registry / tweakcc-fixed / 2.6.1

tweakcc-fixed@2.6.1

⚠ Under review

Maintained fork of tweakcc — patch an installed Claude Code (npm or native binary) with curated system-prompt overrides, system-reminder overrides, and fork-only patches. Pairs with skrabe/lobotomized-claude-code.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 506 KB of source, external domains: example.com, github.com, piebald.ai, raw.githubusercontent.com

Source & flagged code

6 flagged

dist/nativeInstallation-QNBXy4pC.mjsView file

Lines 1-4javascript

1import{p as e,w as t}from"./config-CLHOYyWX.mjs";import n from"node:os";import r from"node:fs";import i from"node:path";import{execFileSync as a,execSync as o}from"node:child_process";import s from"node-lief";function c(t){try{if(r.statSync(t).size>2e5)return null;s.logging.disable();let n=s.parse(t);if(!n.symbols().some(e=>{let t=e.name;return t===`execv`||t===`_execv`}))return e(`resolveNixBinaryWrapper: no execv import found, not a Nix wrapper`),null;e(`resolveNixBinaryWrapper: execv import found, checking for Nix wrapper DOCSTRING`);let i=null;if(n.format===`ELF`){let e=n.sections().find(e ...

2---- Bun! ----

High

Child Process

Package source references child process execution.

dist/nativeInstallation-QNBXy4pC.mjsView on unpkg · L1

3`);function u(e,t){return e.subarray(t.offset,t.offset+t.length)}function d(e,t){return{offset:e.readUInt32LE(t),length:e.readUInt32LE(t+4)}}function f(e){return e.endsWith(`/claude`)||e===`claude`||e.endsWith(`/claude.exe`)||e===`claude.exe`||e.endsWith(`/src/entrypoints/cli.js`)||e===`src/entrypoints/cli.js`}function p(t){let n=t%52==0,r=t%36==0;return n&&!r?52:r&&!n?36:n&&r?(e(`detectModuleStructSize: Ambiguous module list length ${t}, assuming new format`),52):(e(`detectModuleStructSize: Module list length ${t} doesn't cleanly divide by either struct size, assuming new format`),52)}functio ...

4Please close all Claude instances and try again.`):e}}function A(e,t=8){let n=Buffer.allocUnsafe(t+e.length);return t===8?n.writeBigUInt64LE(BigInt(e.length),0):n.writeUInt32LE(e.length,0),e.copy(n,t),n}function j(n,r,i,a,c){try{e(`repackMachO: Has code signature: ${n.hasCodeSignature}`),n.hasCodeSignature&&(e(`repackMachO: Removing code signature...`),n.removeSignature());let l=n.getSegment(`__BUN`);if(!l)throw Error(`__BUN segment not found`);let u=l.getSection(`__bun`);if(!u)throw Error(`__bun section not found`);let d=A(i,c);e(`repackMachO: Original section size: ${u.size}`),e(`repackMachO ...

Long lines were clipped for display.

dist/index.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as

dist/config-CLHOYyWX.mjsView file

Lines 1-21javascript

Source & flagged code

6 flagged · loading source

dist/nativeInstallation-QNBXy4pC.mjsView file

High

Child Process

Package source references child process execution.

dist/nativeInstallation-QNBXy4pC.mjsView on unpkg · L1

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = tweakcc-fixed@2.5.4 matchedIdentity = npm:dHdlYWtjYy1maXhlZA:2.5.4 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

21const vars = ${JSON.stringify(n)}; L22: process.env = {}; L23: const fn = new Function('js', 'vars', ${JSON.stringify(e)}); L24: const result = await fn(input, vars); ... L30: }); L31: `;if(r)return Nn([],i,t);try{return await Nn([`--permission`],i,t)}catch(e){if(!jn(e))throw e}try{return await Nn([`--experimental-permission`],i,t)}catch(e){if(jn(e)){let e=Mn();t... L32: Patches applied (run with --show-unchanged to show all patches):`);for(let e of n){let n=r.get(e).filter(e=>e.applied||e.failed||_()||t&&t.includes(e.id));if(n.length!==0){console....

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L21

1#!/usr/bin/env node L2: import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as y,W as b,X as x,Z as S,_ as C,a as ... L3: `+t.out.slice(-600)),n(`error`);return}u(`Installing (registers with every Chromium browser, MCP, skill, disables Claude in Chrome)…`);let r=[Ut,`install`,`--scope`,e];e===`project... ... L10: Please reapply your changes by running \`${n} --apply\`.`,type:`warning`}),d(()=>{}))},[]),B((e,t)=>{t.ctrl&&e===`c`&&process.exit(0),(e===`q`||t.escape)&&!p&&process.exit(0),e===`... L11: `).length,timings:{formatMs:l-o,diffMs:d-l,totalMs:d-o}}}function En(e,t=!0){return new Promise(n=>{let r=!1,i=e=>{r||(r=!0,a.close(),n(e))},a=Be.createInterface({input:process.std... L12: ⚠ The patched code failed to parse, but the original parsed cleanly —

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

22process.env = {}; L23: const fn = new Function('js', 'vars', ${JSON.stringify(e)}); L24: const result = await fn(input, vars);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L22

dist/config-CLHOYyWX.mjsView file

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs... L2: ... L15: # summary L16: Output an updated running summary - a terse TL;DR of the session in the fewest words that still capture what was done and how hard it has been. Fold the most recent exchange into t... L17: `)}]})`,p=c;c=c.slice(0,t.index)+f+c.slice(t.index+t[0].length),L(p,c,f,t.index,t.index+f.length)}else{let t=Ge(c);if(!t)console.log(`patch: patchesAppliedIndication: patch 3 skipp... L18: `);t.startIndex>0&&c[t.startIndex-1]===`,`&&i.startsWith(`,`)&&(i=i.slice(1)),i.endsWith(`,`)&&c[t.startIndex]===`,`&&(i=i.slice(0,-1));let a=c;c=c.slice(0,t.startIndex)+i+c.slice(... L19: {{context_blocks}} ... L54: L55: IMPORTANT: After completing your current task, you MUST address the user's message above. Do not ignore it.`,apply(e,t,n){return M(e,/((?:case"auto-continuation":)?case"human":case... L56: `).length-1),{name:n||``,description:r||``,ccVersion:i||``,variables:a||[],content:t.content,contentLineOffset:o}},Et=(e,t,n)=>{let r=t||P(e.pieces,e.identifiers,e.identifierMap),i... ... L600:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/config-CLHOYyWX.mjsView on unpkg · L1

Findings

1 Critical3 High2 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/index.mjs

HighChild Processdist/nativeInstallation-QNBXy4pC.mjs

HighSame File Env Network Executiondist/index.mjs

HighCommand Output Exfiltrationdist/index.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.mjs

LowWeak Cryptodist/config-CLHOYyWX.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/nativeInstallation-QNBXy4pC.mjsView file

Lines 1-4javascript

2---- Bun! ----

High

Child Process

Package source references child process execution.

dist/nativeInstallation-QNBXy4pC.mjsView on unpkg · L1

Long lines were clipped for display.

dist/index.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as

dist/config-CLHOYyWX.mjsView file

Lines 1-21javascript