Loading npm security reports…

@hanzlaa/rcode: Suspicious npm security report (Warn) | LPM Firewall

registry / @hanzlaa/rcode / 4.18.0

@hanzlaa/rcode@4.18.0

rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A global npm installation automatically installs rcode tooling into the user's AI-agent home configuration. This is a first-party agent-extension lifecycle action, not a confirmed credential or payload attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation runs the postinstall lifecycle script.

Impact

The package can extend AI-agent behavior after a global package install without an interactive setup decision. No confirmed data theft, remote code loading, or destructive impact was found in the inspected code.

Mechanism

The postinstall script invokes the bundled installer without prompting; global installation writes rcode skills and can add a namespaced prompt-submit router hook for selected supported agents.

AI rationale

The package performs automatic, global AI-agent extension setup during npm postinstall, which warrants a warning under the lifecycle policy. The reviewed paths show package-owned, namespaced installation and no concrete malicious attack behavior.

Evidence

package.jsoncli/postinstall.jscli/install.jscli/lib/install-router.cjs

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Source & flagged code

27 flagged

package.jsonView file

Lines 1-33json

2 "name": "@hanzlaa/rcode",

3 "version": "4.18.0",

4 "description": "rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.",

5 "main": "cli/index.js",

6 "bin": {

7 "rcode": "dist/rcode.js"

8 },

9 "scripts": {

10 "dashboard": "node server/dashboard.js",

11 "test": "node --test",

12 "test:ci": "node --test --test-reporter=spec",

13 "postinstall": "node cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build:cli": "node scripts/build.cjs",

15 "build": "node scripts/build.cjs",

16 "prepack": "node scripts/prepack-strip.cjs && node scripts/build.cjs",

17 "postpack": "node scripts/postpack-restore.cjs",

18 "dogfood": "bash scripts/dogfood-check.sh",

19 "test:skills": "node test/skill-snapshot.test.cjs"

20 },

21 "files": [

22 "cli/",

23 "rcode/",

24 "server/",

25 "dist/",

26 "README.md",

27 "AGENTS.md",

28 "CLAUDE.md",

29 "CONTRIBUTING.md"

30 ],

31 "keywords": [

32 "rcode",

33 "claude-code",

•devDependencies registry_only=@clack/prompts,diff,esbuild,fast-glob,nanospinner,picocolors,semver,zod

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

dist/rcode.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* rcode — built with esbuild. Source: github.com/hanzlahabib/rihal-code */

3var y=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var pt=y((BI

rcode/bin/lib/memory-select.cjsView file

Lines 55-95javascript

55 stack.push(full);

56 } else if (entry.isFile() && entry.name.endsWith('.md')) {

57 results.push(full);

58 }

59 }

rcode/bin/lib/memory-digest.cjsView file

Lines 1-21javascript

1'use strict';

2/**

Low

Weak Crypto

Package source references weak cryptographic algorithms.

rcode/bin/lib/memory-digest.cjsView on unpkg · L1

3 * memory-digest.cjs — deterministic content-based digest for Memory Bank

4 * distillate freshness (#1065).

5 *

6 * memory-distill.md previously defined the freshness digest as

7 * sha1(path + ":" + mtime, sorted) — narrative only, no real implementation.

8 * Keying on mtime is unsound for a git-tracked repo: git clone/checkout/

cli/postinstall.jsView file

Lines 1-24javascript

1/**

2 * rcode postinstall hook — runs automatically after `npm install -g`

3 *

4 * Auto-installs commands, skills, workflows, and bin tools into the global

5 * Claude Code directory (~/.claude/) so every project can use rcode immediately

6 * without needing a per-project `rcode install` run.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/postinstall.jsView on unpkg · L4

7 *

8 * Artifacts (.planning/, STATE.md, ROADMAP.md) are always created in the

cli/index.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ────────────────────────────────────'); console.log(`▶ to run: paste the above into claude code as /${workflowname === 'execute-sprint' ? 'rcode-execute-sprint' : `rcode-${workflowname}`}`); console.log(' or pipe it directly: rcode ' + (workflowname === 'execute-sprint' ? 'execute' : workflowname) + ' | cld --model sonnet'); if (hasauto) { console.log('\n auto mode detected — in claude code run: /rcode-' + (workflowname === 'execute-sprint' ? 'execute-sprint' : workflowname) + ' --auto (applies yolo defaults, skips confirmation prompts)'); } }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = cli/index.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/index.jsView on unpkg

