registry / squeez / 1.34.2

squeez@1.34.2

Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 8.32 KB of source, external domains: github.com, raw.githubusercontent.com

Source & flagged code

7 flagged

package.jsonView file

Lines 8-39json

8 "context-window",

9 "llm-tools",

10 "copilot-cli",

11 "compression"

12 ],

13 "homepage": "https://github.com/claudioemmanuel/squeez",

14 "bugs": {

15 "url": "https://github.com/claudioemmanuel/squeez/issues"

16 },

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/claudioemmanuel/squeez.git"

20 },

21 "license": "Apache-2.0",

22 "readme": "README.md",

23 "author": "claudioemmanuel",

24 "bin": {

25 "squeez": "bin.js"

26 },

27 "scripts": {

28 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "engines": {

31 "node": ">=16"

32 },

33 "os": [

34 "darwin",

35 "linux",

36 "win32"

37 ]

38}

bin.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3/**

4 * bin.js — CLI entry point for the squeez npm package.

5 * Delegates all arguments to the native binary at ~/.claude/squeez/bin/squeez.

6 * Auto-installs if the binary is missing (e.g. after `npx squeez`).

7 */

8const { execFileSync, execSync } = require

install.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2'use strict';

3/**

4 * postinstall — downloads the squeez binary and registers Claude Code hooks.

5 * Runs automatically on `npm install -g squeez` or `npx squeez`.

6 */

7const { execSync } = require('child_process');

8const

Source & flagged code

7 flagged · loading source

package.jsonView file

•

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code