registry / squeez / 1.47.0

squeez@1.47.0

Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation retrieves and executes mutable remote code, then registers AI-agent hooks. The postinstall path can modify agent control surfaces without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install or npx lifecycle postinstall

Impact

Unconsented persistence/control over AI CLI hook and settings surfaces.

Mechanism

remote shell payload and downloaded binary execute agent-hook registration

Policy narrative

Installing the npm package invokes postinstall automatically. On Unix it fetches the repository’s mutable main-branch install.sh and pipes it to sh; the fallback downloads a native binary, marks it executable, and runs setup to register Claude Code settings/hooks. The package documentation states setup detects and registers hooks for multiple AI CLIs, making this an unconsented install-time AI-agent control-surface mutation.

Rationale

The package performs an automatic, unpinned remote-code execution chain during npm postinstall and uses it to register AI-agent hooks. This meets the firewall block boundary for unconsented lifecycle mutation of foreign/broad agent control surfaces.

Evidence

package.jsoninstall.jsREADME.md~/.claude/squeez/bin/squeez~/.claude/squeez/hooks~/.claude/squeez/sessionssettings.json~/.copilot/copilot-instructions.md~/.config/opencode/AGENTS.md

~/.gemini/GEMINI.md

~/.codex/AGENTS.md

~/.pi/agent/skills/squeez/SKILL.md

~/.hermes/profiles/default/SOUL.md

Network endpoints2

raw.githubusercontent.com/claudioemmanuel/squeez/main/install.shgithub.com/claudioemmanuel/squeez/releases/latest/download

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

npm postinstall automatically runs install.js.
Install-time code pipes a mutable GitHub script directly to sh.
It downloads and chmods a native executable, then runs its setup command.
The setup path registers Claude Code settings/hooks without a separate user command.
README states setup can register hooks across detected AI CLIs.

Evidence against

Inspected JavaScript contains no credential harvesting or data-exfiltration logic.
All explicit network URLs are package-repository GitHub URLs; no covert endpoint is present.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.89 KB of source, external domains: github.com, raw.githubusercontent.com

Source & flagged code

10 flagged

package.jsonView file

Lines 8-39json

8 "context-window",

9 "llm-tools",

10 "copilot-cli",

11 "compression"

12 ],

13 "homepage": "https://github.com/claudioemmanuel/squeez",

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin.jsView file

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs'); ... L13: const BINARY = path.join( L14: os.homedir(), '.claude', 'squeez', 'bin', L15: process.platform === 'win32' ? 'squeez.exe' : 'squeez' L16: ); ... L18: if (!fs.existsSync(BINARY)) { L19: process.stderr.write('squeez: binary not found — running installer...\n'); L20: if (process.platform === 'win32') { L21: process.stderr.write('squeez: on Windows, download from https://github.[redacted]\n'); L22: process.exit(1);

Findings

1 Critical8 High5 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin.js

HighShell

HighSame File Env Network Executioninstall.js

HighSandbox Evasion Gated Capabilitybin.js

HighKnown Malware Source Similaritybin.js

HighKnown Malware Source Similarityinstall.js

HighKnown Malware Source Fingerprint Signaturebin.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin.js

MediumNetwork

MediumEnvironment Vars

LPM CLI

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = squeez@1.46.3 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.46.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e5e3d144990d97e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = squeez@1.46.3 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.46.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin.jsView on unpkg

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

install.jsView file

15L16: const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez'); L17: const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez'); ... L92: L93: fs.mkdirSync(path.join(INSTALL_DIR, 'bin'), { recursive: true }); L94: fs.mkdirSync(path.join(INSTALL_DIR, 'hooks'), { recursive: true }); L95: fs.mkdirSync(path.join(INSTALL_DIR, 'sessions'), { recursive: true }); L96: ... L118: warn(`squeez setup failed: ${err.message}`); L119: warn('run manually: ~/.claude/squeez/bin/squeez setup'); L120: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