cli/uninstall.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. n(cwd, '.claude/commands')).length === 0) { fs.rmdirsync(path.join(cwd, '.claude/commands')); } if (fs.existssync(agentsdir) && fs.readdirsync(agentsdir).length === 0) { fs.rmdirsync(agentsdir); } } catch { } } if (editors.includes('cursor')) { const cursordir = path.join(cwd, '.cursor/rules'); const n = removematching(cursordir, (name) => name.startswith('rcode-') || name === 'rcode.mdc' || name === 'rcode-method.mdc' || name === 'rcode', ); removed += n; if (n > 0) console.log(` ✓ removed ${n} cursor rules`); } if (editors.includes('windsurf')) { const windsurfdir = path.join(cwd,

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/uninstall.jsView on unpkg

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView file

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

cli/doctor.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/doctor.js#virtual:normalized:round1View on unpkg

server/orchestrator.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = server/orchestrator.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/orchestrator.jsView on unpkg

rcode/bin/lib/brain.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/lib/brain.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/brain.cjsView on unpkg

server/dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = server/dashboard.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/dashboard.jsView on unpkg

cli/agent.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = cli/agent.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/agent.jsView on unpkg

rcode/bin/lib/memory-drift.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/lib/memory-drift.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/memory-drift.cjsView on unpkg

rcode/bin/lib/progress.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/lib/progress.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/progress.cjsView on unpkg

rcode/bin/rcode-hooks.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/rcode-hooks.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-hooks.cjsView on unpkg

rcode/bin/rcode-tools.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/rcode-tools.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-tools.cjsView on unpkg

cli/dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = cli/dashboard.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/dashboard.jsView on unpkg

Source & flagged code

27 flagged · loading source

package.jsonView file

•devDependencies registry_only=@clack/prompts,diff,esbuild,fast-glob,nanospinner,picocolors,semver,zod

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/rcode.jsView file

216`)){let s=n.replace(/#.*$/,"");if(!s.trim())continue;let i=s.match(/^(\s*)/)[1].length;if(i===0){let o=s.indexOf(":");if(o===-1)continue;let a=s.slice(0,o).trim(),c=s.slice(o+1).tr... L217: `)}uD.exports={readPackageManifest:ri,verifyInstall:N1,verifyClaudeInstall:aD,verifyRulesInstall:Cu,verifyAntigravityInstall:cD,formatReport:L1}});var pD=y((WP,hD)=>{var nt=require... L218: `)+`

High

Child Process

Package source references child process execution.

dist/rcode.jsView on unpkg · L216

3var y=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var pt=y((BI,Dl)=>{var Mv=require("crypto"),ht=require("fs"),En=require("path");function gl(t,e,r={}){let{encoding:n="... L4: `;gl(t,n,r)}function Hv(t,e){let r;try{r=ht.lstatSync(t)}catch(o){return o.code==="ENOENT"?{ok:!0,reason:"missing"}:{ok:!1,reason:`lstat: ${o.message}`}}if(r.isSymbolicLink())try{r... L5: `).reduce((r,n)=>r+=Math.max(1,Math.ceil(n.length/e)),0)}function e0(t="",e={}){let r=0,n=e.interval||50,s=e.stream||process.stderr,i=e.frames&&e.frames.length?e.frames:Gt.symbols.... L6: `,m.write(S,!0),Gt.isTTY&&(c=Qv(S,s.columns)),m},spin(){return m.render(),r=++r%i.length,m},update(S){return typeof S=="string"?t=S:(t=S.text||t,i=S.frames&&S.frames.length?S.frame... L7: `}`:"",!0),Gt.isTTY&&!k?m.write("\x1B[?25h")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/rcode.jsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = dist/rcode.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/rcode.jsView on unpkg

2/* rcode — built with esbuild. Source: github.com/hanzlahabib/rihal-code */ L3: var y=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var pt=y((BI,Dl)=>{var Mv=require("crypto"),ht=require("fs"),En=require("path");function gl(t,e,r={}){let{encoding:n="... L4: `;gl(t,n,r)}function Hv(t,e){let r;try{r=ht.lstatSync(t)}catch(o){return o.code==="ENOENT"?{ok:!0,reason:"missing"}:{ok:!1,reason:`lstat: ${o.message}`}}if(r.isSymbolicLink())try{r...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rcode.jsView on unpkg · L2

rcode/bin/lib/memory-select.cjsView file

75// `2>/dev/null` is POSIX shell syntax; on Windows, execSync's default shell L76: // (cmd.exe) doesn't understand it and the whole command fails, so these L77: // silently returned '' / [] on every Windows run (#1100). Suppressing

