Loading npm security reports…

punchcard-presence@1.0.6: AI-agent control-surface risk | LPM Firewall

registry / punchcard-presence / 1.0.6

punchcard-presence@1.0.6

Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex

AI Security Review

scanned 13h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On global npm installation, the lifecycle script launches the CLI, which rewrites Claude Code's settings to register package commands as hooks. This is an unconsented install-time mutation of a foreign AI-agent control surface.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Global npm install, which runs postinstall.

Impact

Claude events invoke the package command automatically; the package also starts its daemon and tray process.

Mechanism

postinstall-driven Claude settings hook injection

Policy narrative

A global install runs postinstall without an interactive package command. It invokes `punchcard install`, which writes command hooks for several Claude Code events into the user's Claude settings and starts package processes. Those hooks cause future Claude activity to execute Punchcard automatically. This is foreign AI-agent control-surface mutation during npm installation, meeting the block policy even though the inspected hook handler primarily stores local activity metadata.

Rationale

The install chain concretely rewrites Claude Code configuration from postinstall. That foreign AI-agent hook installation is sufficient for a block verdict under the stated policy.

Evidence

scripts/postinstall.cjsbin/cli.jslib/claude-hooks.jslib/paths.jslib/claude-activity.js~/.claude/settings.json~/.claude-codex-presence/claude-activity

Decision evidence

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

2import fs from "node:fs/promises"; L3: import { spawn } from "node:child_process"; L4: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

lib/tray.jsView file

124await fs.mkdir(paths.home, { recursive: true }); L125: const child = spawn("powershell.exe", [ L126: "-NoProfile",

High

Shell

Package source references shell execution.

lib/tray.jsView on unpkg · L124

scripts/postinstall.cjsView file

1const { spawnSync } = require("node:child_process"); L2: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

lib/autostart.jsView file

3Trigger-reachable persistence chain: manifest.bin -> bin/cli.js -> lib/autostart.js L3: import path from "node:path"; L4: import { execFile } from "node:child_process"; L5: import { promisify } from "node:util"; ... L59: function darwinContext(options = {}) { L60: const home = options.home || os.homedir(); L61: const uid = options.uid ?? (typeof process.getuid === "function" ? process.getuid() : null); ... L72: L73: async function launchctl(arguments_, options = {}) { L74: const execute = options.execFile || execFileAsync; ... L87: export async function launchAgentRuntimeStatus(options = {}) { L88: if ((options.platform || process.platform) !== "darwin") return null; L89: const context = darwinContext(options);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/autostart.jsView on unpkg · L3

3import path from "node:path"; L4: import { execFile } from "node:child_process"; L5: import { promisify } from "node:util"; ... L59: function darwinContext(options = {}) { L60: const home = options.home || os.homedir(); L61: const uid = options.uid ?? (typeof process.getuid === "function" ? process.getuid() : null); ... L72: L73: async function launchctl(arguments_, options = {}) { L74: const execute = options.execFile || execFileAsync; ... L87: export async function launchAgentRuntimeStatus(options = {}) { L88: if ((options.platform || process.platform) !== "darwin") return null; L89: const context = darwinContext(options);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/autostart.jsView on unpkg · L3

lib/more-metrics.jsView file

2import path from "node:path"; L3: import { spawn } from "node:child_process"; L4: import { pathToFileURL } from "node:url"; ... L8: export const MORE_METRICS_VERSION = "1.0.1"; L9: export const MORE_METRICS_API_BASE_URL = "https://app.punchcardai.workers.dev"; L10: L11: function packageConfig(env = process.env) { L12: const packageName = String(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/more-metrics.jsView on unpkg · L2

•matchType = token_shingles matchedPackage = punchcard-presence@1.0.5 matchedPath = lib/more-metrics.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.5 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/more-metrics.jsView on unpkg

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 24892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

lib/private-dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.5 matchedPath = lib/private-dashboard.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/private-dashboard.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "punchcard-presence",

3 "version": "1.0.6",

4 "description": "Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex",

5 "type": "module",

6 "bin": {

7 "punchcard": "bin/cli.js"

8 },

9 "scripts": {

10 "test": "node --test",

11 "check": "node tools/check-package.mjs",

12 "release:check": "npm test && npm run check && node tools/smoke-package.mjs",

13 "prepublishOnly": "npm run release:check",

14 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "files": [

17 "bin",

18 "lib",

19 "scripts",

20 "assets",

21 "docs",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md",

25 "PRIVACY.md",

26 "SECURITY.md"

27 ],

28 "keywords": [

29 "discord",

30 "rich-presence",

31 "punchcard",

32 "ai-usage",

33 "token-usage",

34 "claude-code",

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import { spawn } from "node:child_process";

4import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

lib/tray.jsView file

Lines 104-144javascript

104 }

105 } catch (error) {

106 await appendBoundedLog(paths.trayLog, error instanceof Error ? error.message : String(error));

107 throw error;

108

scripts/postinstall.cjsView file

Lines 1-8javascript

1const { spawnSync } = require("node:child_process");

2const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

3

lib/autostart.jsView file

Lines 1-23javascript

1import fs from "node:fs/promises";

2import os from "node:os";

3import path from "node:path";

4import { execFile } from "node:child_process";

lib/more-metrics.jsView file

Lines 1-22javascript

1import fs from "node:fs/promises";

2import path from "node:path";

3import { spawn } from "node:child_process";

4import { pathToFileURL } from "node:url";

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 24892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

lib/private-dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = punchcard-presence@1.0.5 matchedPath = lib/private-dashboard.js matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/private-dashboard.jsView on unpkg