm

37 ];

38 return candidates.find((p) => existsSync(p)) || null;

39}

41// Instala um pacote global SEM shell e SEM depender do PATH: roda o `npm-cli.js` (resolvido por

42// caminho absoluto a partir do node atual) com o proprio `node` (process.execPath, absoluto).

43// `pkg` validado por allowlist ANTES do spawn. Sem fallback por PATH -> evita S4036/CWE-426/427

44// (um `npm` malicioso num diretorio gravavel do PATH nunca e executado). Cross-platform: usa o

45// npm que acompanha o Node em execucao.

46function installGlobal(pkg) {

47 const safe = validatePackageName(pkg);

48 const cli = npmCliPath();

49 if (!cli) throw new Error('npm não encontrado junto ao Node em execução — atualize manualmente: npm install -g moodline');

50 return spawnSync(process.execPath, [cli, 'install', '-g', safe], { stdio: 'ignore', shell: false });

51}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/moodline.jsView on unpkg · L48

53function parseArgs(argv) {

54 const o = { _: [] };

55 for (const a of argv) {

56 if (a.startsWith('--')) { const [k, v] = a.slice(2).split('='); o[k] = v === undefined ? true : v; }

57 else o._.push(a);

58 }

59 return o;

60}

62const ALL_FEATURES = ['git', 'cost', 'rate', 'puns', 'coauthor'];

64async function cmdInit(opts) {

65 await printLogo({ animate: ui.isInteractive() && !opts['no-anim'] });

66 const home = opts.home;

67 const detected = install.detectInstalled(home);

68 const interactive = ui.isInteractive() && !opts.yes && !opts['no-input'];

lib/moodline-core.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = moodline@0.3.21 matchedIdentity = npm:bW9vZGxpbmU:0.3.21 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/moodline-core.mjsView on unpkg

Source & flagged code

3 flagged · loading source

bin/moodline.jsView file

13import { readFileSync, existsSync } from 'node:fs'; L14: import { spawnSync } from 'node:child_process'; L15: import { join, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

bin/moodline.jsView on unpkg · L13

48const cli = npmCliPath(); L49: if (!cli) throw new Error('npm não encontrado junto ao Node em execução — atualize manualmente: npm install -g moodline'); L50: return spawnSync(process.execPath, [cli, 'install', '-g', safe], { stdio: 'ignore', shell: false }); L51: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/moodline.jsView on unpkg · L48

lib/moodline-core.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/moodline-core.mjsView on unpkg

Findings

1 Critical3 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltalib/moodline-core.mjs

HighChild Processbin/moodline.js

HighShell

HighRuntime Package Installbin/moodline.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/moodline.jsView file

Lines 1-68javascript

1#!/usr/bin/env node

2// moodline — instalador/CLI. Escopo de instalacao SEMPRE global (user-level).

3//

4// moodline init wizard interativo (logo animado + seletor de CLIs/features)

5// moodline enable [--all] liga a statusline (Claude Code / Copilot CLI)

6// moodline disable [--all] desliga (mantem config; re-enable instantaneo)

7// moodline doctor mostra estado

8// moodline uninstall [--purge] remove a statusLine (e o engine com --purge)

9// moodline render le JSON no stdin e imprime a barra (teste)

10// moodline watch [experimental] poller pro OpenCode

11// moodline --help|--version

13import { readFileSync, existsSync } from 'node:fs';

14import { spawnSync } from 'node:child_process';

15import { join, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

bin/moodline.jsView on unpkg · L13

16import { fileURLToPath } from 'node:url';

17import { render, ADAPTERS, attachGit, loadConfig, fromOpenCode, cmpVer, coauthorState } from '../lib/moodline-core.mjs';

18import * as ui from '../lib/ui.mjs';

19import { printLogo, smallLogo } from '../lib/logo.mjs';

20import * as install from '../lib/install.mjs';

21import { validatePackageName, sanitizeForLog } from '../lib/sanitize.mjs';

23const C = ui.C;

24const HERE = dirname(fileURLToPath(import.meta.url));

25const PKG = JSON.parse(readFileSync(join(HERE, '..', 'package.json'), 'utf8'));

27// ---- seguranca (validacao/sanitizacao centralizadas em ../lib/sanitize.mjs) ----

28const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;

30// Resolve o npm-cli.js por caminho ABSOLUTO a partir do node em execucao (process.execPath),

31// sem consultar o PATH. Cobre os layouts comuns (npm oficial no Windows e <prefix>/lib no POSIX/nvm).

32function npmCliPath() {

33 const exeDir = dirname(process.execPath);

34 const candidates = [

35 join(exeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'), // Windows: <node>\node_modules\npm

36 join(exeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'), // POSIX: <prefix>/lib/node_modules/npm

37 ];

38 return candidates.find((p) => existsSync(p)) || null;

39}

41// Instala um pacote global SEM shell e SEM depender do PATH: roda o `npm-cli.js` (resolvido por

42// caminho absoluto a partir do node atual) com o proprio `node` (process.execPath, absoluto).

43// `pkg` validado por allowlist ANTES do spawn. Sem fallback por PATH -> evita S4036/CWE-426/427

44// (um `npm` malicioso num diretorio gravavel do PATH nunca e executado). Cross-platform: usa o

45// npm que acompanha o Node em execucao.

46function installGlobal(pkg) {

47 const safe = validatePackageName(pkg);

48 const cli = npmCliPath();

49 if (!cli) throw new Error('npm não encontrado junto ao Node em execução — atualize manualmente: npm install -g moodline');

50 return spawnSync(process.execPath, [cli, 'install', '-g', safe], { stdio: 'ignore', shell: false });

51}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/moodline.jsView on unpkg · L48

53function parseArgs(argv) {

54 const o = { _: [] };

55 for (const a of argv) {

56 if (a.startsWith('--')) { const [k, v] = a.slice(2).split('='); o[k] = v === undefined ? true : v; }

57 else o._.push(a);

58 }

59 return o;

60}

62const ALL_FEATURES = ['git', 'cost', 'rate', 'puns', 'coauthor'];

64async function cmdInit(opts) {

65 await printLogo({ animate: ui.isInteractive() && !opts['no-anim'] });

66 const home = opts.home;

67 const detected = install.detectInstalled(home);

68 const interactive = ui.isInteractive() && !opts.yes && !opts['no-input'];

lib/moodline-core.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/moodline-core.mjsView on unpkg