pinglet-cli@0.4.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

pinglet-cli@0.4.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/update.jsView file

37exports.maybeSelfUpdate = maybeSelfUpdate; L38: const child_process_1 = require("child_process"); L39: const path = __importStar(require("path")); L40: const config_1 = require("./config"); L41: const REGISTRY_LATEST_URL = "https://registry.npmjs.org/pinglet-cli/latest"; L42: const CHECK_INTERVAL_MS = 24 * 3600_000; // 하루 1회 확인 ... L45: function npm[redacted]() { L46: return process.platform === "win32" ? { shell: true } : {}; L47: } ... L54: return null; L55: const body = (await res.json()); L56: return typeof body.version === "string" ? body.version : null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/update.jsView on unpkg · L37

dist/adapters/claude.jsView file

48const render_1 = require("../render"); L49: const CLAUDE_DIR = path.join(os.homedir(), ".claude"); L50: const SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json"); ... L102: function installSlashCommand() { L103: fs.mkdirSync(COMMANDS_DIR, { recursive: true }); L104: fs.writeFileSync(COMMAND_PATH, `--- L105: description: 메시지를 Pinglet에 등록해 다른 개발자들의 터미널에 표시 ... L178: function writeSettings(settings, expectedMtimeMs) { L179: fs.mkdirSync(CLAUDE_DIR, { recursive: true }); L180: if (settingsMtimeMs() !== expectedMtimeMs) ... L183: // tmp 이름에 pid를 붙여 프로세스마다 다르게 만든다 — 여러 세션의 statusline이 L184: // 동시에 돌면 같은 tmp에 겹쳐 쓰게 되고, writeFileSync는 truncate 후 쓰기라

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/adapters/claude.jsView on unpkg · L48

dist/config.jsView file

•matchType = token_shingles matchedPackage = pinglet-cli@0.1.3 matchedPath = dist/config.js matchedIdentity = npm:cGluZ2xldC1jbGk:0.1.3 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/commands/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pinglet-cli@0.1.0 matchedIdentity = npm:cGluZ2xldC1jbGk:0.1.0 similarity = 0.381 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/login.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 12-42json

12 "url": "https://github.com/mabyko/pinglet-client/issues"

13 },

14 "keywords": [

15 "claude-code",

16 "codex",

17 "statusline",

18 "spinner",

19 "cli",

20 "developer-community"

21 ],

22 "bin": {

23 "pinglet": "dist/cli.js"

24 },

25 "files": [

26 "dist"

27 ],

28 "scripts": {

29 "build": "tsc",

30 "dev": "tsc --watch",

31 "prepare": "npm run build",

32 "postinstall": "node dist/postinstall.js || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "engines": {

35 "node": ">=18"

36 },

37 "devDependencies": {

38 "@types/node": "^20.14.0",

39 "typescript": "^5.5.0"

40 }

41}

42

dist/update.jsView file

Lines 17-57javascript

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

dist/adapters/claude.jsView file

Lines 28-68javascript

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys

dist/config.jsView file

•matchType = token_shingles matchedPackage = pinglet-cli@0.1.3 matchedPath = dist/config.js matchedIdentity = npm:cGluZ2xldC1jbGk:0.1.3 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/commands/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pinglet-cli@0.1.0 matchedIdentity = npm:cGluZ2xldC1jbGk:0.1.0 similarity = 0.381 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/login.jsView on unpkg