registry / tweakcc-fixed / 2.6.4

tweakcc-fixed@2.6.4

⚠ Under review

Maintained fork of tweakcc — patch an installed Claude Code (npm or native binary) with curated system-prompt overrides, system-reminder overrides, and fork-only patches. Pairs with skrabe/lobotomized-claude-code.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 504 KB of source, external domains: example.com, github.com, piebald.ai, raw.githubusercontent.com

Source & flagged code

6 flagged

dist/config-Dd0mwDex.mjsView file

Lines 1-21javascript

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs/promises";import*as s from"node:fs";import c from"node:fs";import*as l from"node:path";import u from"node:path";import*as d from"fs";import*as f from"path";import*as p from"os";import*as m from"child_process";import*as h from"crypto";import{spawnSync as g}from"node:child_process";import _ from"gray-matter";import{fileURLToPath as v}from"node:url";import{Worker as y}from"node:worker_threads";import{diffWordsWithSpace ...

High

Child Process

Package source references child process execution.

dist/config-Dd0mwDex.mjsView on unpkg · L1

3# level

4Pick the integer effort level (0 = least effort, {MAX} = most) for the NEW message, judged IN CONTEXT of the summary, the context block, and the recent exchange:

5{LEVELS}

7How to judge:

8- A short or vague prompt does NOT mean an easy task. A terse follow-up (now do the same, fix it, continue, keep going, ok next) inherits the difficulty of the work it continues - score it like that ongoing work, reading the summary and recent exchange to see what is actually being built, not like a fresh trivial request.

9- Conversely, a genuinely new, self-contained simple request (rename a variable, fix a typo, bump a version, answer a quick question) is low even in the middle of a hard session.

10- Watch for hidden complexity behind simple wording: concurrency, security, distributed state, performance or correctness constraints, cross-file or multi-module impact, niche toolchains, specialized domains.

11- Errors, failed attempts, active debugging, or a very large prior assistant turn (shown by an omitted-from-the-middle marker) in the recent exchange or the summary are strong evidence the work needs careful reasoning - lean higher.

12- The CONTEXT block shows the level you assigned last turn; use it for continuity - hold effort steady while the same work continues, and only drop when the NEW message clearly starts something simpler. The model in use is your calibration baseline: the level is the thinking depth for THAT model.

13- When unsure, do NOT default to the top. Default to the standard middle level and let clear signals push it up or down. The top level ({MAX}) is rare - reserve it for exactly what its description says, not for ordinary hard work.

15# summary

16Output an updated running summary - a terse TL;DR of the session in the fewest words that still capture what was done and how hard it has been. Fold the most recent exchange into the prior summary as one short line (what this turn did and its complexity), then compress: keep the task or goal, key decisions, files or systems touched, unresolved threads, and difficulty signals (errors, retries, large changes); mark resolved items resolved and drop anything that will not affect future routing. It is a routing aid, not documentation - favor brevity.`,O={themes:[{name:`Dark mode`,id:`dark

17`)}]})`,p=c;c=c.slice(0,t.index)+f+c.slice(t.index+t[0].length),I(p,c,f,t.index,t.index+f.length)}else{let t=Ge(c);if(!t)console.log(`patch: patchesAppliedIndication: patch 3 skipped (see prior message)`);else{let r=[];r.push(`,${d}.createElement(${e}, { flexDirection: "column" },`),r.push(`${d}.createElement(${e}, null, ${d}.createElement(${u}, {color: "success", bold: true}, "\\u2503 "), ${d}.createElement(${u}, {color: "success", bold: true}, "\\u2713 tweakcc-fixed patches are applied")),`);for(let t of n)t=t.replace(`CHALK_VAR

18`);t.startIndex>0&&c[t.startIndex-1]===`,`&&i.startsWith(`,`)&&(i=i.slice(1)),i.endsWith(`,`)&&c[t.startIndex]===`,`&&(i=i.slice(0,-1));let a=c;c=c.slice(0,t.startIndex)+i+c.slice(t.endIndex),I(a,c,i,t.startIndex,t.endIndex)}}}return c};function qe(){try{let e=v(import.meta.url),t=f.dirname(e);for(let e=0;e<5;e++){let e=f.join(t,`data`,`prompts`),n=f.join(t,`package.json`);if(s.existsSync(n)&&s.existsSync(e))return e;let r=f.dirname(t);if(r===t)break;t=r}}catch{}return null}async function Je(e){let t=qe();if(t){let n=f.join(t,`prompts-${e}.json`);try{let e=await a.readFile(n,`utf-8`);return JS ...

