registry / tweakcc-fixed / 2.5.3

tweakcc-fixed@2.5.3

Maintained fork of tweakcc — patch an installed Claude Code (npm or native binary) with curated system-prompt overrides, system-reminder overrides, and fork-only patches. Pairs with skrabe/lobotomized-claude-code.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 493 KB of source, external domains: example.com, github.com, piebald.ai, raw.githubusercontent.com

Source & flagged code

5 flagged

dist/config-BfUx7VQX.mjsView file

Lines 1-21javascript

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs/promises";import*as s from"node:fs";import c from"node:fs";import*as l from"node:path";import u from"node:path";import*as d from"fs";import*as f from"path";import*as p from"os";import*as m from"child_process";import*as h from"crypto";import{spawnSync as g}from"node:child_process";import _ from"gray-matter";import{fileURLToPath as v}from"node:url";import{Worker as y}from"node:worker_threads";import{diffWordsWithSpace ...

High

Child Process

Package source references child process execution.

dist/config-BfUx7VQX.mjsView on unpkg · L1

3# level

4Pick the integer effort level (0 = least effort, {MAX} = most) for the NEW message, judged IN CONTEXT of the summary, the context block, and the recent exchange:

5{LEVELS}

7How to judge:

8- A short or vague prompt does NOT mean an easy task. A terse follow-up (now do the same, fix it, continue, keep going, ok next) inherits the difficulty of the work it continues - score it like that ongoing work, reading the summary and recent exchange to see what is actually being built, not like a fresh trivial request.

9- Conversely, a genuinely new, self-contained simple request (rename a variable, fix a typo, bump a version, answer a quick question) is low even in the middle of a hard session.

10- Watch for hidden complexity behind simple wording: concurrency, security, distributed state, performance or correctness constraints, cross-file or multi-module impact, niche toolchains, specialized domains.

11- Errors, failed attempts, active debugging, or a very large prior assistant turn (shown by an omitted-from-the-middle marker) in the recent exchange or the summary are strong evidence the work needs careful reasoning - lean higher.

12- The CONTEXT block shows the level you assigned last turn; use it for continuity - hold effort steady while the same work continues, and only drop when the NEW message clearly starts something simpler. The model in use is your calibration baseline: the level is the thinking depth for THAT model.

13- When unsure, do NOT default to the top. Default to the standard middle level and let clear signals push it up or down. The top level ({MAX}) is rare - reserve it for exactly what its description says, not for ordinary hard work.

15# summary

16Output an updated running summary - a terse TL;DR of the session in the fewest words that still capture what was done and how hard it has been. Fold the most recent exchange into the prior summary as one short line (what this turn did and its complexity), then compress: keep the task or goal, key decisions, files or systems touched, unresolved threads, and difficulty signals (errors, retries, large changes); mark resolved items resolved and drop anything that will not affect future routing. It is a routing aid, not documentation - favor brevity.`,O={themes:[{name:`Dark mode`,id:`dark

17`)}]})`,p=c;c=c.slice(0,t.index)+f+c.slice(t.index+t[0].length),L(p,c,f,t.index,t.index+f.length)}else{let t=Ge(c);if(!t)console.log(`patch: patchesAppliedIndication: patch 3 skipped (see prior message)`);else{let r=[];r.push(`,${d}.createElement(${e}, { flexDirection: "column" },`),r.push(`${d}.createElement(${e}, null, ${d}.createElement(${u}, {color: "success", bold: true}, "\\u2503 "), ${d}.createElement(${u}, {color: "success", bold: true}, "\\u2713 tweakcc-fixed patches are applied")),`);for(let t of n)t=t.replace(`CHALK_VAR

18`);t.startIndex>0&&c[t.startIndex-1]===`,`&&i.startsWith(`,`)&&(i=i.slice(1)),i.endsWith(`,`)&&c[t.startIndex]===`,`&&(i=i.slice(0,-1));let a=c;c=c.slice(0,t.startIndex)+i+c.slice(t.endIndex),L(a,c,i,t.startIndex,t.endIndex)}}}return c};function qe(){try{let e=v(import.meta.url),t=f.dirname(e);for(let e=0;e<5;e++){let e=f.join(t,`data`,`prompts`),n=f.join(t,`package.json`);if(s.existsSync(n)&&s.existsSync(e))return e;let r=f.dirname(t);if(r===t)break;t=r}}catch{}return null}async function Je(e){let t=qe();if(t){let n=f.join(t,`prompts-${e}.json`);try{let e=await a.readFile(n,`utf-8`);return JS ...

