Loading npm security reports…

@refactco/refact-os: Suspicious npm security report (Warn) | LPM Firewall

registry / @refactco/refact-os / 2.17.1

@refactco/refact-os@2.17.1

Installable scaffolder for the agent-first repo standard: minimum-seed substrate + canonical agent/ skill catalog with generated tool adapters

AI Security Review

scanned 20d ago · by lpm-firewall-ai

The CLI scaffolds AI-agent hook configuration that uploads full Claude/Cursor session transcripts to a hardcoded remote IP. This includes subagent transcripts and can run automatically at AI session stop/end after project setup.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs refact-os init/sync or gets generated adapters, then Claude/Cursor fires Stop/SessionEnd hooks.

Impact

Prompts, code context, secrets pasted into chats, and subagent transcripts may be sent to the package operator-controlled endpoint.

Mechanism

AI-agent transcript exfiltration via generated hooks

Attack narrative

After a project owner runs the scaffolder, refact-os writes Claude/Cursor hook configs. On Stop/SessionEnd, those hooks read the native AI transcript path supplied by the tool, collect subagent JSONL transcripts, and spawn a detached worker that POSTs the content to https://159.223.97.72:8443/transcript with TLS verification disabled. This creates an automatic AI-agent control-surface data exfiltration path from consumer projects.

Rationale

Although there is no npm install-time execution, source inspection confirms the package intentionally installs AI-agent hooks that automatically upload private session transcripts to a hardcoded remote endpoint. That is concrete unconsented data exfiltration risk in the package's core scaffolded behavior, not a noisy scanner label. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

templates/base/agent/claude-hooks.jsontemplates/base/agent/hooks.jsontemplates/base/agent/hooks/claude-transcript-send-to-remote.pytemplates/base/agent/hooks/transcript-send-to-remote.py

Source & flagged code

5 flagged · loading source

lib/company.jsView file

3const path = require("path"); L4: const { execFileSync } = require("child_process"); L5: const { loadConfig, saveConfig } = require("./refact-config");

High

Child Process

Package source references child process execution.

lib/company.jsView on unpkg · L3

templates/packs/seo/agent/skills/ahrefs/scripts/_shared.mjsView file

42'No ahrefs.projectId in .refact-os.json. Find it in the Site Audit URL ' + L43: '(https://app.ahrefs.com/site-audit/<projectId>) and add:\n' + L44: ' "ahrefs": { "projectId": 12345678 }' ... L54: // Literal env wins (handy for CI); else read the 1Password item via `op`. L55: if (process.env[field]) return process.env[field].trim(); L56: try { L57: return execSync( L58: `op item get "${item}" --vault "${DEFAULT_VAULT}" --fields label=${field} --reveal`,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

templates/packs/seo/agent/skills/ahrefs/scripts/_shared.mjsView on unpkg · L42

templates/packs/wordpress/agent/skills/plugin-update/scripts/fetch-changelog.mjsView file

8// plugin's readme.txt on the server over SSH. Prints the (sliced) changelog to L9: // stdout for the agent to read when drafting the targeted QA checklist. L10: L11: import { spawnSync } from "node:child_process"; L12: import { loadConfig, getEnv, shellQuote } from "./lib/config.mjs"; ... L65: if (m) { L66: current = { version: m[1], body: [] }; L67: blocks.push(current); ... L88: const url = L89: `https://api.wordpress.org/plugins/info/1.2/?action=plugin_information` + L90: `&request[slug]=${encodeURIComponent(slug)}&request[fields][sections]=true`; ... L97: if (!res.ok) return { ok: false, reason: `HTTP ${res.status}` };

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

templates/packs/wordpress/agent/skills/plugin-update/scripts/fetch-changelog.mjsView on unpkg · L8

templates/packs/seo/agent/skills/ga4/scripts/google-login.mjsView file

11* 1. Reads GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET from the 1Password item. L12: * 2. Starts a tiny local server on http://localhost:8765 to catch the redirect. L13: * 3. Opens your browser to Google's consent screen. ... L30: import http from 'node:http'; L31: import { execSync } from 'node:child_process'; L32: import { URL } from 'node:url'; ... L60: function openBrowser(url) { L61: const platform = process.platform; L62: const cmd = ... L95: if (u.pathname !== '/callback') { L96: res.writeHead(404); res.end(); return; L97: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

templates/packs/seo/agent/skills/ga4/scripts/google-login.mjsView on unpkg · L11

templates/base/agent/hooks/claude-transcript-send-to-remote.pyView file

•path = [redacted]-transcript-send-to-remote.py kind = build_helper sizeBytes = 8846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/base/agent/hooks/claude-transcript-send-to-remote.pyView on unpkg

Source & flagged code

5 flagged

lib/company.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const os = require("os");

3const path = require("path");

4const { execFileSync } = require("child_process");

5const { loadConfig, saveConfig } = require("./refact-config");

High

Child Process

Package source references child process execution.

lib/company.jsView on unpkg · L3

6

7// Company context lives canonically in the refact-hq repo. `sync company`

8// pulls a folder from it into the project's docs/context/company/ — local and

9// fast for the agent to read, but re-syncable so it never permanently drifts.

10

11const DEFAULT_SOURCE = "github:refactco/refact-hq";

12const DEFAULT_SOURCE_PATH = "docs/company";

13const DEST = path.join("docs", "context", "company");

14

15const GENERATED_NOTE =

16 "This folder is SYNCED from the company source repo by `npx refact-os sync company`.\n" +

17 "Do not edit here — change it in the source and re-sync. Local edits are overwritten.\n";

18

19function toGitUrl(source) {

20 if (/^github:/.test(source)) {

21 return `git@github.com:${source.slice("github:".length)}.git`;

22 }

23 return source; // assume a full git URL (https or ssh)

templates/packs/seo/agent/skills/ahrefs/scripts/_shared.mjsView file

Lines 22-62javascript

22 while (true) {

23 const candidate = path.join(dir, '.refact-os.json');

24 if (fs.existsSync(candidate)) return candidate;

templates/packs/wordpress/agent/skills/plugin-update/scripts/fetch-changelog.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// Fetch a plugin's changelog, sliced to the versions being applied.

3//

4// node agent/skills/plugin-update/scripts/fetch-changelog.mjs --slug <slug> [--from <ver>] [--to <ver>] [--env staging]

5//

6// Primary source: the WordPress.org plugins API (public, no auth). For premium

7// / off-directory plugins (API returns "not found"), falls back to reading the

8// plugin's readme.txt on the server over SSH. Prints the (sliced) changelog to

9// stdout for the agent to read when drafting the targeted QA checklist.

templates/packs/seo/agent/skills/ga4/scripts/google-login.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * google-login.mjs — one OAuth login that covers GA4, GTM, and Search Console.

4 *

5 * The ga4, gtm, and gsc skills all share ONE refresh token on the 1Password item

6 * `GOOGLE SERVICES TOKEN`. This script mints that token with the union of scopes

7 * they need, so a single login enables all three. Re-running it UPGRADES the

8 * existing token (e.g. when an older gsc-only token lacks the analytics scope).

9 *

10

templates/base/agent/hooks/claude-transcript-send-to-remote.pyView file

•path = [redacted]-transcript-send-to-remote.py kind = build_helper sizeBytes = 8846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/base/agent/hooks/claude-transcript-send-to-remote.pyView on unpkg