Loading npm security reports…

@hanzlaa/rcode@4.10.5: AI-agent control-surface risk | LPM Firewall

registry / @hanzlaa/rcode / 4.10.5

@hanzlaa/rcode@4.10.5

rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically mutates the shared Claude Code control surface. It installs package-supplied agent instructions and slash commands for every project, without an interactive consent step.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g @hanzlaa/rcode

Impact

Package-controlled prompts and agents become available across the user's Claude Code projects.

Mechanism

postinstall-spawned global AI-agent configuration write

Policy narrative

The postinstall hook automatically detects a global installation, invokes the bundled CLI with non-interactive approval flags, and writes rcode tooling into ~/.claude. This is a foreign, broad AI-agent control surface that affects every Claude Code project. The installer also contains global-mode wiring for a ~/.codex UserPromptSubmit hook when the Codex IDE target is selected.

Rationale

Source confirms an unconsented install-time mutation of a broad, foreign AI-agent control surface. Per policy, this is a publish-block condition despite the absence of credential exfiltration.

Evidence

package.jsoncli/postinstall.jscli/install.jscli/lib/homedir.cjs~/.claude/~/.claude/.rcode-install-receipt~/.codex/hooks.json~/.rcode/slash-commands/~/.rcode/bin/rcode-slash-router.cjs

Decision evidence

Source & flagged code

19 flagged · loading source

package.jsonView file

•devDependencies registry_only=@clack/prompts,diff,esbuild,fast-glob,nanospinner,picocolors,semver,zod

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/rcode.jsView file

117`),f(),n()};return{start:D,stop:h,message:(w="")=>{o=m(w??o)}}},Dk=async(t,e)=>{let r={},n=Object.keys(t);for(let s of n){let i=t[s],o=await i({results:r})?.catch(a=>{throw a});if(... L118: `)}lg.exports={readPackageManifest:To,verifyInstall:vk,verifyClaudeInstall:ug,verifyRulesInstall:Uu,verifyAntigravityInstall:cg,formatReport:_k}});var is=v((NI,ct)=>{var y=require(... L119: `)+`

High

Child Process

Package source references child process execution.

dist/rcode.jsView on unpkg · L117

3var v=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Jt=v((WF,Pc)=>{var my=require("crypto"),ot=require("fs"),fn=require("path");function Rc(t,e,r={}){let{encoding:n="... L4: `;Rc(t,n,r)}function Dy(t,e){let r;try{r=ot.lstatSync(t)}catch(o){return o.code==="ENOENT"?{ok:!0,reason:"missing"}:{ok:!1,reason:`lstat: ${o.message}`}}if(r.isSymbolicLink())try{r... L5: `).reduce((r,n)=>r+=Math.max(1,Math.ceil(n.length/e)),0)}function ky(t="",e={}){let r=0,n=e.interval||50,s=e.stream||process.stderr,i=e.frames&&e.frames.length?e.frames:Lt.symbols.... L6: `,h.write(C,!0),Lt.isTTY&&(u=$y(C,s.columns)),h},spin(){return h.render(),r=++r%i.length,h},update(C){return typeof C=="string"?t=C:(t=C.text||t,i=C.frames&&C.frames.length?C.frame... L7: `}`:"",!0),Lt.isTTY&&!A?h.write("\x1B[?25h")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/rcode.jsView on unpkg · L3

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: w starter / advanced / ultra / standards tier map doctor run compliance check on skills set-profile change model profile (quality | balanced | budget | inherit) set-mode toggle communication mode (guided | yolo) version print version help show this help getting started: cd my-project rcode install # set up agents + slash commands rcode tiers # see the golden path rcode set-profile # choose model profile (quality | balanced | budget) documentation: https: `.trim())}function fc(t,e,r){yc()(["show",t,...e],r);let n=e.includes("--auto")||e.includes("--run");console.log(` \u2500\u2500\u2500\u2500\u2500\u2500

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/rcode.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.8.0 matchedPath = dist/rcode.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/rcode.jsView on unpkg

