Loading npm security reports…

squeez@1.46.4: Malicious npm security report (Block) | LPM Firewall

registry / squeez / 1.46.4

squeez@1.46.4

Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Installing the package automatically fetches and executes an unauthenticated remote shell script. It installs a native binary under the user's Claude directory and invokes it to register hooks and settings.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

A package install can alter the user's AI-agent control surface using remotely supplied code.

Mechanism

Remote shell execution followed by opaque Claude Code setup.

Attack narrative

On installation, package.json launches install.js. On Unix, that script downloads a shell script from raw.githubusercontent.com and pipes it directly to sh. The remote installer can place a native binary in ~/.claude/squeez; the lifecycle code then invokes that binary with setup --host=claude-code, which registers hooks and settings. This is an unconsented postinstall mutation path into an AI-agent control surface.

AI rationale

The package performs automatic remote code execution during postinstall and uses the resulting opaque binary to modify Claude Code hooks and settings. This is a concrete install-hook abuse chain, not merely an explicit user setup command.

Evidence

package.jsoninstall.js~/.claude/squeez/bin~/.claude/squeez/hooks~/.claude/squeez/sessions~/.claude/squeez/bin/squeez

Network endpoints2

/claudioemmanuel/squeez/main/install.sh

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin.jsView file

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs'); ... L13: const BINARY = path.join( L14: os.homedir(), '.claude', 'squeez', 'bin', L15: process.platform === 'win32' ? 'squeez.exe' : 'squeez' L16: ); ... L18: if (!fs.existsSync(BINARY)) { L19: process.stderr.write('squeez: binary not found — running installer...\n'); L20: if (process.platform === 'win32') { L21: process.stderr.write('squeez: on Windows, download from https://github.[redacted]\n'); L22: process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = squeez@1.48.4 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.48.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e5e3d144990d97e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = squeez@1.48.4 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.48.4 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin.jsView on unpkg

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

install.jsView file

15L16: const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez'); L17: const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez'); ... L92: L93: fs.mkdirSync(path.join(INSTALL_DIR, 'bin'), { recursive: true }); L94: fs.mkdirSync(path.join(INSTALL_DIR, 'hooks'), { recursive: true }); L95: fs.mkdirSync(path.join(INSTALL_DIR, 'sessions'), { recursive: true }); L96: ... L118: warn(`squeez setup failed: ${err.message}`); L119: warn('run manually: ~/.claude/squeez/bin/squeez setup'); L120: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

6*/ L7: const { execSync } = require('child_process'); L8: const https = require('https'); L9: const fs = require('fs'); ... L13: // Allow skipping (e.g. in CI that only needs the npm package metadata) L14: if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0); L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = squeez@1.48.4 matchedPath = install.js matchedIdentity = npm:c3F1ZWV6:1.48.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.js