6*/ L7: const { execSync } = require('child_process'); L8: const https = require('https'); L9: const fs = require('fs'); ... L13: // Allow skipping (e.g. in CI that only needs the npm package metadata) L14: if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0); L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = squeez@1.46.3 matchedPath = install.js matchedIdentity = npm:c3F1ZWV6:1.46.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.js

Medium

Structural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

bin → squeez

Runtimenode >=16os darwin, linux, win32

Artifact1.21 MB · 5 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

View on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 8-39json

8 "context-window",

9 "llm-tools",

10 "copilot-cli",

11 "compression"

12 ],

13 "homepage": "https://github.com/claudioemmanuel/squeez",

14 "bugs": {

15 "url": "https://github.com/claudioemmanuel/squeez/issues"

16 },

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/claudioemmanuel/squeez.git"

20 },

21 "license": "Apache-2.0",

22 "readme": "README.md",

23 "author": "claudioemmanuel",

24 "bin": {

25 "squeez": "bin.js"

26 },

27 "scripts": {

28 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "engines": {

31 "node": ">=16"

32 },

33 "os": [

34 "darwin",

35 "linux",

36 "win32"

37 ]

38}

39

bin.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3/**

4 * bin.js — CLI entry point for the squeez npm package.

5 * Delegates all arguments to the native binary at ~/.claude/squeez/bin/squeez.

6 * Auto-installs if the binary is missing (e.g. after `npx squeez`).

7 */

8const { execFileSync, execSync } = require

install.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2'use strict';

3/**

4 * postinstall — downloads the squeez binary and registers Claude Code hooks.

5 * Runs automatically on `npm install -g squeez` or `npx squeez`.

6 */

7const { execSync } = require('child_process');

8const

(

'child_process'

);

9const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

10const path = require('path');

11const os = require('os');

12

13const BINARY = path.join(

14 os.homedir(), '.claude', 'squeez', 'bin',

15 process.platform === 'win32' ? 'squeez.exe' : 'squeez'

16);

17

18if (!fs.existsSync(BINARY)) {

19 process.stderr.write('squeez: binary not found — running installer...\n');

20 if (process.platform === 'win32') {

21 process.stderr.write('squeez: on Windows, download from https://github.com/claudioemmanuel/squeez/releases\n');

22 process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

23 }

24 try {

25 execSync(

26 'curl -fsSL https://raw.githubusercontent.com/claudioemmanuel/squeez/main/install.sh | sh',

27 { stdio: 'inherit' }

•matchType = normalized_sha256 matchedPackage = squeez@1.46.3 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.46.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e5e3d144990d97e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = squeez@1.46.3 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.46.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin.jsView on unpkg

https

=

require

(

'https'

);

9const fs = require('fs');

10const path = require('path');

11const os = require('os');

12

13// Allow skipping (e.g. in CI that only needs the npm package metadata)

14if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0);

15

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L6

16const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez');

17const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

18const RELEASES = 'https://github.com/claudioemmanuel/squeez/releases/latest/download';

19

20function log(msg) { process.stdout.write(`squeez: ${msg}\n`); }

21function warn(msg) { process.stderr.write(`squeez: ${msg}\n`); }

22

23// ── Platform map ───────────────────────────────────────────────────────────

24const PLATFORM_MAP = {

25 darwin: { x64: 'squeez-macos-universal', arm64: 'squeez-macos-universal' },

26 linux: { x64: 'squeez-linux-x86_64', arm64: 'squeez-linux-aarch64' },

27 win32: { x64: 'squeez-windows-x86_64.exe' },

28};

29

30function getBinary() {

31 const plat = PLATFORM_MAP[process.platform];

32 if (!plat) return null;

33 return plat[process.arch] || plat['x64'] || null;

34}

35

•matchType = normalized_sha256 matchedPackage = squeez@1.46.3 matchedPath = install.js matchedIdentity = npm:c3F1ZWV6:1.46.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg