slaunt@0.1.18
This package contains the client-side one-sign-in OAuth handoff for Codex and Claude Code. Each native client stores its own OAuth credentials; bootstrap credentials stay in CLI memory during setup. The Desktop vault is not used for the native OAuth hando
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no lifecycle hooks, and the setup and persistence paths are reached through an explicit CLI install flow. The included native helper is opaque and ad hoc-signed, but the inspected source describes and verifies it as the enrolled Slaunt service; I found no concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs `slaunt-hooks install` and selects Codex, Claude Code, or both.
Impact
Selected clients are configured to use Slaunt; enrolled Slaunt helper processes can persist across login. No unrelated credential collection or account actions were identified.
Mechanism
The installer performs Slaunt OAuth and enrollment, updates selected client settings, then verifies and registers the macOS helper and, for Claude, a broker launch agent.
AI rationale
The manifest has no lifecycle hooks, and the setup and persistence paths are reached through an explicit CLI install flow. The included native helper is opaque and ad hoc-signed, but the inspected source describes and verifies it as the enrolled Slaunt service; I found no concrete malicious behavior.
Evidence
~/.claude.json~/.codex/config.toml~/.claude/settings.json~/.codex/hooks.json~/Library/LaunchAgents/ai.slaunt.claude-broker.plist~/Library/Application Support/Slaunt/KillBar/SlauntKillBar.app
Network endpoints2
central-mcp-ccr-production.up.railway.appcentral-mcp-ccr-production.up.railway.app/mcp
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines CLI binaries and test scripts, with no install, preinstall, or postinstall hook.
- The CLI runs its main setup flow only when invoked directly, and accepts the explicit `install` command.
- Setup requires a Slaunt enrollment function and restricts the issuer to HTTPS, apart from loopback HTTP.
- The background helper is copied, verified, and registered as a per-user launch agent during the install flow.
- The package describes the native helper as an enrolled Slaunt service and checks its archive hash and code signature.
Evidence against
- The package includes an opaque, ad hoc-signed native helper that is installed persistently on macOS after setup.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggedsrc/desktop/broker-launch-agent.jsView file
3Trigger-reachable persistence chain: manifest.bin -> bin/slaunt-hooks.js -> src/install-flow.js -> src/desktop/broker-launch-agent.js
L3: const path=require('node:path');
L4: const net=require('node:net');
L5: const {execFile}=require('node:child_process');
L6: const {promisify}=require('node:util');
...
L9: const xml=s=>s.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''');
L10: function brokerPlist({node=process.execPath,script=path.join(__dirname,'broker-daemon.js')}={}){
L11: if(!path.isAbsolute(node)||!path.isAbsolute(script)||/[\x00-\x1f\x7f]/.test(node+script))throw new Error('broker-launch-invalid');
...
L15: try{const root=await fs.lstat(path.dirname(address)),socket=await fs.lstat(address);if(!root.isDirectory()||root.isSy
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/desktop/broker-launch-agent.jsView on unpkg · L33const path=require('node:path');
L4: const net=require('node:net');
L5: const {execFile}=require('node:child_process');
L6: const {promisify}=require('node:util');
...
L9: const xml=s=>s.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''');
L10: function brokerPlist({node=process.execPath,script=path.join(__dirname,'broker-daemon.js')}={}){
L11: if(!path.isAbsolute(node)||!path.isAbsolute(script)||/[\x00-\x1f\x7f]/.test(node+script))throw new Error('broker-launch-invalid');
...
L15: try{const root=await fs.lstat(path.dirname(address)),socket=await fs.lstat(address);if(!root.isDirectory()||root.isSymbolicLink()||root.uid!==process.getuid()||(root.mode&0o077)||!...
L16: return new Promise(resolve=>{const s=net.createConnection(addr
Findings
3 High6 Medium6 Low
HighSandbox Evasion Gated Capabilitysrc/setup-flow.js
HighTrigger Reachable Persistencesrc/desktop/broker-launch-agent.js
HighShips High Entropy Blobrelease/SlauntKillBar.zip
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/desktop/broker-launch-agent.js
MediumShips Build Helperscripts/package-killbar-macos.sh
MediumShips Compressed Blobrelease/SlauntKillBar.zip
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionrelease/SlauntKillBar.zip
Affected versions and remediation
This report applies to slaunt@0.1.18.
See all versions of slaunt for other recorded verdicts.
- Review the evidence and your use of slaunt@0.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.