registry / AI-agent control-surface risk / @refactco/refact-os

@refactco/refact-os

Installable scaffolder for the agent-first repo standard: minimum-seed substrate + canonical agent/ skill catalog with generated tool adapters

This report shows the evidence for @refactco/refact-os@2.16.0. 1 of 2 known versions is blocked or flagged. The newest version, 2.17.1, is flagged. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Direct source inspection confirms a concrete AI-agent control-surface mutation that exfiltrates agent transcripts to a hardcoded remote endpoint without clear user-facing disclosure in README. Lack of npm lifecycle execution lowers immediacy but does not remove the malicious data-exfiltration behavior once the documented CLI is used.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs refact-os init or refact-os sync, then Claude Code or Cursor fires Stop/SessionEnd/stop hooks.

Impact

Prompts, code context, secrets pasted into chats, and subagent transcripts can be sent to the package author's remote endpoint without clear README disclosure.

Mechanism

AI-agent transcript exfiltration via generated hooks

Policy narrative

After a user explicitly scaffolds a project, refact-os copies transcript upload hooks into generated Claude/Cursor adapter directories and wires them into agent stop/session-end events. When those hooks run, they read local AI transcript JSONL files plus subagent transcripts and POST them to a hardcoded remote endpoint, with certificate verification disabled and failures hidden in logs.

AI rationale

Evidence

templates/base/agent/hooks/claude-transcript-send-to-remote.pytemplates/base/agent/hooks/transcript-send-to-remote.pytemplates/base/agent/claude-hooks.jsontemplates/base/agent/hooks.jsonlib/adapters.jslib/scaffold.jsbin/refact-os.jsREADME.mdagent/hooks/claude-transcript-send-to-remote.py

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.

Evidence for policy risk

templates/base/agent/hooks/claude-transcript-send-to-remote.py reads Claude transcript_path and subagent JSONL transcripts.
templates/base/agent/hooks/transcript-send-to-remote.py reads Cursor transcript_path and subagent JSONL transcripts.
Both transcript hooks POST full transcript JSON to default https://159.223.97.72:8443/transcript with TLS verification disabled.
templates/base/agent/claude-hooks.json wires claude-transcript-send-to-remote.py into Stop and SessionEnd hooks.
templates/base/agent/hooks.json wires transcript-send-to-remote.py into Cursor stop hooks.
lib/adapters.js generates .claude/settings.json and .cursor/hooks.json from those hook specs during init/sync.

Evidence against

package.json has no install/postinstall lifecycle hook; scaffolding is user-invoked via bin/refact-os.js.
bin/refact-os.js only runs main when invoked directly, not on require().
bin/refact-os.js refuses root, home, parent-of-home, and package-root targets.
templates/packs/wordpress/agent/skills/plugin-update/scripts/fetch-changelog.mjs fetches public WordPress changelog data or user-configured SSH fallback, not confirmed exfiltration.

Source & flagged code

5 flagged

lib/company.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const os = require("os");

3const path = require("path");

4const { execFileSync } = require("child_process");

5const { loadConfig, saveConfig } = require("./refact-config");

High

Child Process

Package source references child process execution.

lib/company.jsView on unpkg · L3

7// Company context lives canonically in the refact-hq repo. `sync company`

8// pulls a folder from it into the project's docs/context/company/ — local and

9// fast for the agent to read, but re-syncable so it never permanently drifts.

11const DEFAULT_SOURCE = "github:refactco/refact-hq";

12const DEFAULT_SOURCE_PATH = "docs/company";

13const DEST = path.join("docs", "context", "company");

15const GENERATED_NOTE =

16 "This folder is SYNCED from the company source repo by `npx refact-os sync company`.\n" +

17 "Do not edit here — change it in the source and re-sync. Local edits are overwritten.\n";

19function toGitUrl(source) {

20 if (/^github:/.test(source)) {

21 return `git@github.com:${source.slice("github:".length)}.git`;

22 }

23 return source; // assume a full git URL (https or ssh)

templates/packs/seo/agent/skills/ahrefs/scripts/_shared.mjsView file

Lines 22-62javascript

22 while (true) {

23 const candidate = path.join(dir, '.refact-os.json');

24 if (fs.existsSync(candidate)) return candidate;

templates/packs/wordpress/agent/skills/plugin-update/scripts/fetch-changelog.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// Fetch a plugin's changelog, sliced to the versions being applied.

3//

4// node agent/skills/plugin-update/scripts/fetch-changelog.mjs --slug <slug> [--from <ver>] [--to <ver>] [--env staging]

5//

6// Primary source: the WordPress.org plugins API (public, no auth). For premium

7// / off-directory plugins (API returns "not found"), falls back to reading the

8// plugin's readme.txt on the server over SSH. Prints the (sliced) changelog to

9// stdout for the agent to read when drafting the targeted QA checklist.

templates/packs/seo/agent/skills/ga4/scripts/google-login.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * google-login.mjs — one OAuth login that covers GA4, GTM, and Search Console.

4 *

5 * The ga4, gtm, and gsc skills all share ONE refresh token on the 1Password item

6 * `GOOGLE SERVICES TOKEN`. This script mints that token with the union of scopes

7 * they need, so a single login enables all three. Re-running it UPGRADES the

8 * existing token (e.g. when an older gsc-only token lacks the analytics scope).

9 *

templates/base/agent/hooks/claude-transcript-send-to-remote.pyView file

•path = [redacted]-transcript-send-to-remote.py kind = build_helper sizeBytes = 8846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/base/agent/hooks/claude-transcript-send-to-remote.pyView on unpkg

Source & flagged code

5 flagged · loading source

lib/company.jsView file

3const path = require("path"); L4: const { execFileSync } = require("child_process"); L5: const { loadConfig, saveConfig } = require("./refact-config");

High

Child Process

Package source references child process execution.

lib/company.jsView on unpkg · L3

templates/packs/seo/agent/skills/ahrefs/scripts/_shared.mjsView file

42'No ahrefs.projectId in .refact-os.json. Find it in the Site Audit URL ' + L43: '(https://app.ahrefs.com/site-audit/<projectId>) and add:\n' + L44: ' "ahrefs": { "projectId": 12345678 }' ... L54: // Literal env wins (handy for CI); else read the 1Password item via `op`. L55: if (process.env[field]) return process.env[field].trim(); L56: try { L57: return execSync( L58: `op item get "${item}" --vault "${DEFAULT_VAULT}" --fields label=${field} --reveal`,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

templates/packs/seo/agent/skills/ahrefs/scripts/_shared.mjsView on unpkg · L42

Findings

1 Critical4 High4 Medium4 Low

CriticalCommand Output Exfiltrationtemplates/packs/wordpress/agent/skills/plugin-update/scripts/fetch-changelog.mjs

HighChild Processlib/company.js

HighShell

HighSame File Env Network Executiontemplates/packs/seo/agent/skills/ahrefs/scripts/_shared.mjs

HighSandbox Evasion Gated Capabilitytemplates/packs/seo/agent/skills/ga4/scripts/google-login.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/base/agent/hooks/claude-transcript-send-to-remote.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @refactco/refact-os@2.16.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @refactco/refact-os@2.16.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-01 23:41:29.276Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

2.17.1latestSuspiciousData ExfiltrationWarnPublishedJul 1, 2026, 7:35 PM 2.16.0shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJun 26, 2026, 7:29 PM

@refactco/refact-os

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Runtime surface

Behavioral surface

Source & flagged code

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code