The `latest` trap

If you follow the ccstatusline README and use npx -y ccstatusline@latest, Claude Code will automatically download and run whatever code is currently tagged latest on npm, every single session.

The problem is that this command sits in a path that runs automatically, like the status line, which creates the following risks:

• No diff review: You can't review the changes before they run
• No approval prompt: -y hides the confirmation step
• Silent changes: Even if the package changes, the user isn't shown anything

In other words, if a supply-chain incident occurs — such as a package account takeover or a leaked CI token — a malicious payload could execute the moment you open Claude Code.

As an alternative, it's suggested to install once and pin the version, then point directly to the local binary.

• npm install --prefix ~/.claude/statusline-packages --save-exact [email protected]
• In ~/.claude/settings.json, set command to ~/.claude/statusline-packages/node_modules/.bin/ccstatusline

This way, updates only happen when you explicitly choose to, after reviewing the release notes and version. The core message is: audit every npx ...@latest pattern that runs automatically from a config file in the same way.