Loading npm security reports…

squeez@1.48.4: AI-agent control-surface risk | LPM Firewall

registry / squeez / 1.48.4

squeez@1.48.4

Hook-based token compressor for Claude Code, Copilot CLI, and OpenCode. Compresses bash output up to 95%, collapses redundant calls, injects caveman persona.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall fetches and executes remote code, then invokes native setup to register AI-agent hooks. The setup targets user-level AI CLI control surfaces.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package, including npm postinstall.

Impact

Unconsented code execution and modification of AI-agent configuration or extension surfaces.

Mechanism

Remote shell execution followed by automatic AI-agent hook registration.

Policy narrative

Installing this package runs a postinstall hook. On Unix, that hook downloads an unpinned script from raw GitHub and pipes it to sh; its fallback downloads a native executable. It then runs setup automatically to register hooks, and the package identifies several user-level AI CLI configuration and plugin locations as targets. This creates an unconsented install-time path to execute mutable remote code and alter broad AI-agent control surfaces.

Rationale

The automatic lifecycle hook executes mutable remote code and performs hook registration without a separate user setup action. This meets the install-time AI-agent control-surface abuse boundary.

Evidence

package.jsoninstall.jsREADME.md~/.claude/squeez/bin/squeez~/.claude/CLAUDE.md~/.copilot/copilot-instructions.md~/.config/opencode/AGENTS.md~/.config/opencode/plugins/squeez.js

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin.jsView file

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin.jsView on unpkg · L7

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs'); ... L13: const BINARY = path.join( L14: os.homedir(), '.claude', 'squeez', 'bin', L15: process.platform === 'win32' ? 'squeez.exe' : 'squeez' L16: ); ... L18: if (!fs.existsSync(BINARY)) { L19: process.stderr.write('squeez: binary not found — running installer...\n'); L20: if (process.platform === 'win32') { L21: process.stderr.write('squeez: on Windows, download from https://github.[redacted]\n'); L22: process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = squeez@1.48.2 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.48.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e5e3d144990d97e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = squeez@1.48.2 matchedPath = bin.js matchedIdentity = npm:c3F1ZWV6:1.48.2 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin.jsView on unpkg

7*/ L8: const { execFileSync, execSync } = require('child_process'); L9: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.jsView on unpkg · L7

install.jsView file

15L16: const INSTALL_DIR = path.join(os.homedir(), '.claude', 'squeez'); L17: const BINARY = path.join(INSTALL_DIR, 'bin', process.platform === 'win32' ? 'squeez.exe' : 'squeez'); ... L92: L93: fs.mkdirSync(path.join(INSTALL_DIR, 'bin'), { recursive: true }); L94: fs.mkdirSync(path.join(INSTALL_DIR, 'hooks'), { recursive: true }); L95: fs.mkdirSync(path.join(INSTALL_DIR, 'sessions'), { recursive: true }); L96: ... L118: warn(`squeez setup failed: ${err.message}`); L119: warn('run manually: ~/.claude/squeez/bin/squeez setup'); L120: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L15

6*/ L7: const { execSync } = require('child_process'); L8: const https = require('https'); L9: const fs = require('fs'); ... L13: // Allow skipping (e.g. in CI that only needs the npm package metadata) L14: if (process.env.SQUEEZ_SKIP_INSTALL === '1') process.exit(0); L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = squeez@1.48.2 matchedPath = install.js matchedIdentity = npm:c3F1ZWV6:1.48.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.js