Loading npm security reports…

squeez@1.33.0: AI-agent control-surface risk | LPM Firewall

registry / squeez / 1.33.0

squeez@1.33.0

Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Postinstall downloads and executes remote code, then mutates the shared Claude Code hook configuration. The installed hooks execute package-controlled scripts during agent sessions.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install or npx lifecycle execution

Impact

Unconsented persistent execution in Claude Code sessions and arbitrary code execution through a mutable remote installer.

Mechanism

remote shell bootstrap plus Claude Code settings-hook injection

Policy narrative

Installing the package automatically invokes install.js. On Unix it executes a remotely fetched, unpinned install.sh through sh; the fallback downloads an executable. It then edits ~/.claude/settings.json to register commands under PreToolUse, SessionStart, PostToolUse, and statusLine, causing package-controlled scripts to run within Claude Code sessions without a separate setup command.

Rationale

This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, compounded by remote code execution from a mutable main-branch URL. Documentation does not remove the lifecycle-triggered control-surface risk.

Evidence

package.jsoninstall.jsbin.jsREADME.md~/.claude/squeez/bin/squeez~/.claude/squeez/hooks~/.claude/squeez/sessions~/.claude/settings.json~/.claude/settings.json.bak

Network endpoints2

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin.jsView file

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs'); ... L13: const BINARY = path.join( L14: os.homedir(), '.claude', 'squeez', 'bin', L15: process.platform === 'win32' ? 'squeez.exe' : 'squeez' L16: ); ... L18: if (!fs.existsSync(BINARY)) { L19: process.stderr.write('squeez: binary not found — running installer...\n'); L20: if (process.platform === 'win32') { L21: process.stderr.write('squeez: on Windows, download from https://github.[redacted]\n'); L22: process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

install.jsView file

15L16: const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez'); L17: const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez'); ... L92: L93: fs.mkdirSync(path.join(INSTALL_DIR, 'bin'), { recursive: true }); L94: fs.mkdirSync(path.join(INSTALL_DIR, 'hooks'), { recursive: true }); L95: fs.mkdirSync(path.join(INSTALL_DIR, 'sessions'), { recursive: true }); L96: ... L111: function registerHooks() { L112: const settingsPath = path.join(os.homedir(), '.claude', 'settings.json'); L113: let settings = {}; ... L140: if (!Array.isArray(settings.PreToolUse)) { settings.PreToolUse = []; }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

165settings.statusLine = existingCmd L166: ? { type: 'command', command: `bash -c 'input=$(cat); echo "$input" | { ${existingCmd}; } 2>/dev/null; echo "$input" | ${squeezStatusCmd}'` } L167: : { type: 'command', command: squeezStatusCmd };

High

Shell

Package source references shell execution.

install.jsView on unpkg · L165

6*/ L7: const { execSync } = require('child_process'); L8: const https = require('https'); L9: const fs = require('fs'); ... L13: // Allow skipping (e.g. in CI that only needs the npm package metadata) L14: if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0); L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js