registry / squeez / 1.46.2

squeez@1.46.2

Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Automatic installation executes externally fetched code and invokes Claude Code extension setup. This creates an unresolved agent extension lifecycle risk; the inspected source does not establish a confirmed attack or broad control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall, or running the CLI while its native binary is missing.

Impact

External code runs with the installing user's permissions and can register agent hooks; the exact configuration changes cannot be verified from this snapshot.

Mechanism

The wrappers fetch and execute the upstream shell installer or download a native binary and invoke its setup command.

AI rationale

The source establishes automatic remote execution and package-owned agent extension setup, warranting a warning. It does not directly establish malicious payload behavior or unconsented broad agent control-surface writes sufficient for blocking.

Evidence

package.jsoninstall.jsbin.js

Network endpoints2

raw.githubusercontent.com/claudioemmanuel/squeez/main/install.shgithub.com/claudioemmanuel/squeez/releases/latest/download

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json automatically runs install.js after installation.
install.js executes an installer fetched from the project's mutable main branch.
install.js invokes the native binary to set up Claude Code hooks, including when the binary already exists.
The fallback downloads a release binary, makes it executable, and invokes setup.
bin.js also executes the remote installer when the native binary is missing.

Evidence against

Download destinations belong to the package's stated upstream project.
The inspected wrappers show no credential harvesting or exfiltration.
The downloaded installer and native setup implementation are absent, so broad agent configuration mutation is not directly established.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.89 KB of source, external domains: github.com, raw.githubusercontent.com

Source & flagged code

10 flagged

package.jsonView file

Lines 8-39json

8 "context-window",

9 "llm-tools",

10 "copilot-cli",

11 "compression"

12 ],

13 "homepage": "https://github.com/claudioemmanuel/squeez",

14 "bugs": {

15 "url": "https://github.com/claudioemmanuel/squeez/issues"

16 },

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/claudioemmanuel/squeez.git"

20 },

21 "license": "Apache-2.0",

22 "readme": "README.md",

23 "author": "claudioemmanuel",

24 "bin": {

25 "squeez": "bin.js"

26 },

27 "scripts": {

28 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "engines": {

31 "node": ">=16"

32 },

33 "os": [

34 "darwin",

35 "linux",

36 "win32"

37 ]

38}

bin.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3/**

4 * bin.js — CLI entry point for the squeez npm package.

5 * Delegates all arguments to the native binary at ~/.claude/squeez/bin/squeez.

6 * Auto-installs if the binary is missing (e.g. after `npx squeez`).

7 */

8const { execFileSync, execSync } = require('child_process');

9const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

10const path = require('path');

11const os = require('os');

13const BINARY = path.join(

14 os.homedir(), '.claude', 'squeez', 'bin',

15 process.platform === 'win32' ? 'squeez.exe' : 'squeez'

16);

18if (!fs.existsSync(BINARY)) {

19 process.stderr.write('squeez: binary not found — running installer...\n');

20 if (process.platform === 'win32') {

21 process.stderr.write('squeez: on Windows, download from https://github.com/claudioemmanuel/squeez/releases\n');

22 process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

23 }

24 try {

25 execSync(

26 'curl -fsSL https://raw.githubusercontent.com/claudioemmanuel/squeez/main/install.sh | sh',

27 { stdio: 'inherit' }

•matchType = normalized_sha256 matchedPackage = squeez@1.46.4 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.46.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e5e3d144990d97e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = squeez@1.46.4 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.46.4 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin.jsView on unpkg

install.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2'use strict';

3/**

4 * postinstall — downloads the squeez binary and registers Claude Code hooks.

5 * Runs automatically on `npm install -g squeez` or `npx squeez`.

6 */

7const { execSync } = require('child_process');

8const https = require('https');

9const fs = require('fs');

10const path = require('path');

11const os = require('os');

13// Allow skipping (e.g. in CI that only needs the npm package metadata)

14if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L6

16const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez');

17const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

18const RELEASES = 'https://github.com/claudioemmanuel/squeez/releases/latest/download';

20function log(msg) { process.stdout.write(`squeez: ${msg}\n`); }

21function warn(msg) { process.stderr.write(`squeez: ${msg}\n`); }

23// ── Platform map ───────────────────────────────────────────────────────────

24const PLATFORM_MAP = {

25 darwin: { x64: 'squeez-macos-universal', arm64: 'squeez-macos-universal' },

26 linux: { x64: 'squeez-linux-x86_64', arm64: 'squeez-linux-aarch64' },

27 win32: { x64: 'squeez-windows-x86_64.exe' },

28};

30function getBinary() {

31 const plat = PLATFORM_MAP[process.platform];

32 if (!plat) return null;

33 return plat[process.arch] || plat['x64'] || null;

34}

•matchType = normalized_sha256 matchedPackage = squeez@1.46.4 matchedPath = install.js matchedIdentity = npm:c3F1ZWV6:1.46.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin.jsView file

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs'); ... L13: const BINARY = path.join( L14: os.homedir(), '.claude', 'squeez', 'bin', L15: process.platform === 'win32' ? 'squeez.exe' : 'squeez' L16: ); ... L18: if (!fs.existsSync(BINARY)) { L19: process.stderr.write('squeez: binary not found — running installer...\n'); L20: if (process.platform === 'win32') { L21: process.stderr.write('squeez: on Windows, download from https://github.[redacted]\n'); L22: process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin.jsView on unpkg

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

install.jsView file

15L16: const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez'); L17: const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez'); ... L92: L93: fs.mkdirSync(path.join(INSTALL_DIR, 'bin'), { recursive: true }); L94: fs.mkdirSync(path.join(INSTALL_DIR, 'hooks'), { recursive: true }); L95: fs.mkdirSync(path.join(INSTALL_DIR, 'sessions'), { recursive: true }); L96: ... L118: warn(`squeez setup failed: ${err.message}`); L119: warn('run manually: ~/.claude/squeez/bin/squeez setup'); L120: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

6*/ L7: const { execSync } = require('child_process'); L8: const https = require('https'); L9: const fs = require('fs'); ... L13: // Allow skipping (e.g. in CI that only needs the npm package metadata) L14: if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0); L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L6

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

Findings

1 Critical8 High5 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin.js

HighShell

HighSame File Env Network Executioninstall.js

HighSandbox Evasion Gated Capabilitybin.js

HighKnown Malware Source Similaritybin.js

HighKnown Malware Source Similarityinstall.js

HighKnown Malware Source Fingerprint Signaturebin.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to squeez@1.46.2.

See version security history for other recorded verdicts.

Review the evidence and your use of squeez@1.46.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 03:12:58.093Z (UTC).