Loading npm security reports…

pinglet-cli@0.5.4: Malicious npm security report (Block) | LPM Firewall

registry / pinglet-cli / 0.5.4

pinglet-cli@0.5.4

Short messages from other developers shown in your Claude Code spinner while the AI thinks — zero tokens, never reads your code. Claude Code / Codex integration

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A global installation automatically modifies Claude Code's settings and installs command files. The package later performs detached self-updates that install another registry release.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm global installation, followed by Claude statusline activity.

Impact

Claude Code is configured to execute this package and to permit its Node Bash commands without an explicit setup command.

Mechanism

Lifecycle-installed Claude control-surface mutation with silent global self-update.

Attack narrative

Installing the package globally triggers its postinstall hook, which runs the installer without an explicit Pinglet setup command. When Claude is detected, the installer changes ~/.claude/settings.json, registers the package as the status-line command, adds Bash permission rules, and writes slash-command files that run its CLI. During later statusline maintenance it checks npm and silently launches a detached global installation of the latest pinglet-cli release, allowing a future release to repeat the lifecycle chain.

AI rationale

This is an unconsented postinstall mutation of a foreign AI-agent control surface, combined with shell permissions and automatic installation of future releases. The behavior is concrete in source and meets the publish-block boundary.

Evidence

package.jsondist/postinstall.jsdist/commands/install.jsdist/adapters/claude.jsdist/update.js~/.claude/settings.json~/.claude/commands/pinglet.md~/.claude/commands/pinglet-login.md

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/update.jsView file

37exports.maybeSelfUpdate = maybeSelfUpdate; L38: const child_process_1 = require("child_process"); L39: const path = __importStar(require("path")); L40: const config_1 = require("./config"); L41: const REGISTRY_LATEST_URL = "https://registry.npmjs.org/pinglet-cli/latest"; L42: const CHECK_INTERVAL_MS = 24 * 3600_000; // 하루 1회 확인 ... L45: function npm[redacted]() { L46: return process.platform === "win32" ? { shell: true } : {}; L47: } ... L54: return null; L55: const body = (await res.json()); L56: return typeof body.version === "string" ? body.version : null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/update.jsView on unpkg · L37

dist/adapters/claude.jsView file

49const render_1 = require("../render"); L50: const CLAUDE_DIR = path.join(os.homedir(), ".claude"); L51: const SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json"); ... L109: function installSlashCommand() { L110: fs.mkdirSync(COMMANDS_DIR, { recursive: true }); L111: const cli = (0, config_1.cliPath)(); ... L148: for (const [name, body] of Object.entries(files)) { L149: fs.writeFileSync(path.join(COMMANDS_DIR, name), body); L150: } ... L218: function writeSettings(settings, expectedMtimeMs) { L219: fs.mkdirSync(CLAUDE_DIR, { recursive: true }); L220: if (settingsMtimeMs() !== expectedMtimeMs)

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/adapters/claude.jsView on unpkg · L49

dist/config.jsView file

•matchType = token_shingles matchedPackage = pinglet-cli@0.1.3 matchedPath = dist/config.js matchedIdentity = npm:cGluZ2xldC1jbGk:0.1.3 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg