registry / tweakcc-fixed / 2.5.4

tweakcc-fixed@2.5.4

Maintained fork of tweakcc — patch an installed Claude Code (npm or native binary) with curated system-prompt overrides, system-reminder overrides, and fork-only patches. Pairs with skrabe/lobotomized-claude-code.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 495 KB of source, external domains: example.com, github.com, piebald.ai, raw.githubusercontent.com

Source & flagged code

5 flagged

dist/index.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as y,W as b,X as x,Z as S,_ as C,a as ee,b as w,d as te,et as T,g as E,h as D,i as ne,j as O,k as re,l as k,m as ie,n as A,nt as ae,o as j,p as M,q as oe,r as N,s as se,t as P,tt as F,u as I,v as L,x as ce,y as R,z as le}from"./config-ZqNydZNj.mjs";import{a as ue,c as de,d as fe,l as pe,n as z,o as me,s as he,t as ge,u as _e}from"./content-Clhy3wBs.mjs";import{Box as B,Text as V,render as ve,useInput as H,useStdin as ye}from"ink";import{Command as be}fro ...

3(However, your customization are still remembered in ${N}.)

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L1

5Please reapply your changes by running \`${n} --apply\`.`,type:`warning`}),d(()=>{}))},[]),H((e,t)=>{t.ctrl&&e===`c`&&process.exit(0),(e===`q`||t.escape)&&!p&&process.exit(0),e===`h`&&!p&&o&&(s(!1),I(e=>{e.hidePiebaldAnnouncement=!0}))},{isActive:!p});let h=t=>{switch(u(null),t){case Z.THEMES:case Z.THINKING_VERBS:case Z.THINKING_STYLE:case Z.USER_MESSAGE_DISPLAY:case Z.INPUT_PATTERN_HIGHLIGHTERS:case Z.MISC:case Z.TOOLSETS:case Z.SUBAGENT_MODELS:case Z.COMPLEXITY_ROUTER:case Z.CLAUDE_MD_ALT_NAMES:case Z.SYSTEM_REMINDERS:case Z.SKILLS:m(t);break;case Z.VIEW_SYSTEM_PROMPTS:f(ee);break;case Z.RE ...

6`).length,timings:{formatMs:l-o,diffMs:d-l,totalMs:d-o}}}function pn(e,t=!0){return new Promise(n=>{let r=!1,i=e=>{r||(r=!0,a.close(),n(e))},a=ze.createInterface({input:process.stdin,output:process.stderr});a.on(`close`,()=>i(!1)),a.on(`SIGINT`,()=>i(!1)),a.question(e,e=>{let n=e.trim().toLowerCase();if(n===``)return i(t);i(n===`y`||n===`yes`)})})}function mn(e){for(let t of e){console.log(U.cyan(`@@ -${t.oldStart} +${t.newStart} @@`));for(let e of t.lines)e.startsWith(`+`)?console.log(U.green(e)):e.startsWith(`-`)?console.log(U.red(e)):console.log(U.gray(e));console.log()}}async function hn(e ...

7⚠ The patched code failed to parse, but the original parsed cleanly —

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

8 this can mean the patch corrupted the JavaScript. Proceed with caution.`)),pn(U.bold(`

9Apply anyway, despite the parse failure? [y/N] `),!1);let e=r.reason===`oxfmt-unavailable`?`oxfmt unavailable`:`the JS could not be formatted`;return console.log(U.yellow(`Could not generate formatted diff (${e}).`)),pn(U.bold(`

10Apply changes without diff preview? [Y/n] `))}return r.changeCount===0?(console.log(U.yellow(`No visible differences after formatting. Proceeding.`)),!0):(console.log(U.gray(`Formatted ${r.formattedLines.toLocaleString()} lines in ${r.timings.formatMs.toFixed(0)}ms\n`)),mn(r.hunks),console.log(U.gray(`${r.changeCount} change(s) across ${r.formattedLines.toLocaleString()} formatted lines (${r.timings.totalMs.toFixed(0

11Apply these changes? [Y/n] `)))}function gn(e){return l(),{chalkVar:le(e),moduleLoaderFunction:y(e),reactVar:o(e),requireFuncName:v(e),textComponent:t(e),boxComponent:h(e)}}async function _n(e,t,n,r=!1){let i=`

12 let input = '';

13 process.stdin.on('data', c => input += c);

14 process.stdin.on('end', async () => {

15 try {

16 const vars = ${JSON.stringify(n)};

17 process.env = {};

18 const fn = new Function('js', 'vars', ${JSON.stringify(e)});

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L1

19 const result = await fn(input, vars);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L17

20 process.stdout.write(JSON.stringify({"r": result}));

21 } catch (e) {

22 process.stderr.write(e instanceof Error ? e.message : String(e));

23 process.exitCode = 1;

24 }

25 });

26 `;if(r)return bn([],i,t);try{return await bn([`--permission`],i,t)}catch(e){if(!vn(e))throw e}try{return await bn([`--experimental-permission`],i,t)}catch(e){if(vn(e)){let e=yn();throw Error(`Your Node.js version (${e}) does not support the permission model.\nPlease either upgrade to Node.js 20+ or rerun with --dangerous-no-script-sandbox.`)}throw e}}function vn(e){return e instanceof Error?e.message.includes(`bad option`):!1}function yn(){try{return Ne(`node --version`,{encoding:`utf8`}).trim()}catch{return`unknown`}}function bn(e,t,n){return new Promise((r,i)=>{let a=Pe(`node`,[...e,`-e`,t ...

27Patches applied (run with --show-unchanged to show all patches):`);for(let e of n){let n=r.get(e).filter(e=>e.applied||e.failed||_()||t&&t.includes(e.id));if(n.length!==0){console.log(`\n ${U.bold(e)}:`);for(let e of n){let t=e.failed?U.red(`✗`):e.applied?U.green(`✓`):U.dim(`○`),n=e.details?`: ${e.details}`:``,r=e.applied&&e.description?` ${U.gray(`—`)} ${U.gray(e.description)}`:``;console.log(` ${t} ${e.name}${n}${r}`)}}}console.log(``)}function Nn(e){let t=e.filter(e=>e.applied&&e.modelFacing);if(t.length!==0){console.log(U.yellow(`ℹ These applied patches change model-facing behavior (no ...

28✖ Error downloading system prompts:`)),console.log(U.red(` ${a.errorMessage}`)),console.log(U.yellow(`

29⚠ System prompts not available - skipping system prompt customizations`))),console.log(`Applying customizations...`);let{results:o}=await i(n,r,e);Mn(o,e),Nn(o);let s=o.some(e=>e.failed),c=o.some(e=>e.group===d.SYSTEM_PROMPTS&&e.applied);s?(console.log(U.yellow(`Customizations applied with some failures.`)),console.log(U.dim(`These patching errors do not affect your system prompt patches.`)),c&&console.log(U.dim(`Your system prompt customizations were still applied successfully.`)),console.log(U.dim(`Please open an issue on https://github.com/skrabe/tweakcc-fixed/issues/new reporting these pat ...

30✖ Error loading system prompts:`)),console.error(U.red(` ${n.errorMessage}`)),process.exit(1));let r=S();(!r||r.length===0)&&(console.error(U.yellow(`No system prompts found for this version.`)),process.exit(1));let i=e=>{let t=e.indexOf(`:`);if(t===-1)return`Other`;let n=e.substring(0,t).trim();return n===`Data`?n:n+`s`},a=new Map;for(let e of r){let t=i(e.name);a.has(t)||a.set(t,[]),a.get(t).push(e)}let o=[...a.keys()].sort((e,t)=>e.localeCompare(t));console.log(U.gray(`Use --patches <ids> with --apply to apply specific prompts, e.g.:`)),console.log(),console.log(U.gray(` tweakcc --apply - ...

