@hanzlaa/rcode@4.16.2: Suspicious npm security report (Warn)

Loading npm security reports…

@hanzlaa/rcode@4.16.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

27 flagged

Lines 1-33json

2 "name": "@hanzlaa/rcode",

3 "version": "4.16.2",

4 "description": "rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.",

5 "main": "cli/index.js",

6 "bin": {

7 "rcode": "dist/rcode.js"

8 },

9 "scripts": {

10 "dashboard": "node server/dashboard.js",

11 "test": "node --test",

12 "test:ci": "node --test --test-reporter=spec",

13 "postinstall": "node cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build:cli": "node scripts/build.cjs",

15 "build": "node scripts/build.cjs",

16 "prepack": "node scripts/prepack-strip.cjs && node scripts/build.cjs",

17 "postpack": "node scripts/postpack-restore.cjs",

18 "dogfood": "bash scripts/dogfood-check.sh",

19 "test:skills": "node test/skill-snapshot.test.cjs"

20 },

21 "files": [

22 "cli/",

23 "rcode/",

24 "server/",

25 "dist/",

26 "README.md",

27 "AGENTS.md",

28 "CLAUDE.md",

29 "CONTRIBUTING.md"

30 ],

31 "keywords": [

32 "rcode",

33 "claude-code",

•devDependencies registry_only=@clack/prompts,diff,esbuild,fast-glob,nanospinner,picocolors,semver,zod

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

dist/rcode.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* rcode — built with esbuild. Source: github.com/hanzlahabib/rihal-code */

3var v=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var sr=v((ij

rcode/bin/lib/memory-digest.cjsView file

Lines 1-21javascript

1'use strict';

2/**

Low

Weak Crypto

Package source references weak cryptographic algorithms.

rcode/bin/lib/memory-digest.cjsView on unpkg · L1

3 * memory-digest.cjs — deterministic content-based digest for Memory Bank

4 * distillate freshness (#1065).

5 *

6 * memory-distill.md previously defined the freshness digest as

7 * sha1(path + ":" + mtime, sorted) — narrative only, no real implementation.

8 * Keying on mtime is unsound for a git-tracked repo: git clone/checkout/

server/orchestrator.js#virtual:normalized:round1View file

35const fs = require("fs"); L36: const { execFile } = require("child_process"); L37: ... L45: L46: let WebSocketServer = null; L47: try { ({ WebSocketServer } = require("ws")); } catch { /* handled at boot */ } L48: L49: // #1037 — ORCH_PORT is only the STARTING point for this process"s own\n// free-port scan (see the listen/retry block near the bottom), not a fixed\n// bind target. `let` because a... L50: const PROJECT_ROOT = process.env.PROJECT_ROOT

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/orchestrator.js#virtual:normalized:round1View on unpkg · L35

cli/postinstall.jsView file

Lines 1-24javascript

1/**

2 * rcode postinstall hook — runs automatically after `npm install -g`

3 *

4 * Auto-installs commands, skills, workflows, and bin tools into the global

5 * Claude Code directory (~/.claude/) so every project can use rcode immediately

6 * without needing a per-project `rcode install` run.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/postinstall.jsView on unpkg · L4

7 *

8 * Artifacts (.planning/, STATE.md, ROADMAP.md) are always created in the

cli/index.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ────────────────────────────────────'); console.log(`▶ to run: paste the above into claude code as /${workflowname === 'execute-sprint' ? 'rcode-execute-sprint' : `rcode-${workflowname}`}`); console.log(' or pipe it directly: rcode ' + (workflowname === 'execute-sprint' ? 'execute' : workflowname) + ' | cld --model sonnet'); if (hasauto) { console.log('\n auto mode detected — in claude code run: /rcode-' + (workflowname === 'execute-sprint' ? 'execute-sprint' : workflowname) + ' --auto (applies yolo defaults, skips confirmation prompts)'); } }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = cli/index.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/index.jsView on unpkg

cli/install.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. group?.hooks) && group.hooks.some(h => typeof h?.command === 'string' && h.command.includes('rcode-slash-router.cjs')), ); if (already) { console.log(' ' + ok(`${label}: slash-router hook already present (idempotent).`)); return false; } root.hooks[eventkey].push({ hooks: [{ type: 'command', command, timeout: 10 }] }); ensuredir(path.dirname(jsonpath)); fs.writefilesync(jsonpath, json.stringify(root, null, 2) + '\n'); console.log(' ' + ok(`${label}: wired slash-router into ${eventkey} hook (existing hooks preserved).`)); return true; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/install.jsView on unpkg

