Loading npm security reports…

punchcard-presence@1.0.2: AI-agent control-surface risk | LPM Firewall

registry / punchcard-presence / 1.0.2

punchcard-presence@1.0.2

Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install invokes package code that rewrites Claude Code’s user settings to add command hooks, starts a detached daemon, and enables OS login persistence. This mutates a foreign AI-agent control surface without an explicit user command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm global installation

Impact

Future Claude prompt and agent lifecycle events execute the package CLI.

Mechanism

postinstall hook injection plus daemon/autostart persistence

Policy narrative

On global installation, npm runs scripts/postinstall.cjs, which invokes `punchcard install --postinstall` with output suppressed. The install path writes command hooks into the user’s Claude settings for prompt and agent events, starts a detached daemon, and uses default-enabled autostart persistence. The hook executes the package CLI whenever Claude emits those events, creating an unconsented foreign AI-agent control-surface mutation.

Rationale

The package’s global postinstall directly installs persistent command hooks into Claude Code’s user configuration and launches background persistence. This meets the block threshold regardless of the stated presence-tracking purpose.

Evidence

package.jsonscripts/postinstall.cjsbin/cli.jslib/claude-hooks.jslib/paths.jslib/autostart.js~/.claude/settings.json~/.claude-codex-presence/settings.json

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

2import fs from "node:fs/promises"; L3: import { spawn } from "node:child_process"; L4: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

•matchType = previous_version_dangerous_delta matchedPackage = punchcard-presence@1.0.0 matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.0 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

lib/tray.jsView file

50await fs.mkdir(paths.home, { recursive: true }); L51: const child = spawn("powershell.exe", [ L52: "-NoProfile",

High

Shell

Package source references shell execution.

lib/tray.jsView on unpkg · L50

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.1 matchedPath = lib/tray.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/tray.jsView on unpkg

scripts/postinstall.cjsView file

1const { spawnSync } = require("node:child_process"); L2: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

lib/more-metrics.jsView file

2import path from "node:path"; L3: import { spawn } from "node:child_process"; L4: import { pathToFileURL } from "node:url"; ... L8: export const MORE_METRICS_VERSION = "1.0.0"; L9: export const MORE_METRICS_API_BASE_URL = "https://app.punchcardai.workers.dev"; L10: L11: function packageConfig(env = process.env) { L12: const packageName = String(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/more-metrics.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.1 matchedPath = lib/more-metrics.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/more-metrics.jsView on unpkg

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 22434 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

lib/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.1 matchedPath = lib/autostart.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/autostart.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "punchcard-presence",

3 "version": "1.0.2",

4 "description": "Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex",

5 "type": "module",

6 "bin": {

7 "punchcard": "bin/cli.js"

8 },

9 "scripts": {

10 "test": "node --test",

11 "check": "node tools/check-package.mjs",

12 "release:check": "npm test && npm run check && node tools/smoke-package.mjs",

13 "prepublishOnly": "npm run release:check",

14 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "files": [

17 "bin",

18 "lib",

19 "scripts",

20 "assets",

21 "README.md",

22 "LICENSE",

23 "CHANGELOG.md",

24 "PRIVACY.md",

25 "SECURITY.md"

26 ],

27 "keywords": [

28 "discord",

29 "rich-presence",

30 "punchcard",

31 "ai-usage",

32 "token-usage",

33 "claude-code",

34 "codex"

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import { spawn } from "node:child_process";

4import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

lib/tray.jsView file

Lines 30-70javascript

30 const child = spawn(process.execPath, [cliPath, "tray-host", ...(options.showOnStart ? ["--show"] : [])], {

31 cwd: paths.home,

32 detached: true,

33 stdio:

scripts/postinstall.cjsView file

Lines 1-8javascript

1const { spawnSync } = require("node:child_process");

2const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

3

lib/more-metrics.jsView file

Lines 1-22javascript

1import fs from "node:fs/promises";

2import path from "node:path";

3import { spawn } from "node:child_process";

4import { pathToFileURL } from "node:url";

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 22434 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

lib/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.1 matchedPath = lib/autostart.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/autostart.jsView on unpkg