취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7bb3ff21cce9379a60d3ebe3408d8c179e39cfd940eed6deb4afb2f28d852254)

package.json declares bin.claude = bin/claude-win.cjs and bin.claude-linux = bin/claude under a non-Anthropic publisher (Leanchy). On npm i -g bingocode (or any project that puts node_modules/.bin on PATH), the claude command resolves to this package's launcher instead of Anthropic's official @anthropic-ai/claude-code. The launchers wrap a repackaged Claude Code fork that routes API traffic through a configurable ANTHROPIC_BASE_URL (the shipped .env.example documents MiniMax, DeepSeek, and OpenRouter as the intended backends) while continuing to read Anthropic's CLAUDE_CODE_* environment variables and ~/.claude/ config directory. Developers who type claude expecting Anthropic's CLI instead invoke this fork, which can silently relay prompts (and any auth material configured for Claude Code) to whichever third-party endpoint the publisher chooses now or in any future version. Additionally, bin/bingo-win.cjs runs powershell -ExecutionPolicy Bypass -Command 'irm bun.sh/install.ps1 | iex' to auto-install Bun when the user runs the bingo CLI; this is gated on user-initiated CLI invocation (not install/import) and points at Bun's official installer, so it is a secondary quality concern rather than a dropper. The numerous YARA hits on fetch/POST/ping in src/services/api/claude.ts, src/upstreamproxy/upstreamproxy.ts, src/services/mcp/*, and analytics exporters are consistent with a Claude Code fork talking to api.anthropic.com / api-staging.anthropic.com / docs.claude.com / platform.claude.com / Slack / Google APIs and to MCP servers — i.e., the application's normal traffic, not hardcoded attacker C2 — so they are not the basis for the block.