High

Shell

Package source references shell execution.

rcode/bin/lib/memory-select.cjsView on unpkg · L75

rcode/bin/lib/memory-digest.cjsView file

1'use strict'; L2: /**

Low

Weak Crypto

Package source references weak cryptographic algorithms.

rcode/bin/lib/memory-digest.cjsView on unpkg · L1

cli/postinstall.jsView file

4* Auto-installs commands, skills, workflows, and bin tools into the global L5: * Claude Code directory (~/.claude/) so every project can use rcode immediately L6: * without needing a per-project `rcode install` run. ... L61: // #924 — opt-out for users who install the package globally but do NOT want L62: // their ~/.claude mutated (e.g. inspecting the package, or managing the global L63: // install themselves). Setting RCODE_NO_POSTINSTALL=1 (or the npm-config ... L80: L81: const globalTarget = path.join(os.homedir(), '.claude'); L82: ... L109: }; L110: fs.mkdirSync(globalTarget, { recursive: true }); L111: fs.writeFileSync(receiptPath, JSON.stringify(receipt, null, 2) + '\n');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/postinstall.jsView on unpkg · L4

32Cross-file remote execution chain: cli/postinstall.js spawns dist/rcode.js; helper contains network access plus dynamic code execution. L32: * Pure function — takes its inputs explicitly so tests can drive every L33: * branch without needing to mutate process.env / __dirname / process.cwd. L34: * ... L67: if (require.main === module) { L68: if (process.env.CI || process.env.NODE_ENV === 'test') { L69: process.exit(0); ... L71: if (process.env.RCODE_NO_POSTINSTALL === '1' || process.env.npm[redacted]) { L72: process.stderr.write('\nrcode: skipping global auto-install (RCODE_NO_POSTINSTALL set).\n'); L73: process.stderr.write(" Run 'rcode install --global' when you want /rcode-* commands.\n\n"); ... L86: // devDependencies (picocolors, semver, etc.) are not installed for global package

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli/postinstall.jsView on unpkg · L32

cli/index.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/index.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/index.jsView on unpkg

cli/uninstall.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/uninstall.jsView on unpkg

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView file

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

cli/doctor.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/doctor.js#virtual:normalized:round1View on unpkg

server/orchestrator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/orchestrator.jsView on unpkg

rcode/bin/lib/brain.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/brain.cjsView on unpkg

server/dashboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/dashboard.jsView on unpkg

cli/agent.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/agent.jsView on unpkg

rcode/bin/lib/memory-drift.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/memory-drift.cjsView on unpkg

rcode/bin/lib/progress.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/progress.cjsView on unpkg

rcode/bin/rcode-hooks.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-hooks.cjsView on unpkg

rcode/bin/rcode-tools.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-tools.cjsView on unpkg

cli/dashboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/dashboard.jsView on unpkg

Source & flagged code

27 flagged

package.jsonView file

Lines 1-33json

2 "name": "@hanzlaa/rcode",

3 "version": "4.18.0",

4 "description": "rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.",

5 "main": "cli/index.js",

6 "bin": {

7 "rcode": "dist/rcode.js"

8 },

9 "scripts": {

10 "dashboard": "node server/dashboard.js",

11 "test": "node --test",

12 "test:ci": "node --test --test-reporter=spec",

13 "postinstall": "node cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build:cli": "node scripts/build.cjs",

15 "build": "node scripts/build.cjs",

16 "prepack": "node scripts/prepack-strip.cjs && node scripts/build.cjs",

17 "postpack": "node scripts/postpack-restore.cjs",

18 "dogfood": "bash scripts/dogfood-check.sh",

19 "test:skills": "node test/skill-snapshot.test.cjs"

20 },

21 "files": [

22 "cli/",

23 "rcode/",

24 "server/",

25 "dist/",

26 "README.md",

27 "AGENTS.md",

28 "CLAUDE.md",

29 "CONTRIBUTING.md"

30 ],

31 "keywords": [

32 "rcode",

33 "claude-code",

•devDependencies registry_only=@clack/prompts,diff,esbuild,fast-glob,nanospinner,picocolors,semver,zod