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView file

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

cli/doctor.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/doctor.js#virtual:normalized:round1View on unpkg

rcode/bin/lib/brain.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/lib/brain.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/brain.cjsView on unpkg

server/dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = server/dashboard.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/dashboard.jsView on unpkg

cli/agent.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = cli/agent.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/agent.jsView on unpkg

rcode/bin/lib/memory-drift.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/lib/memory-drift.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/memory-drift.cjsView on unpkg

rcode/bin/lib/progress.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/lib/progress.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/progress.cjsView on unpkg

rcode/bin/rcode-hooks.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/rcode-hooks.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-hooks.cjsView on unpkg

rcode/bin/rcode-tools.cjsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = rcode/bin/rcode-tools.cjs matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-tools.cjsView on unpkg

cli/dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = cli/dashboard.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/dashboard.jsView on unpkg

cli/github-sync.jsView file

•matchType = normalized_sha256 matchedPackage = @hanzlaa/rcode@4.17.0 matchedPath = cli/github-sync.js matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/github-sync.jsView on unpkg

Source & flagged code

27 flagged · loading source

package.jsonView file

•devDependencies registry_only=@clack/prompts,diff,esbuild,fast-glob,nanospinner,picocolors,semver,zod

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/rcode.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @hanzlaa/rcode@4.15.2 matchedIdentity = npm:QGhhbnpsYWEvcmNvZGU:4.15.2 similarity = 0.868 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/rcode.jsView on unpkg

117`),f(),n()};return{start:y,stop:p,message:(S="")=>{o=m(S??o)}}},A$=async(t,e)=>{let r={},n=Object.keys(t);for(let s of n){let i=t[s],o=await i({results:r})?.catch(a=>{throw a});if(... L118: `)}gg.exports={readPackageManifest:Lo,verifyInstall:j$,verifyClaudeInstall:pg,verifyRulesInstall:Xc,verifyAntigravityInstall:mg,formatReport:I$}});var ls=v((tT,vt)=>{var D=require(... L119: `)+`

High

Child Process

Package source references child process execution.

dist/rcode.jsView on unpkg · L117

3var v=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var sr=v((ij,qu)=>{var ky=require("crypto"),ht=require("fs"),gn=require("path");function Mu(t,e,r={}){let{encoding:n="... L4: `;Mu(t,n,r)}function Ay(t,e){let r;try{r=ht.lstatSync(t)}catch(o){return o.code==="ENOENT"?{ok:!0,reason:"missing"}:{ok:!1,reason:`lstat: ${o.message}`}}if(r.isSymbolicLink())try{r... L5: `).reduce((r,n)=>r+=Math.max(1,Math.ceil(n.length/e)),0)}function My(t="",e={}){let r=0,n=e.interval||50,s=e.stream||process.stderr,i=e.frames&&e.frames.length?e.frames:Ut.symbols.... L6: `,p.write(C,!0),Ut.isTTY&&(c=By(C,s.columns)),p},spin(){return p.render(),r=++r%i.length,p},update(C){return typeof C=="string"?t=C:(t=C.text||t,i=C.frames&&C.frames.length?C.frame... L7: `}`:"",!0),Ut.isTTY&&!A?p.write("\x1B[?25h")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/rcode.jsView on unpkg · L3

2/* rcode — built with esbuild. Source: github.com/hanzlahabib/rihal-code */ L3: var v=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var sr=v((ij,qu)=>{var ky=require("crypto"),ht=require("fs"),gn=require("path");function Mu(t,e,r={}){let{encoding:n="... L4: `;Mu(t,n,r)}function Ay(t,e){let r;try{r=ht.lstatSync(t)}catch(o){return o.code==="ENOENT"?{ok:!0,reason:"missing"}:{ok:!1,reason:`lstat: ${o.message}`}}if(r.isSymbolicLink())try{r...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rcode.jsView on unpkg · L2

rcode/bin/lib/memory-digest.cjsView file

1'use strict'; L2: /**

Low

Weak Crypto

Package source references weak cryptographic algorithms.

