Loading npm security reports…

punchcard-presence@1.0.5: AI-agent control-surface risk | LPM Firewall

registry / punchcard-presence / 1.0.5

punchcard-presence@1.0.5

Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically modifies Claude Code's user-level hook configuration and starts persistent processes. This is an unconsented foreign AI-agent control-surface write.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm global install / postinstall

Impact

Commands run on Claude lifecycle events; daemon persists at login.

Mechanism

postinstall-driven Claude hook injection with autostart

Policy narrative

On global installation, the postinstall script silently runs `punchcard install`. That command writes command hooks into the user's Claude configuration for prompt, stop, subagent, and session lifecycle events, starts a detached daemon and tray, and enables OS login autostart by default. The automatic lifecycle-triggered mutation of an external AI-agent configuration is a concrete unconsented control-surface takeover.

Rationale

The package's install-time behavior is not limited to its own state: it modifies user-level Claude hooks and establishes persistence without an explicit follow-up command. This meets the block boundary for postinstall mutation of a foreign AI-agent control surface.

Evidence

scripts/postinstall.cjsbin/cli.jslib/claude-hooks.jslib/paths.jslib/autostart.js~/.claude/settings.json~/.claude-codex-presence/settings.json~/Library/LaunchAgents/com.punchcard.presence.plist

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

2import fs from "node:fs/promises"; L3: import { spawn } from "node:child_process"; L4: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

•matchType = previous_version_dangerous_delta matchedPackage = punchcard-presence@1.0.0 matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.0 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

lib/tray.jsView file

50await fs.mkdir(paths.home, { recursive: true }); L51: const child = spawn("powershell.exe", [ L52: "-NoProfile",

High

Shell

Package source references shell execution.

lib/tray.jsView on unpkg · L50

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.2 matchedPath = lib/tray.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/tray.jsView on unpkg

scripts/postinstall.cjsView file

1const { spawnSync } = require("node:child_process"); L2: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

lib/more-metrics.jsView file

2import path from "node:path"; L3: import { spawn } from "node:child_process"; L4: import { pathToFileURL } from "node:url"; ... L8: export const MORE_METRICS_VERSION = "1.0.1"; L9: export const MORE_METRICS_API_BASE_URL = "https://app.punchcardai.workers.dev"; L10: L11: function packageConfig(env = process.env) { L12: const packageName = String(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/more-metrics.jsView on unpkg · L2

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 24892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

lib/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.2 matchedPath = lib/autostart.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/autostart.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "punchcard-presence",

3 "version": "1.0.5",

4 "description": "Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex",

5 "type": "module",

6 "bin": {

7 "punchcard": "bin/cli.js"

8 },

9 "scripts": {

10 "test": "node --test",

11 "check": "node tools/check-package.mjs",

12 "release:check": "npm test && npm run check && node tools/smoke-package.mjs",

13 "prepublishOnly": "npm run release:check",

14 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "files": [

17 "bin",

18 "lib",

19 "scripts",

20 "assets",

21 "README.md",

22 "LICENSE",

23 "CHANGELOG.md",

24 "PRIVACY.md",

25 "SECURITY.md"

26 ],

27 "keywords": [

28 "discord",

29 "rich-presence",

30 "punchcard",

31 "ai-usage",

32 "token-usage",

33 "claude-code",

34 "codex"

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import { spawn } from "node:child_process";

4import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

lib/tray.jsView file

Lines 30-70javascript

30 const child = spawn(process.execPath, [cliPath, "tray-host", ...(options.showOnStart ? ["--show"] : [])], {

31 cwd: paths.home,

32 detached: true,

33 stdio:

scripts/postinstall.cjsView file

Lines 1-8javascript

1const { spawnSync } = require("node:child_process");

2const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

3

lib/more-metrics.jsView file

Lines 1-22javascript

1import fs from "node:fs/promises";

2import path from "node:path";

3import { spawn } from "node:child_process";

4import { pathToFileURL } from "node:url";

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 24892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

lib/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.2 matchedPath = lib/autostart.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/autostart.jsView on unpkg