31✖ Error downloading system prompts:`)),console.log(U.red(` ${r.errorMessage}`)),console.log(U.yellow(`⚠ System prompts not available - system prompt customizations will be skipped

32`))),ve(J(sn,{startupCheckInfo:e,configMigrated:t,invocationCommand:jn(),initialConfig:n}))}Pn();export{};

Long lines were clipped for display.

dist/config-ZqNydZNj.mjsView file

Lines 1-21javascript

Source & flagged code

5 flagged · loading source

dist/index.mjsView file

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as y,W as b,X as x,Z as S,_ as C,a as ... L3: (However, your customization are still remembered in ${N}.) ... L16: const vars = ${JSON.stringify(n)}; L17: process.env = {}; L18: const fn = new Function('js', 'vars', ${JSON.stringify(e)});

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as y,W as b,X as x,Z as S,_ as C,a as ... L3: (However, your customization are still remembered in ${N}.) ... L5: Please reapply your changes by running \`${n} --apply\`.`,type:`warning`}),d(()=>{}))},[]),H((e,t)=>{t.ctrl&&e===`c`&&process.exit(0),(e===`q`||t.escape)&&!p&&process.exit(0),e===`... L6: `).length,timings:{formatMs:l-o,diffMs:d-l,totalMs:d-o}}}function pn(e,t=!0){return new Promise(n=>{let r=!1,i=e=>{r||(r=!0,a.close(),n(e))},a=ze.createInterface({input:process.std... L7: ⚠ The patched code failed to parse, but the original parsed cleanly —

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

17process.env = {}; L18: const fn = new Function('js', 'vars', ${JSON.stringify(e)}); L19: const result = await fn(input, vars);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L17

dist/config-ZqNydZNj.mjsView file

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs... L2: ... L15: # summary L16: Output an updated running summary - a terse TL;DR of the session in the fewest words that still capture what was done and how hard it has been. Fold the most recent exchange into t... L17: `)}]})`,p=c;c=c.slice(0,t.index)+f+c.slice(t.index+t[0].length),L(p,c,f,t.index,t.index+f.length)}else{let t=Ge(c);if(!t)console.log(`patch: patchesAppliedIndication: patch 3 skipp... L18: `);t.startIndex>0&&c[t.startIndex-1]===`,`&&i.startsWith(`,`)&&(i=i.slice(1)),i.endsWith(`,`)&&c[t.startIndex]===`,`&&(i=i.slice(0,-1));let a=c;c=c.slice(0,t.startIndex)+i+c.slice(... L19: {{context_blocks}} ... L54: L55: IMPORTANT: After completing your current task, you MUST address the user's message above. Do not ignore it.`,apply(e,t,n){return M(e,/((?:case"auto-continuation":)?case"human":case... L56: `).length-1),{name:n||``,description:r||``,ccVersion:i||``,variables:a||[],content:t.content,contentLineOffset:o}},Et=(e,t,n)=>{let r=t||P(e.pieces,e.identifiers,e.identifierMap),i... ... L600:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/config-ZqNydZNj.mjsView on unpkg · L1

Findings

3 High2 Medium6 Low

HighChild Processdist/index.mjs

HighSame File Env Network Executiondist/index.mjs

HighCommand Output Exfiltrationdist/index.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.mjs

LowWeak Cryptodist/config-ZqNydZNj.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/index.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

3(However, your customization are still remembered in ${N}.)

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L1

7⚠ The patched code failed to parse, but the original parsed cleanly —

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

8 this can mean the patch corrupted the JavaScript. Proceed with caution.`)),pn(U.bold(`

12 let input = '';

13 process.stdin.on('data', c => input += c);

14 process.stdin.on('end', async () => {

15 try {

16 const vars = ${JSON.stringify(n)};

17 process.env = {};

18 const fn = new Function('js', 'vars', ${JSON.stringify(e)});

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L1

19 const result = await fn(input, vars);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L17

20 process.stdout.write(JSON.stringify({"r": result}));

21 } catch (e) {

22 process.stderr.write(e instanceof Error ? e.message : String(e));

23 process.exitCode = 1;

24 }

25 });

28✖ Error downloading system prompts:`)),console.log(U.red(` ${a.errorMessage}`)),console.log(U.yellow(`

31✖ Error downloading system prompts:`)),console.log(U.red(` ${r.errorMessage}`)),console.log(U.yellow(`⚠ System prompts not available - system prompt customizations will be skipped

32`))),ve(J(sn,{startupCheckInfo:e,configMigrated:t,invocationCommand:jn(),initialConfig:n}))}Pn();export{};

Long lines were clipped for display.

dist/config-ZqNydZNj.mjsView file

Lines 1-21javascript