registry / power-claude / 3.0.82

power-claude@3.0.82

⚠ Under review

Local orchestration for Claude Code — session recovery, scheduling, worktrees, Token Saver, and dashboards via official CLI transport. Independent third-party software. Free to start.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscated

Manifest

NoLicense

scanned 2 file(s), 568 KB of source

Oversized source lightweight scan

bin/power-claude-cli.js2.51 MB file, sampled 256 KB

FilesystemCryptoDynamicRequireObfuscatedHighEntropyStringsMinified

out/extension.js5.72 MB file, sampled 256 KB

FilesystemChildProcessCryptoDynamicRequireObfuscatedHighEntropyStringsMinified

Source & flagged code

8 flagged

package.jsonView file

Lines 2560-2600json

2560 }

2561 }

2562 }

2563 ],

2564 "keybindings": [

2565 {

2566 "command": "powerClaude.searchSessions",

2567 "key": "ctrl+alt+s",

2568 "mac": "cmd+alt+s",

2569 "when": "workbenchState != empty"

2570 },

2571 {

2572 "command": "powerClaude.searchOpenTabsQuickPick",

2573 "key": "ctrl+alt+shift+s",

2574 "mac": "cmd+alt+shift+s",

2575 "when": "workbenchState != empty"

2576 }

2577 ]

2578 },

2579 "scripts": {

2580 "postinstall": "node -e \"const{existsSync}=require('fs');const{spawnSync}=require('child_process');const s='scripts/release/merge-drivers/register.sh';if(!existsSync(s))process.exit(0);const r=spawnSync('bash',[s],{stdio:'inherit'});process.exit(r.status??0)\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L2580

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L2580

2581 "prepublishOnly": "bash scripts/release/gate/prepublish-npm.sh",

2582 "vscode:prepublish": "bash scripts/release/prepublish.sh",

2583 "validate:settings": "if [ -f ../hurc-harness/tools/settings-docs/validate.mjs ]; then node ../hurc-harness/tools/settings-docs/validate.mjs --package package.json --min 40; else echo 'WARN: hurc-harness settings validator missing — skipping settings-docs gate'; fi",

2584 "docs:settings": "if [ -f ../hurc-harness/tools/settings-docs/generate.mjs ]; then node ../hurc-harness/tools/settings-docs/generate.mjs --package package.json --title \"Power Claude\" --out-md docs/settings/reference.md --out-json docs/settings/reference.json; else echo 'WARN: hurc-harness settings doc generator missing — skipping'; fi",

2585 "test:prepublish": "node scripts/release/run-vitest-prepublish.mjs",

2586 "test:prepublish:raw": "vitest run --reporter=basic --no-coverage --config=vitest.config.prepublish.ts",

2587 "test:replay": "bash test/replay/run-replay-suite.sh",

2588 "test:messaging": "bash test/messaging/roundtrip.sh",

2589 "compile": "tsc -p ./ --noEmit",

2590 "vscode:uninstall": "node ./out/uninstall-hook.js",

2591 "inject:version": "bash scripts/build/inject-version.sh",

2592 "vendor:sync": "bash scripts/vendor/sync-token-engines.sh && bash scripts/vendor/sync-jq.sh",

2593 "sync:media": "node scripts/build/sync-media.mjs --src node_modules/@cj-hurc/webview-ui/static --dest media --prefix pc",

2594 "deps:refresh-internal": "node scripts/build/refresh-internal-deps.mjs",

2595 "gen:readme": "node scripts/build/install-channels.mjs --write",

2596 "gen:savings": "node scripts/build/savings-model.mjs --write",

2597 "check:savings": "node scripts/build/savings-model.mjs --check",

2598 "build": "npm run inject:version && npm run gen:readme && npm run gen:savings && npm run vendor:sync && npm run sync:media && node esbuild.config.mjs && node scripts/build/emit-cli-manifest.mjs && node scripts/build/emit-system-index.mjs",

2599 "build:dev": "npm run deps:refresh-internal && npm run inject:version && npm run gen:readme && npm run gen:savings && npm run vendor:sync && npm run sync:media && PC_DEV_BUILD=1 node esbuild.config.mjs && node scripts/build/emit-cli-manifest.mjs && node scripts/build/emit-system-index.mjs",

2600 "build:prod": "npm run inject:version && npm run gen:readme && npm run gen:savings && npm run vendor:sync && npm run sync:media && NODE_ENV=production node esbuild.config.mjs && node scripts/build/emit-cli-manifest.mjs && node scripts/build/emit-system-index.mjs",

bin/power-claude-stop-classifier.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';const _0x355d9f=_0x177c;(function(_0x20faaa,_0x199587){const _0x433fb4=_0x177c,_0xe971fe=_0x20faaa();while(!![]){try{const _0x406380=parseInt(_0x433fb4(0x176

data/vendor/jq/jq-darwin-amd64View file

•path = data/vendor/jq/jq-darwin-amd64 kind = native_binary sizeBytes = 851328 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

data/vendor/jq/jq-darwin-amd64View on unpkg

data/runtime/engine.encView file

•path = data/runtime/engine.enc kind = high_entropy_blob sizeBytes = 486825 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

data/runtime/engine.encView on unpkg

bin/power-claude-cli.jsView file

•path = bin/power-claude-cli.js kind = oversized_source_file sizeBytes = 2636412 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/power-claude-cli.jsView on unpkg