2/* rcode — built with esbuild. Source: github.com/hanzlahabib/rihal-code */ L3: var v=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Jt=v((WF,Pc)=>{var my=require("crypto"),ot=require("fs"),fn=require("path");function Rc(t,e,r={}){let{encoding:n="... L4: `;Rc(t,n,r)}function Dy(t,e){let r;try{r=ot.lstatSync(t)}catch(o){return o.code==="ENOENT"?{ok:!0,reason:"missing"}:{ok:!1,reason:`lstat: ${o.message}`}}if(r.isSymbolicLink())try{r...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rcode.jsView on unpkg · L2

rcode/bin/lib/brain.cjsView file

212const BRAIN_ALLOWED_ORGS = new Set(['hanzlahabib', 'rcode-om']); L213: if (process.env.RCODE_BRAIN_ALLOW_UNVERIFIED !== '1') { L214: let host = '', org = ''; ... L240: // after this change. Cache TTL is configurable per source (defaults to 6h). L241: const { execSync, execFileSync: execFileSyncBrain } = require('child_process'); L242: const crypto = require('crypto'); ... L270: .slice(0, 16); L271: const cacheRoot = path.join(os.homedir(), '.rcode', 'brain-cache'); L272: const cacheDir = path.join(cacheRoot, cacheKey); ... L292: if (!fs.existsSync(cacheManifest)) return null; L293: try { return JSON.parse(fs.readFileSync(cacheManifest, 'utf8')); } L294: catch { return null; }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

rcode/bin/lib/brain.cjsView on unpkg · L212

server/dashboard.jsView file

22L23: const http = require('http'); L24: const path = require('path'); ... L27: const crypto = require('crypto'); L28: const { spawn } = require('child_process'); L29: ... L37: // ---------- Configuration ---------- L38: const PORT = parseInt(process.env.PORT || '7717', 10); L39: // #969 — the orchestrator's actual port, injected into the client so it never

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/dashboard.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.8.0 matchedPath = server/dashboard.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/dashboard.jsView on unpkg

cli/postinstall.jsView file

4* Auto-installs commands, skills, workflows, and bin tools into the global L5: * Claude Code directory (~/.claude/) so every project can use rcode immediately L6: * without needing a per-project `rcode install` run. ... L61: // #924 — opt-out for users who install the package globally but do NOT want L62: // their ~/.claude mutated (e.g. inspecting the package, or managing the global L63: // install themselves). Setting RCODE_NO_POSTINSTALL=1 (or the npm-config ... L80: L81: const globalTarget = path.join(os.homedir(), '.claude'); L82: ... L109: }; L110: fs.mkdirSync(globalTarget, { recursive: true }); L111: fs.writeFileSync(receiptPath, JSON.stringify(receipt, null, 2) + '\n');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/postinstall.jsView on unpkg · L4

32Cross-file remote execution chain: cli/postinstall.js spawns dist/rcode.js; helper contains network access plus dynamic code execution. L32: * Pure function — takes its inputs explicitly so tests can drive every L33: * branch without needing to mutate process.env / __dirname / process.cwd. L34: * ... L67: if (require.main === module) { L68: if (process.env.CI || process.env.NODE_ENV === 'test') { L69: process.exit(0); ... L71: if (process.env.RCODE_NO_POSTINSTALL === '1' || process.env.npm[redacted]) { L72: process.stderr.write('\nrcode: skipping global auto-install (RCODE_NO_POSTINSTALL set).\n'); L73: process.stderr.write(" Run 'rcode install --global' when you want /rcode-* commands.\n\n"); ... L86: // devDependencies (picocolors, semver, etc.) are not installed for global package

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli/postinstall.jsView on unpkg · L32

cli/update.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function detectinstallededitors(cwd) { const editors = []; const homeskills = path.join(homedir(), '.claude/skills'); const projectclaude = ( (fs.existssync(path.join(cwd, '.claude/skills')) && fs.readdirsync(path.join(cwd, '.claude/skills')).some(n => n.startswith('rcode-'))) || (fs.existssync(path.joi

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/update.jsView on unpkg

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView file

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

server/orchestrator.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.8.0 matchedPath = server/orchestrator.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/orchestrator.jsView on unpkg

cli/install.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.8.0 matchedPath = cli/install.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/install.jsView on unpkg

Source & flagged code

19 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@hanzlaa/rcode",

3 "version": "4.10.5",

4 "description": "rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.",

5 "main": "cli/index.js",

6 "bin": {

7 "rcode": "dist/rcode.js"

8 },

9 "scripts": {

10 "dashboard": "node server/dashboard.js",

11 "test": "node --test",

12 "test:ci": "node --test --test-reporter=spec",

13 "postinstall": "node cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build:cli": "node scripts/build.cjs",