rcode/bin/lib/memory-digest.cjsView on unpkg · L1

server/orchestrator.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/orchestrator.js#virtual:normalized:round1View on unpkg · L35

cli/postinstall.jsView file

4* Auto-installs commands, skills, workflows, and bin tools into the global L5: * Claude Code directory (~/.claude/) so every project can use rcode immediately L6: * without needing a per-project `rcode install` run. ... L61: // #924 — opt-out for users who install the package globally but do NOT want L62: // their ~/.claude mutated (e.g. inspecting the package, or managing the global L63: // install themselves). Setting RCODE_NO_POSTINSTALL=1 (or the npm-config ... L80: L81: const globalTarget = path.join(os.homedir(), '.claude'); L82: ... L109: }; L110: fs.mkdirSync(globalTarget, { recursive: true }); L111: fs.writeFileSync(receiptPath, JSON.stringify(receipt, null, 2) + '\n');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/postinstall.jsView on unpkg · L4

32Cross-file remote execution chain: cli/postinstall.js spawns dist/rcode.js; helper contains network access plus dynamic code execution. L32: * Pure function — takes its inputs explicitly so tests can drive every L33: * branch without needing to mutate process.env / __dirname / process.cwd. L34: * ... L67: if (require.main === module) { L68: if (process.env.CI || process.env.NODE_ENV === 'test') { L69: process.exit(0); ... L71: if (process.env.RCODE_NO_POSTINSTALL === '1' || process.env.npm[redacted]) { L72: process.stderr.write('\nrcode: skipping global auto-install (RCODE_NO_POSTINSTALL set).\n'); L73: process.stderr.write(" Run 'rcode install --global' when you want /rcode-* commands.\n\n"); ... L86: // devDependencies (picocolors, semver, etc.) are not installed for global package

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli/postinstall.jsView on unpkg · L32

cli/index.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/index.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/index.jsView on unpkg

cli/install.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/install.jsView on unpkg

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView file

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

cli/doctor.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/doctor.js#virtual:normalized:round1View on unpkg

rcode/bin/lib/brain.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/brain.cjsView on unpkg

server/dashboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/dashboard.jsView on unpkg

cli/agent.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/agent.jsView on unpkg

rcode/bin/lib/memory-drift.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/memory-drift.cjsView on unpkg

rcode/bin/lib/progress.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/progress.cjsView on unpkg

rcode/bin/rcode-hooks.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-hooks.cjsView on unpkg

rcode/bin/rcode-tools.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-tools.cjsView on unpkg

cli/dashboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/dashboard.jsView on unpkg

cli/github-sync.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/github-sync.jsView on unpkg

Source & flagged code

27 flagged

package.jsonView file

Lines 1-33json

2 "name": "@hanzlaa/rcode",

3 "version": "4.16.2",

4 "description": "rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.",

5 "main": "cli/index.js",

6 "bin": {

7 "rcode": "dist/rcode.js"

8 },

9 "scripts": {

10 "dashboard": "node server/dashboard.js",

11 "test": "node --test",

12 "test:ci": "node --test --test-reporter=spec",

13 "postinstall": "node cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build:cli": "node scripts/build.cjs",

15 "build": "node scripts/build.cjs",

16 "prepack": "node scripts/prepack-strip.cjs && node scripts/build.cjs",

17 "postpack": "node scripts/postpack-restore.cjs",

18 "dogfood": "bash scripts/dogfood-check.sh",

19 "test:skills": "node test/skill-snapshot.test.cjs"

20 },

21 "files": [

22 "cli/",

23 "rcode/",

24 "server/",

25 "dist/",

26 "README.md",

27 "AGENTS.md",

28 "CLAUDE.md",

29 "CONTRIBUTING.md"

