slaunt@0.1.20
This package contains the client-side one-sign-in OAuth handoff for Codex and Claude Code. Each native client stores its own OAuth credentials; bootstrap credentials stay in CLI memory during setup. The Desktop vault is not used for the native OAuth hando
AI Security Review
scanned 6d ago · by lpm-firewall-aiThere are no npm lifecycle scripts, and the executable performs setup only when a user explicitly runs its install command. The setup includes persistent helper and hook configuration, but the reviewed source ties those changes to the selected Slaunt integration and its own HTTPS service.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs `slaunt-hooks install` and selects Codex, Claude Code, or both; setup then requires Slaunt sign-in and helper enrollment.
Impact
The selected clients connect to Slaunt and the helper runs in the background for its authorization features; reviewed source does not show unrelated collection or actions.
Mechanism
The setup configures the selected client, enrolls a packaged helper, and may register per-user LaunchAgents and client hooks for Slaunt authorization.
AI rationale
There are no npm lifecycle scripts, and the executable performs setup only when a user explicitly runs its install command. The setup includes persistent helper and hook configuration, but the reviewed source ties those changes to the selected Slaunt integration and its own HTTPS service.
Evidence
.claude.json.codex/config.toml.claude/settings.json.codex/hooks.json~/Library/LaunchAgents/ai.slaunt.claude-broker.plist~/Library/LaunchAgents/ai.slaunt.killbar.plist~/Library/Application Support/Slaunt/KillBar/SlauntKillBar.app
Network endpoints1
central-mcp-ccr-production.up.railway.app
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install, preinstall, or postinstall lifecycle hook.
- The executable accepts setup only through an explicit `install` command and offers client selection.
- Setup uses the Slaunt HTTPS issuer and installs its MCP endpoint in the selected client configuration.
- Persistent helper registration and agent hook setup occur in the explicit setup flow after sign-in and KillBar enrollment.
- The packaged helper is checked against a manifest hash and code-directory hash before use.
Evidence against
- Setup can register per-user LaunchAgents that run at login and remain active.
- Setup writes hooks into Codex and Claude configuration files and connects them to the Slaunt broker.
- The native helper archive is opaque to this source review; the package describes it as an ad hoc-signed development helper.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
13 flaggedsrc/desktop/broker-launch-agent.jsView file
3Trigger-reachable persistence chain: manifest.bin -> bin/slaunt-hooks.js -> src/install-flow.js -> src/desktop/broker-launch-agent.js
L3: const path=require('node:path');
L4: const net=require('node:net');
L5: const {execFile}=require('node:child_process');
L6: const {promisify}=require('node:util');
...
L9: const xml=s=>s.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''');
L10: function brokerPlist({node=process.execPath,script=path.join(__dirname,'broker-daemon.js')}={}){
L11: if(!path.isAbsolute(node)||!path.isAbsolute(script)||/[\x00-\x1f\x7f]/.test(node+script))throw new Error('broker-launch-invalid');
...
L15: try{const root=await fs.lstat(path.dirname(address)),socket=await fs.lstat(address);if(!root.isDirectory()||root.isSy
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/desktop/broker-launch-agent.jsView on unpkg · L3•matchType = normalized_sha256
matchedPackage = slaunt@0.1.18
matchedPath = src/desktop/broker-launch-agent.js
matchedIdentity = npm:c2xhdW50:0.1.18
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/desktop/broker-launch-agent.jsView on unpkgFindings
9 High6 Medium6 Low
HighSandbox Evasion Gated Capabilitysrc/setup-flow.js
HighTrigger Reachable Persistencesrc/desktop/broker-launch-agent.js
HighShips High Entropy Blobrelease/SlauntKillBar.zip
HighKnown Malware Source Similaritysrc/desktop/broker-launch-agent.js
HighKnown Malware Source Similaritysrc/killbar-enrollment.js
HighKnown Malware Source Similaritysrc/desktop/broker-keychain.js
HighKnown Malware Source Similaritysrc/native-config.js
HighKnown Malware Source Similaritysrc/setup/codex-guard-supervisor.js
HighKnown Malware Source Similaritysrc/native-oauth.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to slaunt@0.1.20.
See all versions of slaunt for other recorded verdicts.
- Review the evidence and your use of slaunt@0.1.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.