•path = bin/power-claude-cli.js kind = oversized_cli_entrypoint sizeBytes = 2636412 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/power-claude-cli.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const{existsSync}=require('fs');const{spawnSync}=require('child_process');const s='scripts/release/merge-drivers/register.sh';if(!existsSync(s))process.exit(0);const r=spa...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/power-claude-stop-classifier.jsView file

1#!/usr/bin/env node L2: 'use strict';const _0x355d9f=_0x177c;(function(_0x20faaa,_0x199587){const _0x433fb4=_0x177c,_0xe971fe=_0x20faaa();while(!![]){try{const _0x406380=parseInt(_0x433fb4(0x176,'6Wel'))/...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/power-claude-stop-classifier.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/power-claude-stop-classifier.jsView on unpkg · L1

data/vendor/jq/jq-darwin-amd64View file

•path = data/vendor/jq/jq-darwin-amd64 kind = native_binary sizeBytes = 851328 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

data/vendor/jq/jq-darwin-amd64View on unpkg

data/runtime/engine.encView file

•path = data/runtime/engine.enc kind = high_entropy_blob sizeBytes = 486825 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

data/runtime/engine.encView on unpkg

bin/power-claude-cli.jsView file

•path = bin/power-claude-cli.js kind = oversized_source_file sizeBytes = 2636412 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/power-claude-cli.jsView on unpkg

•path = bin/power-claude-cli.js kind = oversized_cli_entrypoint sizeBytes = 2636412 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/power-claude-cli.jsView on unpkg

Findings

1 Critical5 High4 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighObfuscated Payload Loaderbin/power-claude-stop-classifier.js

HighObfuscated

HighShips High Entropy Blobdata/runtime/engine.enc

HighOversized Source Filebin/power-claude-cli.js

MediumDynamic Requirebin/power-claude-stop-classifier.js

MediumShips Native Binarydata/vendor/jq/jq-darwin-amd64

MediumOversized Cli Entrypointbin/power-claude-cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

8 flagged

package.jsonView file

Lines 2560-2600json

2560 }

2561 }

2562 }

2563 ],

2564 "keybindings": [

2565 {

2566 "command": "powerClaude.searchSessions",

2567 "key": "ctrl+alt+s",

2568 "mac": "cmd+alt+s",

2569 "when": "workbenchState != empty"

2570 },

2571 {

2572 "command": "powerClaude.searchOpenTabsQuickPick",

2573 "key": "ctrl+alt+shift+s",

2574 "mac": "cmd+alt+shift+s",

2575 "when": "workbenchState != empty"

2576 }

2577 ]

2578 },

2579 "scripts": {

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L2580

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L2580

2581 "prepublishOnly": "bash scripts/release/gate/prepublish-npm.sh",

2582 "vscode:prepublish": "bash scripts/release/prepublish.sh",

2585 "test:prepublish": "node scripts/release/run-vitest-prepublish.mjs",

2586 "test:prepublish:raw": "vitest run --reporter=basic --no-coverage --config=vitest.config.prepublish.ts",

2587 "test:replay": "bash test/replay/run-replay-suite.sh",

2588 "test:messaging": "bash test/messaging/roundtrip.sh",

2589 "compile": "tsc -p ./ --noEmit",

2590 "vscode:uninstall": "node ./out/uninstall-hook.js",

2591 "inject:version": "bash scripts/build/inject-version.sh",

2592 "vendor:sync": "bash scripts/vendor/sync-token-engines.sh && bash scripts/vendor/sync-jq.sh",

2593 "sync:media": "node scripts/build/sync-media.mjs --src node_modules/@cj-hurc/webview-ui/static --dest media --prefix pc",

2594 "deps:refresh-internal": "node scripts/build/refresh-internal-deps.mjs",

2595 "gen:readme": "node scripts/build/install-channels.mjs --write",

2596 "gen:savings": "node scripts/build/savings-model.mjs --write",

2597 "check:savings": "node scripts/build/savings-model.mjs --check",

bin/power-claude-stop-classifier.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';const _0x355d9f=_0x177c;(function(_0x20faaa,_0x199587){const _0x433fb4=_0x177c,_0xe971fe=_0x20faaa();while(!![]){try{const _0x406380=parseInt(_0x433fb4(0x176

data/vendor/jq/jq-darwin-amd64View file

•path = data/vendor/jq/jq-darwin-amd64 kind = native_binary sizeBytes = 851328 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

data/vendor/jq/jq-darwin-amd64View on unpkg

data/runtime/engine.encView file

•path = data/runtime/engine.enc kind = high_entropy_blob sizeBytes = 486825 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

data/runtime/engine.encView on unpkg

bin/power-claude-cli.jsView file

•path = bin/power-claude-cli.js kind = oversized_source_file sizeBytes = 2636412 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/power-claude-cli.jsView on unpkg

•path = bin/power-claude-cli.js kind = oversized_cli_entrypoint sizeBytes = 2636412 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/power-claude-cli.jsView on unpkg