openzoo@0.50.99: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

openzoo@0.50.99: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

bin/claude-zoo.jsView file

17*/ L18: import { spawn } from 'node:child_process'; L19: import { existsSync, readdirSync as fsReaddir, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/claude-zoo.jsView on unpkg · L17

65]) { L66: try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ } L67: }

High

Shell

Package source references shell execution.

bin/claude-zoo.jsView on unpkg · L65

50L51: const PROXY_PORT = Number(process.env.OPENZOO_PROXY_PORT || 8402); L52: const PROXY_URL = `http://localhost:${PROXY_PORT}/v1`; L53: ... L65: ]) { L66: try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ } L67: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-zoo.jsView on unpkg · L50

lib/xbot.jsView file

26L27: const GATEWAY = process.env.OPENZOO_GATEWAY || 'https://x402-tokens.fly.dev'; L28: /** ... L134: * acceptable: there is nothing in it that its author did not already publish. L135: * Do not reuse this pattern anywhere the material is private — a shared context L136: * means any question can recall any bound slice. ... L140: const STATE_FILE = process.env.OPENZOO_XBOT_STATE L141: || path.join(os.homedir(), '.openzoo', 'xbot.json'); L142: ... L151: try { L152: const d = JSON.parse(fs.readFileSync(file, 'utf8')); L153: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/xbot.jsView on unpkg · L26

lib/worktree.mjsView file

130return project L131: ? `https://gitlab.com/api/v4/projects/${encodeURIComponent(project)}/merge_requests/${n}` L132: : null; ... L140: if (!r.ok) process.exit(1); L141: process.stdout.write(await r.text()); L142: `; L143: const body = execFileSync(process.execPath, ['--input-type=module', '-e', src], { L144: encoding: 'utf8',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/worktree.mjsView on unpkg · L130

lib/aoe.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/aoe.js#virtual:normalized:round1View on unpkg

lib/cursorbackend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openzoo@0.50.55 matchedIdentity = npm:b3Blbnpvbw:0.50.55 similarity = 0.648 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cursorbackend.jsView on unpkg

Source & flagged code

7 flagged

bin/claude-zoo.jsView file

Lines 1-85javascript

1#!/usr/bin/env node

2/**

3 * `claude` — the openzoo-backed Claude Code command.

4 *

5 * Replaces the raw occ launcher. Same binary, but every request goes through

6 * the local openzoo proxy on :8402 (x402 per-call payment, no Anthropic

7 * subscription, no login):

8 *

9 * - starts the proxy if it is not already THIS version on :8402 (steals stale)

10 * - applies claudeZooEnv(): ANTHROPIC_BASE_URL=localhost:PORT/v1,

11 * AUTH_TOKEN=sk-openzoo, ANTHROPIC_API_KEY deleted, compaction disabled

12 * (the proxy binds the prefix), 1M-token ceiling restored

13 * - execs occ (open-claude-code) with your original argv

14 *

15 * The old direct-to-Anthropic-capable launcher is preserved as

16 * `claude-code-cli` (same directory, symlinked to occ).

17 */

18import { spawn } from 'node:child_process';

19import { existsSync, readdirSync as fsReaddir, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/claude-zoo.jsView on unpkg · L17

20import { execSync } from 'node:child_process';

21import { homedir, platform } from 'node:os';

22import { dirname, join, sep } from 'node:path';

23import { fileURLToPath } from 'node:url';

24

25const here = dirname(fileURLToPath(import.meta.url));

26const shimRoot = dirname(here);

27

28// occ lives beside us (nvm bin/occ) or, if this wrapper is copied elsewhere,

29// we fall back to searching the nvm tree we were installed from.

30function findOcc() {

31 const candidate = join(here, 'occ');

32 if (existsSync(candidate)) return candidate;

33 {

34 const versions = join(homedir(), '.nvm', 'versions', 'node');

35 try {

36 for (const v of fsReaddir(versions).sort().reverse()) {

37 const p = join(versions, v, 'bin', 'occ');

38 if (existsSync(p)) return p;

39 }

40 } catch { /* fall through */ }

41 }

42 return null;

43}

44

45const occ = findOcc();

46if (!occ) {

47 console.error('claude: cannot find occ (open-claude-code) next to this wrapper.');

48 process.exit(1);

49}

50

51const PROXY_PORT = Number(process.env.OPENZOO_PROXY_PORT || 8402);

52const PROXY_URL = `http://localhost:${PROXY_PORT}/v1`;

53

54function mineVersion() {

55 try {

56 return JSON.parse(readFileSync(join(shimRoot, 'package.json'), 'utf8')).version;

57 } catch { return ''; }

58}

59

60function stealPort(port) {

61 const n = Number(port);

62 for (const cmd of [

63 `lsof -t -iTCP:${n} -sTCP:LISTEN | xargs kill -9`,

64 `fuser -k ${n}/tcp`,

65 ]) {

66 try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ }

67 }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-zoo.jsView on unpkg · L50

High

Shell

Package source references shell execution.

bin/claude-zoo.jsView on unpkg · L65

68}

69

70async function proxyUp() {

71 try {

72 const r = await fetch(`http://localhost:${PROXY_PORT}/v1/info`, { signal: AbortSignal.timeout(1500) });

73 if (!r.ok) return false;

74 const j = await r.json().catch(() => ({}));

75 const mine = mineVersion();

76 if (mine && String(j.version || '') !== mine) {

77 console.error(`claude: stale proxy v${j.version || '?'} on :${PROXY_PORT} — stealing for v${mine}`);

78 stealPort(PROXY_PORT);

79 return false;

80 }

81 return true;

82 } catch { return false; }

83}

84

85async function ensureProxy() {

lib/xbot.jsView file

Lines 6-46javascript

6 * would have cost on OpenRouter. That receipt is the product — a reply that

7 * just answers is a worse @grok, a reply that prices itself is the pitch.

8 *

9 * WHY THE COMPARISON IS AGAINST A NAMED

lib/worktree.mjsView file

Lines 110-150javascript

110 }

111}

112

113export function githubRepoFromOrigin(originUrl) {

114 const m = /github\.com[:/]([^/]+)

lib/aoe.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/aoe.js#virtual:normalized:round1View on unpkg

lib/cursorbackend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openzoo@0.50.55 matchedIdentity = npm:b3Blbnpvbw:0.50.55 similarity = 0.648 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cursorbackend.jsView on unpkg