@volter/supercode@0.5.223: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@volter/supercode@0.5.223: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/release.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node lib/release.mjs" }, "dependencies": { "@volter/supercode-orchestrator": "0.5.90", "@volter/supercode-harness-sdk": "0.3.76", "@volter/supercode-teams": "0.3.100" }, "optionalDependencies": { "@volter/supercode-c

Medium

Ai Review Evidence

package.json automatically runs lib/release.mjs after installation.

package.jsonView on unpkg · L13

bin/supercode.jsView file

7L8: const { spawnSync } = require("child_process"); L9: const { pathToFileURL } = require("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/supercode.jsView on unpkg · L7

lib/release.mjsView file

47if (!own || !isMachines()) return; const home = process.env.SUPERCODE_HOME || (process.env.XDG_CONFIG_HOME ? join(process.env.XDG_CONFIG_HOME, 'supercode') : join(homedir(), '.config', 'supercode')); const service = join(process.env.SUPERCODE_TEAMS_HOME || join(home, 'teams'), 'service'); let stale = false; try { for (const na

Medium

Ai Review Evidence

The hook requires a package-local Teams entry and checks that this installation is the machine’s active Supercode.

lib/release.mjsView on unpkg · L47

52for (const name of readdirSync(service)) { if (!UNIT.test(name)) continue; const named = readFileSync(join(service, name), 'utf8').match(ENTRY) ?? []; if (named.some((entry) => resolve(entry) !== own)) stale = true; } } catch { return; } // no units: nothing runs a daemon here if (stale) spawnSync(native, ['__teams-follow-release'], { stdio: ['ignore', 'ignore', 'inherit'] }); }

Medium

Ai Review Evidence

The hook reads matching Supercode Teams service units and invokes a native migration command when their Teams entry differs.

lib/release.mjsView on unpkg · L52

65const native = createRequire(import.meta.url).resolve(`@volter/supercode-cli-${process.platform}-${process.arch}/bin/${binName}`); followRelease(native); } catch { /* no

Medium

Suspicious Dependency Evidence

The migration executable comes from a platform-specific optional dependency; its implementation is absent from this snapshot.

lib/release.mjsView on unpkg · L65

Source & flagged code

6 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "@volter/supercode",

3 "version": "0.5.223",

4 "description": "Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.",

5 "repository": { "type": "git", "url": "git+https://github.com/volter-ai/supercode.git" },

6 "homepage": "https://github.com/volter-ai/supercode#readme",

7 "bugs": { "url": "https://github.com/volter-ai/supercode/issues" },

8 "license": "MIT OR Apache-2.0",

9 "keywords": ["ai", "agent", "llm", "coding", "cli", "openrouter", "claude", "codex"],

10 "bin": { "supercode": "bin/supercode.js" },

11 "files": ["bin/", "lib/"],

12 "engines": { "node": ">=16" },

13 "scripts": { "postinstall": "node lib/release.mjs" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "dependencies": {

15 "@volter/supercode-orchestrator": "0.5.90",

16 "@volter/supercode-harness-sdk": "0.3.76",

17 "@volter/supercode-teams": "0.3.100"

18 },

19 "optionalDependencies": {

20 "@volter/supercode-cli-darwin-arm64": "0.5.223",

Medium

Ai Review Evidence

package.json automatically runs lib/release.mjs after installation.

package.jsonView on unpkg · L13

21 "@volter/supercode-cli-darwin-x64": "0.5.223",

22 "@volter/supercode-cli-linux-x64": "0.5.223",

23 "@volter/supercode-cli-linux-arm64": "0.5.223",

24 "@volter/supercode-cli-win32-x64": "0.5.223"

25 }

26}

27

bin/supercode.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// The `supercode` front door. A command that has moved to TypeScript (lib/commands.mjs) is served here, in Node; every

3// other command goes to the native binary, which ships in a platform-specific optional dependency

4// (`@volter/supercode-cli-<os>-<cpu>`, npm installs only the one matching the host), with argv, stdio (so the

5// interactive REPL/TTY works) and the exit code forwarded as before (arc t_08d00e09, route step 2).

6"use strict";

7

8const { spawnSync } = require

lib/release.mjsView file

Lines 27-69javascript

27 * node_modules/.bin. Another install run on the machine (a scratch prefix, an npx, a review's build) is not, and

28 * never moves the machine's daemon. */

29function isMachines() {

30 const self