Loading npm security reports…

squeez@1.48.2: Malicious npm security report (Block) | LPM Firewall

registry / squeez / 1.48.2

squeez@1.48.2

Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation automatically retrieves and executes unpinned remote code, then invokes a downloaded binary to register Claude Code hooks. This can alter the user's AI-agent configuration outside the package directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, including postinstall execution.

Impact

A remote publisher can execute code and modify the Claude Code control surface during dependency installation.

Mechanism

Remote shell execution and automatic Claude Code hook registration.

Attack narrative

Installing the package runs its postinstall hook. On non-Windows systems, that hook fetches a shell script from a moving GitHub branch and pipes it to sh. Its fallback downloads an executable from the latest release, makes it executable, and invokes setup to register Claude Code hooks. The downloaded script and binary are not present or integrity-pinned in this package, so they can perform arbitrary changes while installation automatically reaches an external AI-agent control surface.

Rationale

The automatic postinstall executes unpinned remote code and uses it to register hooks in a foreign AI-agent environment. This is concrete install-hook abuse, not merely an explicit user-invoked setup command.

Evidence

package.jsoninstall.js~/.claude/squeez/bin/squeez~/.claude/squeez/hooks~/.claude/squeez/sessions

Network endpoints2

/claudioemmanuel/squeez/main/install.sh

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin.jsView file

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs'); ... L13: const BINARY = path.join( L14: os.homedir(), '.claude', 'squeez', 'bin', L15: process.platform === 'win32' ? 'squeez.exe' : 'squeez' L16: ); ... L18: if (!fs.existsSync(BINARY)) { L19: process.stderr.write('squeez: binary not found — running installer...\n'); L20: if (process.platform === 'win32') { L21: process.stderr.write('squeez: on Windows, download from https://github.[redacted]\n'); L22: process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = squeez@1.47.0 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.47.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e5e3d144990d97e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = squeez@1.47.0 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.47.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin.jsView on unpkg

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

install.jsView file

15L16: const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez'); L17: const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez'); ... L92: L93: fs.mkdirSync(path.join(INSTALL_DIR, 'bin'), { recursive: true }); L94: fs.mkdirSync(path.join(INSTALL_DIR, 'hooks'), { recursive: true }); L95: fs.mkdirSync(path.join(INSTALL_DIR, 'sessions'), { recursive: true }); L96: ... L118: warn(`squeez setup failed: ${err.message}`); L119: warn('run manually: ~/.claude/squeez/bin/squeez setup'); L120: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

6*/ L7: const { execSync } = require('child_process'); L8: const https = require('https'); L9: const fs = require('fs'); ... L13: // Allow skipping (e.g. in CI that only needs the npm package metadata) L14: if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0); L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = squeez@1.47.0 matchedPath = install.js matchedIdentity = npm:c3F1ZWV6:1.47.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.js