Loading npm security reports…

pinglet-cli@0.7.0: AI-agent control-surface risk | LPM Firewall

registry / pinglet-cli / 0.7.0

pinglet-cli@0.7.0

Short messages from other developers shown in your Claude Code spinner while the AI thinks — zero tokens, never reads your code. Claude Code / Codex integration

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically configures Claude Code when Claude is detected. It changes the status-line command and grants Bash rules to invoke this package.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global npm installation triggers postinstall.

Impact

The package gains recurring execution through Claude Code and expands its allowed Bash command surface without a user-issued setup command.

Mechanism

Automatic mutation of Claude Code settings and command permissions.

Policy narrative

During a global npm installation, postinstall calls the installer. If Claude Code is detected, the installer writes Claude settings that execute pinglet and adds Bash permission rules and command files. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The global postinstall path automatically mutates Claude Code configuration and permissions. This meets the install-control-surface blocking policy despite safeguards against replacing an existing status line.

Evidence

package.jsondist/postinstall.jsdist/commands/install.jsdist/adapters/claude.js~/.claude/settings.json~/.claude/commands/pinglet.md~/.claude/commands/pinglet-login.md~/.claude/commands/pinglet-logout.md~/.claude/commands/pinglet-hud.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/update.jsView file

37exports.maybeSelfUpdate = maybeSelfUpdate; L38: const child_process_1 = require("child_process"); L39: const path = __importStar(require("path")); L40: const config_1 = require("./config"); L41: const REGISTRY_LATEST_URL = "https://registry.npmjs.org/pinglet-cli/latest"; L42: const CHECK_INTERVAL_MS = 24 * 3600_000; // 하루 1회 확인 ... L45: function npm[redacted]() { L46: return process.platform === "win32" ? { shell: true } : {}; L47: } ... L54: return null; L55: const body = (await res.json()); L56: return typeof body.version === "string" ? body.version : null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/update.jsView on unpkg · L37

•matchType = normalized_sha256 matchedPackage = pinglet-cli@0.5.4 matchedPath = dist/update.js matchedIdentity = npm:cGluZ2xldC1jbGk:0.5.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update.jsView on unpkg

dist/adapters/claude.jsView file

51const storage_1 = require("../storage"); L52: const CLAUDE_DIR = path.join(os.homedir(), ".claude"); L53: const SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json"); ... L111: function installSlashCommand() { L112: fs.mkdirSync(COMMANDS_DIR, { recursive: true }); L113: const cli = (0, config_1.cliPath)(); ... L161: for (const [name, body] of Object.entries(files)) { L162: fs.writeFileSync(path.join(COMMANDS_DIR, name), body); L163: } ... L169: function ensureSlashCommands(config) { L170: if (!config.adapters.claude) L171: return;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/adapters/claude.jsView on unpkg · L51

dist/hud/git.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pinglet-cli@0.6.2 matchedIdentity = npm:cGluZ2xldC1jbGk:0.6.2 similarity = 0.759 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hud/git.jsView on unpkg