Package Health/@anthropic-ai/claude-code

@anthropic-ai/claude-code

Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.

Latest 2.1.295

NPM

84%

Total Score

healthy

Frequent releases and active, organization-backed maintenance outweigh install scripts and limited build attestation.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

The release has no build attestation, so consumers cannot independently verify its publishing provenance from this signal. The trusted publisher is identified as GitHub, which partly offsets but does not remove the gap.

Lifecycle scripts

The package runs both postinstall and prepare scripts, adding installation-time behavior and upgrade surface beyond the bundled files. This is a real operational caution for a CLI dependency.

Repo tooling

No build tool or security-scanning tool was detected in the repository. That weakens engineering and security-process transparency, though the repository does include a separate security policy.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-965601 New @anthropic-ai/claude-code is vulnerable to Improper Authorization in versions 2.0.68 - 2.1.259.	2.0.68 - 2.1.259	Low
AIKIDO-2026-522458 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @anthropic-ai/claude-code is vulnerable to Authorization Bypass in versions 0.2.9 - 2.1.220.	0.2.9 - 2.1.220	Medium
AIKIDO-2026-690449 @anthropic-ai/claude-code is vulnerable to Sandbox Escape in versions 2.1.38 - 2.1.162.	2.1.38 - 2.1.162	High
CVE-2026-46406 @anthropic-ai/claude-code is vulnerable to Improper Link Resolution Before File Access ('Link Following') in versions 2.1.59 - 2.1.128.	2.1.59 - 2.1.128	Medium
CVE-2026-54316 @anthropic-ai/claude-code is vulnerable to Permissive List of Allowed Inputs in versions 0.2.54 - 2.1.163.	0.2.54 - 2.1.163	Critical