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

dist/rcode.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* rcode — built with esbuild. Source: github.com/hanzlahabib/rihal-code */

3var y=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var pt=y((BI

rcode/bin/lib/memory-select.cjsView file

Lines 55-95javascript

55 stack.push(full);

56 } else if (entry.isFile() && entry.name.endsWith('.md')) {

57 results.push(full);

58 }

59 }

rcode/bin/lib/memory-digest.cjsView file

Lines 1-21javascript

1'use strict';

2/**

Low

Weak Crypto

Package source references weak cryptographic algorithms.

rcode/bin/lib/memory-digest.cjsView on unpkg · L1

3 * memory-digest.cjs — deterministic content-based digest for Memory Bank

4 * distillate freshness (#1065).

5 *

6 * memory-distill.md previously defined the freshness digest as

7 * sha1(path + ":" + mtime, sorted) — narrative only, no real implementation.

8 * Keying on mtime is unsound for a git-tracked repo: git clone/checkout/

cli/postinstall.jsView file

Lines 1-24javascript

1/**

2 * rcode postinstall hook — runs automatically after `npm install -g`

3 *

4 * Auto-installs commands, skills, workflows, and bin tools into the global

5 * Claude Code directory (~/.claude/) so every project can use rcode immediately

6 * without needing a per-project `rcode install` run.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/postinstall.jsView on unpkg · L4

7 *

8 * Artifacts (.planning/, STATE.md, ROADMAP.md) are always created in the

cli/index.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/index.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/index.jsView on unpkg

cli/uninstall.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/uninstall.jsView on unpkg

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView file

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

cli/doctor.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/doctor.js#virtual:normalized:round1View on unpkg

server/orchestrator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/orchestrator.jsView on unpkg

rcode/bin/lib/brain.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/brain.cjsView on unpkg

server/dashboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/dashboard.jsView on unpkg

cli/agent.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/agent.jsView on unpkg

rcode/bin/lib/memory-drift.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/memory-drift.cjsView on unpkg

rcode/bin/lib/progress.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/progress.cjsView on unpkg

rcode/bin/rcode-hooks.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-hooks.cjsView on unpkg

rcode/bin/rcode-tools.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-tools.cjsView on unpkg

cli/dashboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/dashboard.jsView on unpkg

Lines 196-236javascript

196`;return jt(t,i+a+n),{action:"appended"}}catch(i){return{action:"skipped-error",error:i.message}}}function R1(t,e){let r={},n=new Set(e||[]),s=i=>[`## ${i}`,"","This project has [rcode](https://www.npmjs.com/package/@hanzlaa/rcode) installed \u2014","persistent project memory, specialist agents, and structured workflows under `.rcode/`.","","For any non-trivial task (new feature, bug fix that needs investigation, multi-file","change, planning) prefer routing through **`/rcode-do <task description>`** \u2014 rcode's","command picker \u2014 instead of working ad hoc. It picks the right rcode com ...

197`);if(n.has("claude")||n.has("vscode")){let i="",o="",a=`${i}

198

199${s("Working with rcode")}

200

201${o}

202`;r.claude=Eu(rt.join(t,"CLAUDE.md"),i,o,a)}if(n.has("codex")){let i="",o="",a=`${i}

203

204${s("Working with rcode")}

205

206${o}

207`;r.codex=Eu(rt.join(t,"AGENTS.md"),i,o,a)}if(n.has("cursor")){let i=["---","description: Prefer rcode's /rcode-do command for non-trivial work","alwaysApply: true","---","",s("Working with rcode"),""

208`);try{let o=rt.join(t,".cursor","rules","rcode-prefer-do.mdc");Le.mkdirSync(rt.dirname(o),{recursive:!0}),jt(o,i),r.cursor={action:"written"}}catch(o){r.cursor={action:"skipped-error",error:o.message}}}

209`);try{let o=rt.join(t,".windsurf","rules","rcode-prefer-do.mdc");Le.mkdirSync(rt.dirname(o),{recursive:!0}),jt(o,i),r.windsurf={action:"written"}}catch(o){r.windsurf={action:"skipped-error",error:o.message}}}

210`),o=rt.join(r,"hooks"),a=rt.join(o,"pre-commit");try{let l=function(d,f){let p=d.indexOf(n);if(p<0)return null;let h=d.indexOf(s,p);if(h<0){let v=p;return v>0&&d[v-1]===`