30 ],

31 "keywords": [

32 "rcode",

33 "claude-code",

•devDependencies registry_only=@clack/prompts,diff,esbuild,fast-glob,nanospinner,picocolors,semver,zod

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

dist/rcode.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* rcode — built with esbuild. Source: github.com/hanzlahabib/rihal-code */

3var v=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var sr=v((ij

rcode/bin/lib/memory-digest.cjsView file

Lines 1-21javascript

1'use strict';

2/**

Low

Weak Crypto

Package source references weak cryptographic algorithms.

rcode/bin/lib/memory-digest.cjsView on unpkg · L1

3 * memory-digest.cjs — deterministic content-based digest for Memory Bank

4 * distillate freshness (#1065).

5 *

6 * memory-distill.md previously defined the freshness digest as

7 * sha1(path + ":" + mtime, sorted) — narrative only, no real implementation.

8 * Keying on mtime is unsound for a git-tracked repo: git clone/checkout/

server/orchestrator.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/orchestrator.js#virtual:normalized:round1View on unpkg · L35

cli/postinstall.jsView file

Lines 1-24javascript

1/**

2 * rcode postinstall hook — runs automatically after `npm install -g`

3 *

4 * Auto-installs commands, skills, workflows, and bin tools into the global

5 * Claude Code directory (~/.claude/) so every project can use rcode immediately

6 * without needing a per-project `rcode install` run.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/postinstall.jsView on unpkg · L4

7 *

8 * Artifacts (.planning/, STATE.md, ROADMAP.md) are always created in the

cli/index.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/index.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/index.jsView on unpkg

cli/install.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/install.jsView on unpkg

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView file

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

rcode/skills/core/rcode-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

cli/doctor.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/doctor.js#virtual:normalized:round1View on unpkg

rcode/bin/lib/brain.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/brain.cjsView on unpkg

server/dashboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/dashboard.jsView on unpkg

cli/agent.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/agent.jsView on unpkg

rcode/bin/lib/memory-drift.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/memory-drift.cjsView on unpkg

rcode/bin/lib/progress.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/lib/progress.cjsView on unpkg

rcode/bin/rcode-hooks.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-hooks.cjsView on unpkg

rcode/bin/rcode-tools.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rcode/bin/rcode-tools.cjsView on unpkg

cli/dashboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/dashboard.jsView on unpkg

cli/github-sync.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/github-sync.jsView on unpkg

Lines 97-137javascript

97${t}

98`.split(`

99`),n=Zc.stripVTControlCharacters(e).length,s=Math.max(r.reduce((o,a)=>{let c=Zc.stripVTControlCharacters(a);return c.length>o?c.length:o},0),n)+2,i=r.map(o=>`${_.gray(te)} ${_.dim(o)}${" ".repeat(s-Zc.stripVTControlCharacters(o).length)}${_.gray(te)}`).join(`

100`);process.stdout.write(`${_.gray(te)}

101${_.green(Oo)} ${_.reset(e)} ${_.gray(ag.repeat(Math.max(s-n-1,1))+d$)}

102${i}

103${_.gray(f$+ag.repeat(s+2)+h$)}

104`)},x$=(t="")=>{process.stdout.write(`${_.gray(lt)} ${_.red(t)}

105

106`)},k$=(t="")=>{process.stdout.write(`${_.gray(u$)} ${t}

107`)},$$=(t="")=>{process.stdout.write(`${_.gray(te)}

108${_.gray(lt)} ${t}

109

110`)},an={message:(t="",{symbol:e=_.gray(te)}={})=>{let r=[`${_.gray(te)}`];if(t){let[n,...s]=t.split(`

111`);r.push(`${e} ${n}`,...s.map(i=>`${_.gray(te)} ${i}`))}process.stdout.write(`${r.join(`

112`)}

113`)},info:t=>{an.message(t,{symbol:_.blue(p$)})},success:t=>{an.message(t,{symbol:_.green(m$)})},step:t=>{an.message(t,{symbol:_.green(Oo)})},warn:t=>{an.message(t,{symbol:_.yellow(g$)})},warning:t=>{an.warn(t)},error:t=>{an.message(t,{symbol:_.red(D$)})}},fg=()=>{let t=Uc?["\u25D2","\u25D0","\u25D3","\u25D1"]:["\u2022","o","O","0"],e=Uc?80:120,r=process.env.CI==="true",n,s,i=!1,o="",a,c=S=>{let C=S>1?"Something went wrong":"Canceled";i&&p(C,S)},u=()=>c(2),l=()=>c(1),d=()=>{process.on("uncaughtExceptionMonitor",u),process.on("unhandledRejection",u),process.on("SIGINT",l),process.on("SIGTERM",l) ...

