Loading npm security reports…

squeez@1.34.1: AI-agent control-surface risk | LPM Firewall

registry / squeez / 1.34.1

squeez@1.34.1

Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall downloads and executes remote code, then mutates Claude Code's global settings to register persistent command hooks. The hooks run on later agent lifecycle and tool events.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of squeez@1.34.1

Impact

Unconsented execution now and persistent command execution in Claude Code sessions.

Mechanism

remote shell bootstrap plus global AI-agent hook registration

Policy narrative

On npm installation, postinstall invokes a remote install script through `curl | sh`. Its fallback downloads a native binary into ~/.claude/squeez, then modifies ~/.claude/settings.json to add command hooks for PreToolUse, SessionStart, PostToolUse, and statusLine. Those hooks execute package-controlled scripts during later Claude Code sessions without an explicit setup command.

Rationale

This is a concrete, unconsented postinstall mutation of a broad AI-agent control surface, with remote code execution in the same lifecycle. Documentation and defensive settings parsing do not remove that install-time control-hijack behavior.

Evidence

package.jsoninstall.jsbin.jsREADME.md~/.claude/squeez/bin/squeez~/.claude/settings.json~/.claude/settings.json.bak

Network endpoints2

raw.githubusercontent.com/claudioemmanuel/squeez/main/install.sh

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin.jsView file

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs'); ... L13: const BINARY = path.join( L14: os.homedir(), '.claude', 'squeez', 'bin', L15: process.platform === 'win32' ? 'squeez.exe' : 'squeez' L16: ); ... L18: if (!fs.existsSync(BINARY)) { L19: process.stderr.write('squeez: binary not found — running installer...\n'); L20: if (process.platform === 'win32') { L21: process.stderr.write('squeez: on Windows, download from https://github.[redacted]\n'); L22: process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

install.jsView file

15L16: const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez'); L17: const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez'); ... L92: L93: fs.mkdirSync(path.join(INSTALL_DIR, 'bin'), { recursive: true }); L94: fs.mkdirSync(path.join(INSTALL_DIR, 'hooks'), { recursive: true }); L95: fs.mkdirSync(path.join(INSTALL_DIR, 'sessions'), { recursive: true }); L96: ... L111: function registerHooks() { L112: const settingsPath = path.join(os.homedir(), '.claude', 'settings.json'); L113: let settings = {}; ... L140: if (!Array.isArray(settings.PreToolUse)) { settings.PreToolUse = []; }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

165settings.statusLine = existingCmd L166: ? { type: 'command', command: `bash -c 'input=$(cat); echo "$input" | { ${existingCmd}; } 2>/dev/null; echo "$input" | ${squeezStatusCmd}'` } L167: : { type: 'command', command: squeezStatusCmd };

High

Shell

Package source references shell execution.

install.jsView on unpkg · L165

6*/ L7: const { execSync } = require('child_process'); L8: const https = require('https'); L9: const fs = require('fs'); ... L13: // Allow skipping (e.g. in CI that only needs the npm package metadata) L14: if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0); L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js