211`&&(v-=1),d.slice(0,v)+f}let D=p;D>0&&d[D-1]===`

212`&&(D-=1);let m=h+s.length;return d[m]===`

213`&&(m+=1),d.slice(0,D)+f+d.slice(m)};var c=l;if(Le.mkdirSync(o,{recursive:!0}),!Le.existsSync(a))return jt(a,`#!/bin/sh

214${i}`,{mode:493}),{action:"created"};let u=Le.readFileSync(a,"utf8");if(u.includes(n)){let d=l(u,i);return d!==null&&d!==u?(jt(a,d,{mode:493}),{action:"updated"}):{action:"already-present"}}return jt(a,u+i,{mode:493}),{action:"appended"}}catch(u){return{action:"skipped-error",error:u.message}}}tD.exports={resolveCommitPlanning:$1,resolveEnableHooks:A1,ensureRcodeSettingsHooks:F1,ensureRcodeGitignore:j1,spliceMarkedBlockIntoFile:Eu,ensureRcodePreferredCommandRule:R1,ensureRcodePreCommitHook:I1}});var oD=y((qP,sD)=>{var{z:Be}=Co(),nD=Be.object({user_name:Be.string().min(1),project_name:Be.string ...

215`)}function P1(t){let e=nD.safeParse(t);return e.success?{valid:!0}:{valid:!1,errors:e.error.issues.map(n=>` ${n.path.

216`)){let s=n.replace(/#.*$/,"");if(!s.trim())continue;let i=s.match(/^(\s*)/)[1].length;if(i===0){let o=

217`)}uD.exports={readPackageManifest:ri,verifyInstall:N1,verifyClaudeInstall:aD,verifyRulesInstall:Cu,verifyAntigravityInstall:cD,formatReport:L1}});var pD=y((WP,hD)=>{var nt=require("fs"),_t=require("path"),B1=Wr(),{homedir:lD}=mt(),{ok:q1,fail:dD,dim:wu,bold:M1,PACKAGE_ROOT:fD}=hn();function W1(t,e){let{spawnSync:r}=require("child_process"),n=[];for(let u of e){let l=u.rel||u.dest;if(!l)continue;let d=_t.join(t,l);nt.existsSync(d)&&n.push(l)}for(let u of[".rcode/config.yaml",".rcode/state.json",".rcode/_config/manifest.yaml",".rcode/_config/files-manifest.csv"])nt.existsSync(_t.join(t,u))&&n.p ...

218`)+`

High

Child Process

Package source references child process execution.

dist/rcode.jsView on unpkg · L216

219`,encoding:"utf8"});return c.status!==0?{ok:!1,warning:`tar failed: ${(c.stderr||"").trim().split(`

220`)[0]}`,fileCount:n.length}:{ok:!0,path:a,fileCount:n.length}}function H1(t){let e=_t.join(t,"package.json"),r=_t.join(t,"pnpm-lock.yaml");

221`),console.log(" "+ni(`${n}: wired slash-router into ${e} hook (existing hooks preserved).`)),!0)}function DD(t){let e=vs(),r=Te.join(e,".codex","skills");Hn(r);let n=Te.join(gD,"skills");if(!Or.existsSync(n))return 0;let s=0;for(let i of mD(n)){if(Te.basename(i)!=="SKILL.md")continue;let o=Te.dirname(i),a=Te.basename(o),c=a.startsWith("rcode-")?a:`rcode-${a}`,u=Te.join(r,c);Hn(u);for(let l of mD(o)){let d=Te.relative(o,l),f=Te.join(u,d);Hn(Te.dirname(f)),Or.copyFileSync(l,f)}s++}return t&&t.global!=="silent"&&console.log(" "+ni(`Codex skills: ${s} \u2192 ~/.codex/skills/rcode-*/`)),s}functi ...

222`))}function AD(){console.log(`

223rcode installer

224

225Usage:

226 node cli/install.js [target-dir]

227

228Options:

229 --force overwrite existing files without prompting

230 --reset with --force, also delete config.yaml and state.json to re-init

231 --yes non-interactive, accept defaults

232 --user <name> set user_name in config.yaml (default: $USER)

233 --project <name> set project_name (default: basename of target-dir)

234 --language <lang> set communication_language (default: English)

235 --mode <guided|yolo> default mode (default: guided)

236 --ide <name> target IDE (claude, cursor, gemini; default: claude)

Long lines were clipped for display.

@hanzlaa/rcode@4.18.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code