15 "build": "node scripts/build.cjs",

16 "prepack": "node scripts/prepack-strip.cjs && node scripts/build.cjs",

17 "postpack": "node scripts/postpack-restore.cjs",

18 "dogfood": "bash scripts/dogfood-check.sh",

19 "test:skills": "node test/skill-snapshot.test.cjs"

20 },

21 "files": [

22 "cli/",

23 "rcode/",

24 "server/",

25 "dist/",

26 "README.md",

27 "AGENTS.md",

28 "CLAUDE.md",

29 "CONTRIBUTING.md"

30 ],

31 "keywords": [

32 "rcode",

33 "claude-code",

•devDependencies registry_only=@clack/prompts,diff,esbuild,fast-glob,nanospinner,picocolors,semver,zod

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

dist/rcode.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* rcode — built with esbuild. Source: github.com/hanzlahabib/rihal-code */

3var v=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Jt=v((WF

rcode/bin/lib/brain.cjsView file

Lines 192-232javascript

192 const out = path.join(destPath, rel);

193 fs.mkdirSync(path.dirname(out), { recursive: true });

194 fs.copyFileSync(full, out);

195 copied++;

server/dashboard.jsView file

Lines 2-42javascript

2/**

3 * Majlis — rcode Dashboard Server

4 *

5 * View-only Node server that scans .rcode/ directory and renders

6 * a live HTML dashboard showing project state, phases, progress,

7 * decisions, and artifacts.

8 *

9 * VIEW-ONLY by design. No CRUD. No database. Source of truth is files.

10 *

11 * Architecture:

12 * server/dashboard.js - HTTP server + routing (this file)

cli/postinstall.jsView file

Lines 1-24javascript

1/**

2 * rcode postinstall hook — runs automatically after `npm install -g`

3 *

4 * Auto-installs commands, skills, workflows, and bin tools into the global

5 * Claude Code directory (~/.claude/) so every project can use rcode immediately

6 * without needing a per-project `rcode install` run.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/postinstall.jsView on unpkg · L4

7 *

8 * Artifacts (.planning/, STATE.md, ROADMAP.md) are always created in the

cli/update.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function detectinstallededitors(cwd) { const editors = []; const homeskills = path.join(homedir(), '.claude/skills'); const projectclaude = ( (fs.existssync(path.join(cwd, '.claude/skills')) && fs.readdirsync(path.join(cwd, '.claude/skills')).some(n => n.startswith('rcode-'))) || (fs.existssync(path.joi

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/update.jsView on unpkg

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView file

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

server/orchestrator.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.8.0 matchedPath = server/orchestrator.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/orchestrator.jsView on unpkg

cli/install.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.8.0 matchedPath = cli/install.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/install.jsView on unpkg

Lines 97-137javascript

97${t}

98`.split(`

99`),n=Lu.stripVTControlCharacters(e).length,s=Math.max(r.reduce((o,a)=>{let u=Lu.stripVTControlCharacters(a);return u.length>o?u.length:o},0),n)+2,i=r.map(o=>`${_.gray(te)} ${_.dim(o)}${" ".repeat(s-Lu.stripVTControlCharacters(o).length)}${_.gray(te)}`).join(`

100`);process.stdout.write(`${_.gray(te)}

101${_.green(jo)} ${_.reset(e)} ${_.gray(tg.repeat(Math.max(s-n-1,1))+Q$)}

102${i}

103${_.gray(ek+tg.repeat(s+2)+tk)}

104`)},pk=(t="")=>{process.stdout.write(`${_.gray(rt)} ${_.red(t)}

105

106`)},mk=(t="")=>{process.stdout.write(`${_.gray(J$)} ${t}

107`)},gk=(t="")=>{process.stdout.write(`${_.gray(te)}

108${_.gray(rt)} ${t}

109

110`)},rn={message:(t="",{symbol:e=_.gray(te)}={})=>{let r=[`${_.gray(te)}`];if(t){let[n,...s]=t.split(`

111`);r.push(`${e} ${n}`,...s.map(i=>`${_.gray(te)} ${i}`))}process.stdout.write(`${r.join(`

