registry / pinglet-cli / 0.8.0

pinglet-cli@0.8.0

⚠ Under review

Short messages from other developers shown in your Claude Code spinner while the AI thinks — zero tokens, never reads your code. Claude Code / Codex integration

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 286 KB of source, external domains: 127.0.0.1, github.com, pinglet.halluci.co.kr, registry.npmjs.org

Source & flagged code

10 flagged

package.jsonView file

Lines 13-43json

13 },

14 "keywords": [

15 "claude-code",

16 "codex",

17 "statusline",

18 "spinner",

19 "cli",

20 "developer-community"

21 ],

22 "bin": {

23 "pinglet": "dist/cli.js"

24 },

25 "files": [

26 "dist"

27 ],

28 "scripts": {

29 "build": "tsc",

30 "test": "npm run build && node --test test/*.test.cjs",

31 "dev": "tsc --watch",

32 "prepare": "npm run build",

33 "postinstall": "node dist/postinstall.js || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "engines": {

36 "node": ">=18"

37 },

38 "devDependencies": {

39 "@types/node": "^20.14.0",

40 "typescript": "^5.5.0"

41 }

42}

dist/update.jsView file

Lines 17-57javascript

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

dist/adapters/claude.jsView file

Lines 31-71javascript

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.detectClaude = detectClaude;

dist/commands/login.jsView file

•matchType = normalized_sha256 matchedPackage = pinglet-cli@0.7.0 matchedPath = dist/commands/login.js matchedIdentity = npm:cGluZ2xldC1jbGk:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/login.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = pinglet-cli@0.7.0 matchedPath = dist/config.js matchedIdentity = npm:cGluZ2xldC1jbGk:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/commands/flush.jsView file

•matchType = normalized_sha256 matchedPackage = pinglet-cli@0.7.0 matchedPath = dist/commands/flush.js matchedIdentity = npm:cGluZ2xldC1jbGk:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/flush.jsView on unpkg

dist/hud/width.jsView file

•matchType = normalized_sha256 matchedPackage = pinglet-cli@0.7.0 matchedPath = dist/hud/width.js matchedIdentity = npm:cGluZ2xldC1jbGk:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hud/width.jsView on unpkg

dist/hud/git.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pinglet-cli@0.6.2 matchedIdentity = npm:cGluZ2xldC1jbGk:0.6.2 similarity = 0.690 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hud/git.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

pinglet-cli@0.8.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code