registry / tweakcc / 4.3.2

tweakcc@4.3.2

⚠ Under review

Command-line tool to customize your Claude Code theme colors, thinking verbs and more.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 335 KB of source, external domains: example.com, github.com, piebald.ai, raw.githubusercontent.com

Source & flagged code

6 flagged

dist/nativeInstallation-DxEGtoxP.mjsView file

Lines 1-4javascript

1import{S as e,f as t}from"./config-Do-CXBW0.mjs";import n from"node:fs";import{execSync as r}from"node:child_process";import i from"node-lief";function a(e){try{if(n.statSync(e).size>2e5)return null;i.logging.disable();let r=i.parse(e);if(!r.symbols().some(e=>{let t=e.name;return t===`execv`||t===`_execv`}))return t(`resolveNixBinaryWrapper: no execv import found, not a Nix wrapper`),null;t(`resolveNixBinaryWrapper: execv import found, checking for Nix wrapper DOCSTRING`);let a=null;if(r.format===`ELF`){let e=r.sections().find(e=>e.name===`.rodata`);e&&(a=e.content)}else if(r.format===`MachO`) ...

2---- Bun! ----

High

Child Process

Package source references child process execution.

dist/nativeInstallation-DxEGtoxP.mjsView on unpkg · L1

3`);function s(e,t){return e.subarray(t.offset,t.offset+t.length)}function c(e,t){return{offset:e.readUInt32LE(t),length:e.readUInt32LE(t+4)}}function l(e){return e.endsWith(`/claude`)||e===`claude`||e.endsWith(`/claude.exe`)||e===`claude.exe`||e.endsWith(`/src/entrypoints/cli.js`)||e===`src/entrypoints/cli.js`}function u(e){let n=e%52==0,r=e%36==0;return n&&!r?52:r&&!n?36:n&&r?(t(`detectModuleStructSize: Ambiguous module list

4Please close all Claude instances and try again.`):e}}function w(e,t=8){let n=Buffer.allocUnsafe(t+e.length);return t===8?n.writeBigUInt64LE(BigInt(e.length),0):n.writeUInt32LE(e.length,0),e.copy(n,t),n}function T(n,a,o,s,c){try{t(`repackMachO: Has code signature: ${n.hasCodeSignature}`),n.hasCodeSignature&&(t(`repackMachO: Removing code signature...`),n.removeSignature());let l=n.getSegment(`__BUN`);if(!l)throw Error(`__BUN segment not found`);let u=l.getSection(`__bun`);if(!u)throw Error(`__bun section not found`);let d=w(o,c);t(`repackMachO: Original section size: ${u.size}`),t(`repackMachO ...

Long lines were clipped for display.

dist/index.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2import{$ as e,A as t,C as n,E as r,F as i,G as a,H as o,I as s,J as c,K as l,L as u,M as d,N as f,O as

dist/config-Do-CXBW0.mjsView file

Lines 1-21javascript

1import e from"chalk";import t,{EOL as n}from"node:os";import*as r from"node:fs/promises";import i from"node:fs/promises";import*as a from"node:fs";

Source & flagged code

6 flagged · loading source

dist/nativeInstallation-DxEGtoxP.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code