112`)}

113`)},info:t=>{rn.message(t,{symbol:_.blue(rk)})},success:t=>{rn.message(t,{symbol:_.green(nk)})},step:t=>{rn.message(t,{symbol:_.green(jo)})},warn:t=>{rn.message(t,{symbol:_.yellow(sk)})},warning:t=>{rn.warn(t)},error:t=>{rn.message(t,{symbol:_.red(ok)})}},ig=()=>{let t=Bu?["\u25D2","\u25D0","\u25D3","\u25D1"]:["\u2022","o","O","0"],e=Bu?80:120,r=process.env.CI==="true",n,s,i=!1,o="",a,u=w=>{let C=w>1?"Something went wrong":"Canceled";i&&h(C,w)},c=()=>u(2),l=()=>u(1),d=()=>{process.on("uncaughtExceptionMonitor",c),process.on("unhandledRejection",c),process.on("SIGINT",l),process.on("SIGTERM",l) ...

114`);let w=a.split(`

115`);process.stdout.write(eg.cursor.move(-999,w.length-1)),process.stdout.write(eg.erase.down(w.length))},m=w=>w.replace(/\.+$/,""),D=

116`);let C=0,A=0;d(),s=setInterval(()=>{if(r&&o===a)return;g(),a=o;let T=_.

117`),f(),n()};return{start:D,stop:h,message:(w="")=>{o=m(w??o)}}},Dk=async(t,e)=>{let r={},n

118`)}lg.exports={readPackageManifest:To,verifyInstall:vk,verifyClaudeInstall:ug,verifyRulesInstall:Uu,verifyAntigravityInstall:cg,formatReport:_k}});var is=v((NI,ct)=>{var y=require("fs"),p=require("path"),Ek=require("crypto"),bk=require("os"),{writeFileAtomic:It,safeRmSync:zu}=Jt(),{homedir:Ye}=lr(),X=Pn(),{createSpinner:Sk}=Hc(),Ck=Of(),{z:Ie}=Ga(),Fn=zp(),{createTwoFilesPatch:dg}=Im(),nt=Zu(),or=t=>X.green("\u2713")+" "+t,fg=t=>X.red("\u2717")+" "+t,_t=t=>X.yellow("\u26A0")+" "+t,Ro=t=>X.cyan("\u2192")+" "+t,Y=t=>X.dim(t),Ft=t=>X.bold(t),Et=p.resolve(__dirname,".."),$e=p.join(Et,"rcode"),os=O ...

119`)+`

High

Child Process

Package source references child process execution.

dist/rcode.jsView on unpkg · L117

120`,encoding:"utf8"});return u.status!==0?{ok:!1,warning:`tar failed: ${(u.stderr||"").trim().split(`

121`)[0]}`,fileCount:n.length}:{ok:!0,path:a,fileCount:n.length}}function kk(t){let e=t||We(),r=["",X.cyan(

122`))}function hg(t){let e={claude:!1,cursor:!1,gemini:!1,vscode:!1,antigravity:!1,windsurf:!1,codex:!1};y.existsSync(p.join(t,".claude"))&&(e.claude=!0),y.existsSync(p.join(t,".cursor"))&&(e.cursor=!0),y.existsSync(p.join(t,".gemini"))&&(e.gemini=!0),y.existsSync(p.join(t,".vscode"))&&(e.vscode=!0),y.existsSync(p.join(t,".antigravity"))&&(e.antigravity=!0),y.existsSync(p.join(t,".windsurf"))&&(e.windsurf=!0);let r=Ye();return y.existsSync(p.join(r,".claude"))&&(e.claude=!0),y.existsSync(p.join(r,".cursor"))&&(e.cursor=!0),y.existsSync(p.join(r,".config","Cursor"))&&(e.cursor=!0),y.existsSync(p. ...

123rcode installer

124

125Usage:

126 node cli/install.js [target-dir]

127

128Options:

129 --force overwrite existing files without prompting

130 --reset with --force, also delete config.yaml and state.json to re-init

131 --yes non-interactive, accept defaults

132 --user <name> set user_name in config.yaml (default: $USER)

133 --project <name> set project_name (default: basename of target-dir)

134 --language <lang> set communication_language (default: English)

135 --mode <guided|yolo> default mode (default: guided)

136 --ide <name> target IDE (claude, cursor, gemini; default: claude)

137 --dry-run preview what would be written; exit without writing any files

Long lines were clipped for display.