@ai-dev-methodologies/rlp-desk@0.24.1: Suspicious npm security | LPM Firewall

Loading npm security reports…

@ai-dev-methodologies/rlp-desk@0.24.1: Suspicious npm security | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

9const home = os.homedir(); L10: const claudeDir = path.join(home, ".claude"); L11: const commandsDir = path.join(claudeDir, "commands"); ... L24: // injectBannerAndLock preserves the shebang and adds a `# DO NOT EDIT` L25: // line on line 2 so the verification scripts in CLAUDE.md still L26: // recognize the file as installed. ... L57: function ensureDir(dirPath) { L58: fs.mkdirSync(dirPath, { recursive: true }); L59: } ... L64: // Security review v5.7 follow-up: lstatSync first; SKIP symlinks entirely so L65: // a hostile symlink (e.g., ~/.claude/ralph-desk/foo -> /etc/passwd) cannot L66: // be chmod'd via unlockTree's chmodSync (which follows symlinks).

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = @ai-dev-methodologies/rlp-desk@0.24.0 matchedPath = scripts/postinstall.js matchedIdentity = npm:[redacted]:0.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @ai-dev-methodologies/rlp-desk@0.22.14 matchedIdentity = npm:[redacted]:0.22.14 similarity = 0.692 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

3L4: const fs = require("fs"); L5: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.jsView on unpkg · L3

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/node/reporting/campaign-reporting.mjsView file

•matchType = normalized_sha256 matchedPackage = @ai-dev-methodologies/rlp-desk@0.24.0 matchedPath = src/node/reporting/campaign-reporting.mjs matchedIdentity = npm:[redacted]:0.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/node/reporting/campaign-reporting.mjsView on unpkg

src/node/run.mjsView file

•matchType = normalized_sha256 matchedPackage = @ai-dev-methodologies/rlp-desk@0.24.0 matchedPath = src/node/run.mjs matchedIdentity = npm:[redacted]:0.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/node/run.mjsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-26json

1{

2 "name": "@ai-dev-methodologies/rlp-desk",

3 "version": "0.24.1",

4 "description": "Fresh-context iterative loops for Claude Code — autonomous task completion with independent verification",

5 "scripts": {

6 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L6

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L6

7 "uninstall": "node scripts/uninstall.js",

8 "manifest:check": "node scripts/build-node-manifest.js --check",

9 "prepublishOnly": "node scripts/build-node-manifest.js --check",

10 "test:node": "node --test 'tests/node/*.mjs' 'tests/node/*.test.mjs'",

11 "test:zsh": "for f in tests/test_*.sh; do echo \"=== $f ===\"; case \"$(head -1 \"$f\")\" in *zsh*) zsh \"$f\";; *) bash \"$f\";; esac || exit 1; done",

12 "test:fast": "npm run test:node",

13 "test:full": "npm run test:fast && npm run test:zsh",

14 "sv-gate:fast": "zsh tests/sv-gate-fast.sh",

15 "sv-gate:full": "zsh tests/sv-gate-full.sh"

16 },

17 "files": [

18 "src/commands/",

19 "src/node/",

20 "src/scripts/",

21 "!src/scripts/.run_src_verify.zsh",

22 "src/governance.md",

23 "src/model-upgrade-table.md",

24 "scripts/",

25 "docs/rlp-desk/*.md",

26 "docs/rlp-desk/blueprints/",

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2"use strict";

3

4const fs = require("fs");

5const path = require("path");

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/node/reporting/campaign-reporting.mjsView file

•matchType = normalized_sha256 matchedPackage = @ai-dev-methodologies/rlp-desk@0.24.0 matchedPath = src/node/reporting/campaign-reporting.mjs matchedIdentity = npm:[redacted]:0.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/node/reporting/campaign-reporting.mjsView on unpkg

src/node/run.mjsView file

•matchType = normalized_sha256 matchedPackage = @ai-dev-methodologies/rlp-desk@0.24.0 matchedPath = src/node/run.mjs matchedIdentity = npm:[redacted]:0.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/node/run.mjsView on unpkg