19{{context_blocks}}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/config-Dd0mwDex.mjsView on unpkg · L1

21 IMPORTANT: this context may or may not be relevant to your tasks. You should not respond to this context unless it is highly relevant to your task.`,apply(e,t,n){let r=e.match(/function ([$\w]+)$([$\w]+),([$\w]+)$\{if$Object\.entries\(\3$\.length===0\)return \2;return\[([$\w]+)\(\{content:`<system-reminder>\n[\s\S]*?\n<

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = tweakcc-fixed@2.5.4 matchedIdentity = npm:dHdlYWtjYy1maXhlZA:2.5.4 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config-Dd0mwDex.mjsView on unpkg

dist/index.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as

Source & flagged code

6 flagged · loading source

dist/config-Dd0mwDex.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config-Dd0mwDex.mjsView on unpkg

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs... L2:

High

Child Process

Package source references child process execution.

dist/config-Dd0mwDex.mjsView on unpkg · L1

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs... L2: ... L15: # summary L16: Output an updated running summary - a terse TL;DR of the session in the fewest words that still capture what was done and how hard it has been. Fold the most recent exchange into t... L17: `)}]})`,p=c;c=c.slice(0,t.index)+f+c.slice(t.index+t[0].length),I(p,c,f,t.index,t.index+f.length)}else{let t=Ge(c);if(!t)console.log(`patch: patchesAppliedIndication: patch 3 skipp... L18: `);t.startIndex>0&&c[t.startIndex-1]===`,`&&i.startsWith(`,`)&&(i=i.slice(1)),i.endsWith(`,`)&&c[t.startIndex]===`,`&&(i=i.slice(0,-1));let a=c;c=c.slice(0,t.startIndex)+i+c.slice(... L19: {{context_blocks}} ... L54: L55: IMPORTANT: After completing your current task, you MUST address the user's message above. Do not ignore it.`,apply(e,t,n){return M(e,/((?:case"auto-continuation":)?case"human":case... L56: `).length-1),{name:n||``,description:r||``,ccVersion:i||``,variables:a||[],content:t.content,contentLineOffset:o}},Dt=(e,t,n)=>{let r=t||N(e.pieces,e.identifiers,e.identifierMap),i... ... L600:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/config-Dd0mwDex.mjsView on unpkg · L1

dist/index.mjsView file

21const vars = ${JSON.stringify(n)}; L22: process.env = {}; L23: const fn = new Function('js', 'vars', ${JSON.stringify(e)}); L24: const result = await fn(input, vars); ... L30: }); L31: `;if(r)return Pn([],i,t);try{return await Pn([`--permission`],i,t)}catch(e){if(!Mn(e))throw e}try{return await Pn([`--experimental-permission`],i,t)}catch(e){if(Mn(e)){let e=Nn();t... L32: Patches applied (run with --show-unchanged to show all patches):`);for(let e of n){let n=r.get(e).filter(e=>e.applied||e.failed||_()||t&&t.includes(e.id));if(n.length!==0){console....

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L21

1#!/usr/bin/env node L2: import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as y,W as b,X as x,Z as S,_ as C,a as ... L3: `+t.out.slice(-600)),n(`error`);return}u(`Installing (registers with every Chromium browser, MCP, skill, disables Claude in Chrome)…`);let r=[Ut,`install`,`--scope`,e];e===`project... ... L10: Please reapply your changes by running \`${n} --apply\`.`,type:`warning`}),d(()=>{}))},[]),B((e,t)=>{t.ctrl&&e===`c`&&process.exit(0),(e===`q`||t.escape)&&!p&&process.exit(0),e===`... L11: `).length,timings:{formatMs:l-o,diffMs:d-l,totalMs:d-o}}}function Dn(e,t=!0){return new Promise(n=>{let r=!1,i=e=>{r||(r=!0,a.close(),n(e))},a=Be.createInterface({input:process.std... L12: ⚠ The patched code failed to parse, but the original parsed cleanly —

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

22process.env = {}; L23: const fn = new Function('js', 'vars', ${JSON.stringify(e)}); L24: const result = await fn(input, vars);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L22

Findings

1 Critical3 High2 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/config-Dd0mwDex.mjs

HighChild Processdist/config-Dd0mwDex.mjs

HighSame File Env Network Executiondist/index.mjs

HighCommand Output Exfiltrationdist/index.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.mjs

LowWeak Cryptodist/config-Dd0mwDex.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/config-Dd0mwDex.mjsView file

Lines 1-21javascript

1import{createRequire as e}from"node:module";import t from"chalk";import*as n from"node:os";import r,{EOL as i}from"node:os";import*as a from"node:fs/promises";import o from"node:fs/promises";import*as s from"node:fs";import c from"node:fs";import*as l from"node:path";import u from"node:path";import*as d from"fs";import*as f from"path";import*as p from"os";import*as m from"child_process";import*as h from"crypto";import{spawnSync as g}from"node:child_process";import _ from"gray-matter";import{fileURLToPath as v}from"node:url";import{Worker as y}from"node:worker_threads";import{diffWordsWithSpace ...

High

Child Process

Package source references child process execution.

dist/config-Dd0mwDex.mjsView on unpkg · L1

3# level

4Pick the integer effort level (0 = least effort, {MAX} = most) for the NEW message, judged IN CONTEXT of the summary, the context block, and the recent exchange:

5{LEVELS}

7How to judge:

9- Conversely, a genuinely new, self-contained simple request (rename a variable, fix a typo, bump a version, answer a quick question) is low even in the middle of a hard session.

15# summary

19{{context_blocks}}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/config-Dd0mwDex.mjsView on unpkg · L1

Long lines were clipped for display.

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config-Dd0mwDex.mjsView on unpkg

dist/index.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import{$ as e,B as t,D as n,E as r,F as i,G as a,H as o,I as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as m,R as h,S as g,T as _,U as v,V as