registry / @c-d-cc/reap / 0.17.4

@c-d-cc/reap@0.17.4

Recursive Evolutionary Autonomous Pipeline — AI and humans evolve software across generations

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently mutates the global Claude Code control surface and establishes SessionStart command hooks. It can also trigger a global package update.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

Future Claude Code sessions execute reap commands; global package state is modified.

Mechanism

unconsented global AI-agent hook registration and auto-update

Policy narrative

Installation invokes a suppressed CLI command that writes REAP content into global Claude Code directories and adds SessionStart hooks executing `reap check-version` and `reap load-context`. The subsequent postinstall command may run an unprompted global npm update. These effects occur without an explicit user command and persist into future agent sessions.

Rationale

Source confirms unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. This meets the blocking policy regardless of the package's stated workflow purpose.

Evidence

package.jsonscripts/postinstall.shdist/cli/index.js~/.claude/commands/reap.*.md~/.claude/agents/reap-*.md~/.claude/settings.json~/.reap/reap-guide.md

Network endpoints1

127.0.0.1:17224

@c-d-cc/reap@0.17.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code