power-claude@3.0.98: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

power-claude@3.0.98: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const{existsSync}=require('fs');const{spawnSync}=require('child_process');const steps=['scripts/release/merge-drivers/register.sh','scripts/release/install-bypass-guard.sh...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const{existsSync}=require('fs');const{spawnSync}=require('child_process');const steps=['scripts/release/merge-drivers/register.sh','scripts/release/install-bypass-guard.sh...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/power-claude-cli.jsView file

1#!/usr/bin/env node L2: 'use strict';const _0x5025bd=_0x357f;(function(_0x5ad820,_0x205d44){const _0x4e2f5c=_0x357f,_0x50b832=_0x5ad820();while(!![]){try{const _0x8b73b8=-parseInt(_0x4e2f5c(0x1b8f,'$[8N')...

High

Child Process

Package source references child process execution.

bin/power-claude-cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';const _0x5025bd=_0x357f;(function(_0x5ad820,_0x205d44){const _0x4e2f5c=_0x357f,_0x50b832=_0x5ad820();while(!![]){try{const _0x8b73b8=-parseInt(_0x4e2f5c(0x1b8f,'$[8N')...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/power-claude-cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';const _0x5025bd=_0x357f;(function(_0x5ad820,_0x205d44){const _0x4e2f5c=_0x357f,_0x50b832=_0x5ad820();while(!![]){try{const _0x8b73b8=-parseInt(_0x4e2f5c(0x1b8f,'$[8N')...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/power-claude-cli.jsView on unpkg · L1

bin/power-claude-rotator.jsView file

1#!/usr/bin/env node L2: 'use strict';const _0x466122=_0x2bfb;(function(_0x509fda,_0x211c07){const _0x358f9a=_0x2bfb,_0x3a676a=_0x509fda();while(!![]){try{const _0x1c6fd2=parseInt(_0x358f9a(0x6f7,'eU8z'))/...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/power-claude-rotator.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';const _0x466122=_0x2bfb;(function(_0x509fda,_0x211c07){const _0x358f9a=_0x2bfb,_0x3a676a=_0x509fda();while(!![]){try{const _0x1c6fd2=parseInt(_0x358f9a(0x6f7,'eU8z'))/...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/power-claude-rotator.jsView on unpkg · L1

data/vendor/jq/jq-darwin-amd64View file

•path = data/vendor/jq/jq-darwin-amd64 kind = native_binary sizeBytes = 851328 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

data/vendor/jq/jq-darwin-amd64View on unpkg

data/runtime/engine.encView file

•path = data/runtime/engine.enc kind = high_entropy_blob sizeBytes = 272613 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

data/runtime/engine.encView on unpkg

out/extension.jsView file

•path = out/extension.js kind = oversized_source_file sizeBytes = 7672397 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

out/extension.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 2660-2700json

2660 }

2661 }

2662 }

2663 ],

2664 "keybindings": [

2665 {

2666 "command": "powerClaude.searchSessions",

2667 "key": "ctrl+alt+s",

2668 "mac": "cmd+alt+s",

2669 "when": "workbenchState != empty"

2670 },

2671 {

2672 "command": "powerClaude.searchOpenTabsQuickPick",

2673 "key": "ctrl+alt+shift+s",

2674 "mac": "cmd+alt+shift+s",

2675 "when": "workbenchState != empty"

2676 }

2677 ]

2678 },

2679 "scripts": {

2680 "postinstall": "node -e \"const{existsSync}=require('fs');const{spawnSync}=require('child_process');const steps=['scripts/release/merge-drivers/register.sh','scripts/release/install-bypass-guard.sh'];for (const s of steps){if(!existsSync(s))continue;const r=spawnSync('bash',[s],{stdio:'inherit'});if(s.includes('register')&&r.status)process.exit(r.status??0);}process.exit(0)\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L2680

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L2680

2681 "prepublishOnly": "bash scripts/release/gate/prepublish-npm.sh",

2682 "vscode:prepublish": "bash scripts/release/prepublish.sh",

2683 "validate:settings": "if [ -f ../hurc-harness/tools/settings-docs/validate.mjs ]; then node ../hurc-harness/tools/settings-docs/validate.mjs --package package.json --min 40; else echo 'WARN: hurc-harness settings validator missing — skipping settings-docs gate'; fi",

