취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d9c6fc5df21efcd2949e4c05b4a9a75dbe8142243a3967dc853be7069ecaca24)

Package is published under the @cometix scope but its package.json sets author to 'Anthropic support@anthropic.com' and ships a README copied verbatim from Anthropic's official Claude Code, including links to claude.com, anthropic.com, and github.com/anthropics/claude-code. The actual repository is github.com/CometixSpace/claude-code — unrelated to Anthropic. The genuine package is @anthropic-ai/claude-code. Installers are deceived about provenance: they believe they are installing Anthropic's product but receive third-party code. The postinstall script (install.cjs) is itself benign — it implements the standard platform-binary wrapper pattern (detects platform/arch, copies cli.js and vendor/ from a matching @cometix/claude-code-- optional dependency, no network or exec). However, the real CLI code is delivered via those platform-specific optional dependency tarballs not analyzed here, and the falsified Anthropic metadata + verbatim README copy demonstrates intent to deceive. Combined signals — namespace impersonation of a high-profile target plus forged author identity claiming to be the legitimate vendor — warrant blocking pending review of the platform-dep payloads.