114`);let S=a.split(`

115`);process.stdout.write(ig.cursor.move(-999,S.length-1)),process.stdout.write(ig.erase.down(S.length))},m=S=>S.replace(/\.+$/

116`);let C=0,A=0;d(),s=setInterval(()=>{if(r&&o===a)return;g(),a=o;let T=_.

117`),f(),n()};return{start:y,stop:p,message:(S="")=>{o=m(S??o)}}},A$=async(t,e)=>{let r={},n=

118`)}gg.exports={readPackageManifest:Lo,verifyInstall:j$,verifyClaudeInstall:pg,verifyRulesInstall:Xc,verifyAntigravityInstall:mg,formatReport:I$}});var ls=v((tT,vt)=>{var D=require("fs"),h=require("path"),T$=require("crypto"),R$=require("os"),{writeFileAtomic:Le,safeRmSync:eu}=sr(),{homedir:Re}=gr(),J=Bn(),{createSpinner:P$}=Yu(),O$=Wf(),{z:Te}=Qa(),Rn=em(),{createTwoFilesPatch:Dg}=Lm(),Ne=Jc(),qt=t=>J.green("\u2713")+" "+t,yg=t=>J.red("\u2717")+" "+t,Dt=t=>J.yellow("\u26A0")+" "+t,Bo=t=>J.cyan("\u2192")+" "+t,Z=t=>J.dim(t),Bt=t=>J.bold(t),yt=h.resolve(__dirname,".."),xe=h.join(yt,"rcode"),us=O ...

119`)+`

High

Child Process

Package source references child process execution.

dist/rcode.jsView on unpkg · L117

120`,encoding:"utf8"});return c.status!==0?{ok:!1,warning:`tar failed: ${(c.stderr||"").trim().split(`

121`)[0]}`,fileCount:n.length}:{ok:!0,path:a,fileCount:n.length}}function M$(t){let e=t||ze(),r=["",J.cyan(

122`))}function vg(t){let e={claude:!1,cursor:!1,gemini:!1,vscode:!1,antigravity:!1,windsurf:!1,codex:!1};D.existsSync(h.join(t,".claude"))&&(e.claude=!0),D.existsSync(h.join(t,".cursor"))&&(e.cursor=!0),D.existsSync(h.join(t,".gemini"))&&(e.gemini=!0),D.existsSync(h.join(t,".vscode"))&&(e.vscode=!0),D.existsSync(h.join(t,".antigravity"))&&(e.antigravity=!0),D.existsSync(h.join(t,".windsurf"))&&(e.windsurf=!0);let r=Re();return D.existsSync(h.join(r,".claude"))&&(e.claude=!0),D.existsSync(h.join(r,".cursor"))&&(e.cursor=!0),D.existsSync(h.join(r,".config","Cursor"))&&(e.cursor=!0),D.existsSync(h. ...

123`),{action:"merged",replaced:u}}catch{return{action:"skipped-error"}}}function Eg(){console.log(`

124rcode installer

125

126Usage:

127 node cli/install.js [target-dir]

128

129Options:

130 --force overwrite existing files without prompting

131 --reset with --force, also delete config.yaml and state.json to re-init

132 --yes non-interactive, accept defaults

133 --user <name> set user_name in config.yaml (default: $USER)

134 --project <name> set project_name (default: basename of target-dir)

135 --language <lang> set communication_language (default: English)

136 --mode <guided|yolo> default mode (default: guided)

137 --ide <name> target IDE (claude, cursor, gemini; default: claude)

Long lines were clipped for display.

@hanzlaa/rcode@4.16.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code