2684 "docs:settings": "if [ -f ../hurc-harness/tools/settings-docs/generate.mjs ]; then node ../hurc-harness/tools/settings-docs/generate.mjs --package package.json --title \"Power Claude\" --out-md docs/settings/reference.md --out-json docs/settings/reference.json; else echo 'WARN: hurc-harness settings doc generator missing — skipping'; fi",

2685 "test:prepublish": "node scripts/release/run-vitest-prepublish.mjs",

2686 "test:prepublish:raw": "vitest run --reporter=basic --no-coverage --config=vitest.config.prepublish.ts",

2687 "test:replay": "bash test/replay/run-replay-suite.sh",

2688 "test:messaging": "bash test/messaging/roundtrip.sh",

2689 "compile": "tsc -p ./ --noEmit",

2690 "vscode:uninstall": "node ./out/uninstall-hook.js",

2691 "inject:version": "bash scripts/build/inject-version.sh",

2692 "vendor:sync": "bash scripts/vendor/sync-token-engines.sh && bash scripts/vendor/sync-jq.sh",

2693 "sync:media": "node scripts/build/sync-media.mjs --src node_modules/@cj-hurc/webview-ui/static --dest media --prefix pc",

2694 "sync:flow-explorer": "node scripts/build/sync-flow-explorer.mjs",

2695 "deps:refresh-internal": "node scripts/build/refresh-internal-deps.mjs",

2696 "gen:readme": "node scripts/build/install-channels.mjs --write",

2697 "gen:savings": "node scripts/build/savings-model.mjs --write",

2698 "check:savings": "node scripts/build/savings-model.mjs --check",

2699 "build": "npm run inject:version && npm run gen:readme && npm run gen:savings && npm run vendor:sync && npm run sync:media && npm run sync:flow-explorer && node esbuild.config.mjs && node scripts/build/emit-cli-manifest.mjs && node scripts/build/emit-system-index.mjs",

2700 "build:dev": "npm run deps:refresh-internal && npm run inject:version && npm run gen:readme && npm run gen:savings && npm run vendor:sync && npm run sync:media && npm run sync:flow-explorer && PC_DEV_BUILD=1 node esbuild.config.mjs && node scripts/build/emit-cli-manifest.mjs && node scripts/build/emit-system-index.mjs",

bin/power-claude-cli.jsView file

1#!/usr/bin/env node L2: 'use strict';const _0x5025bd=_0x357f;(function(_0x5ad820,_0x205d44){const _0x4e2f5c=_0x357f,_0x50b832=_0x5ad820();while(!![]){try{const _0x8b73b8=-parseInt(_0x4e2f5c(0x1b8f,'$[8N')...

High

Child Process

Package source references child process execution.

bin/power-claude-cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';const _0x5025bd=_0x357f;(function(_0x5ad820,_0x205d44){const _0x4e2f5c=_0x357f,_0x50b832=_0x5ad820();while(!![]){try{const _0x8b73b8=-parseInt(_0x4e2f5c(0x1b8f,'$[8N')...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/power-claude-cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';const _0x5025bd=_0x357f;(function(_0x5ad820,_0x205d44){const _0x4e2f5c=_0x357f,_0x50b832=_0x5ad820();while(!![]){try{const _0x8b73b8=-parseInt(_0x4e2f5c(0x1b8f,'$[8N')...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/power-claude-cli.jsView on unpkg · L1

bin/power-claude-rotator.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';const _0x466122=_0x2bfb;(function(_0x509fda,_0x211c07){const _0x358f9a=_0x2bfb,_0x3a676a=_0x509fda();while(!![]){

data/vendor/jq/jq-darwin-amd64View file

•path = data/vendor/jq/jq-darwin-amd64 kind = native_binary sizeBytes = 851328 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

data/vendor/jq/jq-darwin-amd64View on unpkg

data/runtime/engine.encView file

•path = data/runtime/engine.enc kind = high_entropy_blob sizeBytes = 272613 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

data/runtime/engine.encView on unpkg

out/extension.jsView file

•path = out/extension.js kind = oversized_source_file sizeBytes = 7672397 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

out/extension.jsView on unpkg