19{{context_blocks}}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/config-BfUx7VQX.mjsView on unpkg · L1

21 IMPORTANT: this context may or may not be relevant to your tasks. You should not respond to this context unless it is highly relevant to your task.`,apply(e,t,n){let r=e.match(/function ([$\w]+)$([$\w]+),([$\w]+)$\{if$Object\.entries\(\3$\.length===0\)return \2;return\[([$\w]+)\(\{content:`<system-reminder>\n[\s\S]*?\n<

Long lines were clipped for display.

dist/index.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as

Source & flagged code

5 flagged · loading source

dist/config-BfUx7VQX.mjsView file

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs... L2:

High

Child Process

Package source references child process execution.

dist/config-BfUx7VQX.mjsView on unpkg · L1

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs... L2: ... L15: # summary L16: Output an updated running summary - a terse TL;DR of the session in the fewest words that still capture what was done and how hard it has been. Fold the most recent exchange into t... L17: `)}]})`,p=c;c=c.slice(0,t.index)+f+c.slice(t.index+t[0].length),L(p,c,f,t.index,t.index+f.length)}else{let t=Ge(c);if(!t)console.log(`patch: patchesAppliedIndication: patch 3 skipp... L18: `);t.startIndex>0&&c[t.startIndex-1]===`,`&&i.startsWith(`,`)&&(i=i.slice(1)),i.endsWith(`,`)&&c[t.startIndex]===`,`&&(i=i.slice(0,-1));let a=c;c=c.slice(0,t.startIndex)+i+c.slice(... L19: {{context_blocks}} ... L54: L55: IMPORTANT: After completing your current task, you MUST address the user's message above. Do not ignore it.`,apply(e,t,n){return M(e,/((?:case"auto-continuation":)?case"human":case... L56: `).length-1),{name:n||``,description:r||``,ccVersion:i||``,variables:a||[],content:t.content,contentLineOffset:o}},Et=(e,t,n)=>{let r=t||P(e.pieces,e.identifiers,e.identifierMap),i... ... L600:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/config-BfUx7VQX.mjsView on unpkg · L1

dist/index.mjsView file

1#!/usr/bin/env node L2: import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as y,W as b,X as x,Z as S,_ as C,a as ... L3: (However, your customization are still remembered in ${N}.) ... L16: const vars = ${JSON.stringify(n)}; L17: process.env = {}; L18: const fn = new Function('js', 'vars', ${JSON.stringify(e)});

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as y,W as b,X as x,Z as S,_ as C,a as ... L3: (However, your customization are still remembered in ${N}.) ... L5: Please reapply your changes by running \`${n} --apply\`.`,type:`warning`}),d(()=>{}))},[]),H((e,t)=>{t.ctrl&&e===`c`&&process.exit(0),(e===`q`||t.escape)&&!p&&process.exit(0),e===`... L6: `).length,timings:{formatMs:l-o,diffMs:d-l,totalMs:d-o}}}function pn(e,t=!0){return new Promise(n=>{let r=!1,i=e=>{r||(r=!0,a.close(),n(e))},a=ze.createInterface({input:process.std... L7: ⚠ The patched code failed to parse, but the original parsed cleanly —

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

17process.env = {}; L18: const fn = new Function('js', 'vars', ${JSON.stringify(e)}); L19: const result = await fn(input, vars);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L17

Findings

3 High2 Medium6 Low

HighChild Processdist/config-BfUx7VQX.mjs

HighSame File Env Network Executiondist/index.mjs

HighCommand Output Exfiltrationdist/index.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.mjs

LowWeak Cryptodist/config-BfUx7VQX.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/config-BfUx7VQX.mjsView file

Lines 1-21javascript

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs/promises";import*as s from"node:fs";import c from"node:fs";import*as l from"node:path";import u from"node:path";import*as d from"fs";import*as f from"path";import*as p from"os";import*as m from"child_process";import*as h from"crypto";import{spawnSync as g}from"node:child_process";import _ from"gray-matter";import{fileURLToPath as v}from"node:url";import{Worker as y}from"node:worker_threads";import{diffWordsWithSpace ...

High

Child Process

Package source references child process execution.

dist/config-BfUx7VQX.mjsView on unpkg · L1

3# level

4Pick the integer effort level (0 = least effort, {MAX} = most) for the NEW message, judged IN CONTEXT of the summary, the context block, and the recent exchange:

5{LEVELS}

7How to judge:

9- Conversely, a genuinely new, self-contained simple request (rename a variable, fix a typo, bump a version, answer a quick question) is low even in the middle of a hard session.

15# summary

19{{context_blocks}}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/config-BfUx7VQX.mjsView on unpkg · L1

Long lines were clipped for display.

dist/index.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as