registry / pinglet-cli / 0.1.3

pinglet-cli@0.1.3

AI가 생각하는 동안 다른 개발자의 Ping을 만나는 메시지 네트워크 — Claude Code / Codex integration

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically configures detected third-party AI CLIs to execute Pinglet. It also registers the installation and obtains remote feed content.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install -g pinglet-cli on a host with Claude Code or Codex detected

Impact

Subsequent AI-agent lifecycle events execute package code and display server-provided content.

Mechanism

postinstall hook writes Claude/Codex control-surface hooks

Policy narrative

On global installation, postinstall runs setup with no user command. If Claude Code or Codex is detected, setup writes their configuration so later status-line or notify events run Pinglet; it also registers the installation and downloads remote feed data. This is an unconsented install-time mutation of foreign AI-agent control surfaces.

Rationale

The package’s postinstall automatically modifies detected Claude Code and Codex hook configuration. This meets the blocking policy for unconsented install-time mutation of foreign AI-agent control surfaces.

Evidence

package.jsondist/postinstall.jsdist/commands/install.jsdist/adapters/codex.jsdist/adapters/claude.jsdist/api.js~/.codex/config.toml~/.claude/settings.json~/.claude/commands/pinglet.md~/.pinglet/config.json

Network endpoints1

pinglet.halluci.co.kr

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

postinstall automatically invokes integration setup on global installation.
Setup detects Claude/Codex and installs both integrations without an explicit command.
Codex adapter overwrites the CLI notify hook to execute Pinglet.
Claude adapter writes a status-line command and slash-command file.
Install registers the host with a remote service and fetches server-supplied feed content.

Evidence against

The lifecycle path is limited to global installs.
Existing foreign hook values are preserved unless forced.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 64.3 KB of source, external domains: pinglet.halluci.co.kr

Source & flagged code

4 flagged

package.jsonView file

Lines 12-42json

12 "url": "https://github.com/mabyko/pinglet-client/issues"

13 },

14 "keywords": [

15 "claude-code",

16 "codex",

17 "statusline",

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/adapters/claude.jsView file

48const render_1 = require("../render"); L49: const CLAUDE_DIR = path.join(os.homedir(), ".claude"); L50: const SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json"); ... L85: function installSlashCommand() { L86: fs.mkdirSync(COMMANDS_DIR, { recursive: true }); L87: fs.writeFileSync(COMMAND_PATH, `--- L88: description: 메시지를 Pinglet에 등록해 다른 개발자들의 터미널에 표시 ... L141: function writeSettings(settings) { L142: fs.mkdirSync(CLAUDE_DIR, { recursive: true }); L143: // settings.json은 Claude Code가 수시로 읽는 파일이라 tmp+rename으로 원자적으로 쓴다. L144: const tmp = SETTINGS_PATH + ".pinglet-tmp"; L145: fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");

Findings

1 Critical2 High4 Medium5 Low

CriticalAi Agent Control Hijackdist/adapters/claude.js

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltadist/config.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/adapters/claude.jsView on unpkg · L48

dist/config.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pinglet-cli@0.1.0 matchedIdentity = npm:cGluZ2xldC1jbGk:0.1.0 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config.jsView on unpkg

node >=18

Artifact70.6 KB · 24 files1 signature(s)

Install lifecyclepostinstallprepare

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

4 flagged

package.jsonView file

Lines 12-42json

12 "url": "https://github.com/mabyko/pinglet-client/issues"

13 },

14 "keywords": [

15 "claude-code",

16 "codex",

17 "statusline",

18 "spinner",

19 "cli",

20 "developer-community"

21 ],

22 "bin": {

23 "pinglet": "dist/cli.js"

24 },

25 "files": [

26 "dist"

27 ],

28 "scripts": {

29 "build": "tsc",

30 "dev": "tsc --watch",

31 "prepare": "npm run build",

32 "postinstall": "node dist/postinstall.js || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "engines": {

35 "node": ">=18"

36 },

37 "devDependencies": {

38 "@types/node": "^20.14.0",

39 "typescript": "^5.5.0"

40 }

41}

42

dist/adapters/claude.jsView file

Lines 28-68javascript

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys

dist/config.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pinglet-cli@0.1.0 matchedIdentity = npm:cGluZ2xldC1jbGk:0.1.0 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config.jsView on unpkg

(mod), i

=

0

; i

<

k.

length

; i

++

)

if

(k[i]

!==

"default"

)

__createBinding

(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.detectClaude = detectClaude;

37exports.syncSpinnerVerbs = syncSpinnerVerbs;

38exports.spinnerVerbsStatus = spinnerVerbsStatus;

39exports.isClaudeIntegrationInstalled = isClaudeIntegrationInstalled;

40exports.installClaudeIntegration = installClaudeIntegration;

41exports.uninstallClaudeIntegration = uninstallClaudeIntegration;

42const fs = __importStar(require("fs"));

43const os = __importStar(require("os"));

44const path = __importStar(require("path"));

45const child_process_1 = require("child_process");

46const config_1 = require("../config");

47const cache_1 = require("../cache");

48const render_1 = require("../render");

49const CLAUDE_DIR = path.join(os.homedir(), ".claude");

50const SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/adapters/claude.jsView on unpkg · L48

51const COMMANDS_DIR = path.join(CLAUDE_DIR, "commands");

52const COMMAND_PATH = path.join(COMMANDS_DIR, "pinglet.md");

53const COMMAND_MARKER = "generated by pinglet";

54/**

55 * Claude Adapter.

56 * Claude Code의 statusLine hook에 `pinglet statusline`을 연결한다.

57 * - statusline은 UI 영역이므로 LLM context에 전혀 들어가지 않는다 (Zero Token).

58 * - Claude가 Thinking/Working 중일 때 status 영역에 Ping 메시지가 보인다.

59 */

60function detectClaude() {

61 if (fs.existsSync(CLAUDE_DIR))

62 return true;

63 try {

64 (0, child_process_1.execFileSync)(process.platform === "win32" ? "where" : "which", ["claude"], {

65 stdio: "ignore",

66 });

67 return true;

68 }