@volter/supercode@0.5.224: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@volter/supercode@0.5.224: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/release.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node lib/release.mjs" }, "dependencies": { "@volter/supercode-orchestrator": "0.5.90", "@volter/supercode-harness-sdk": "0.3.76", "@volter/supercode-tea

Medium

Ai Review Evidence

package.json automatically runs lib/release.mjs after installation.

package.jsonView on unpkg · L13

bin/supercode.jsView file

7L8: const { spawnSync } = require("child_process"); L9: const { pathToFileURL } = require("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/supercode.jsView on unpkg · L7

lib/release.mjsView file

45export function followRelease(native) { const own = ownEntry(); if (!own || !isMachines()) return; const home = process.env.SUPERCO

Medium

Ai Review Evidence

The hook requires a package-local Teams entry and verifies that this installation is the machine's active Supercode command.

lib/release.mjsView on unpkg · L45

34if (!existsSync(join(dir, file))) continue; // npm's Windows shim is a .cmd beside the prefix's node_modules, not a link to the script if (process.platform === 'win32') return resolve(dir, 'node_modules', '@volter', 'supercode', 'bin', 'supercode.js') === self; try { return realpathSync(join(dir, file)) === self; } catch { return false; } } } return false; } /** Move the machine daemon's unit to this release wh

Medium

Ai Review Evidence

The hook requires a package-local Teams entry and verifies that this installation is the machine's active Supercode command.

lib/release.mjsView on unpkg · L34

14const UNIT = /^dev\.volter\.supercode-teams-connector-[0-9a-f]{16}\.(plist|service|xml)$/; const ENTRY = /[^\s<>"']*[\\/]@volter[\\/]supercode-teams[\\/]bin[\\/]teams\.mjs/g; /** This releas

Medium

Ai Review Evidence

It checks narrowly named Supercode Teams service units for references to another Teams installation.

lib/release.mjsView on unpkg · L14

Source & flagged code

6 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "@volter/supercode",

3 "version": "0.5.224",

4 "description": "Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.",

5 "repository": { "type": "git", "url": "git+https://github.com/volter-ai/supercode.git" },

6 "homepage": "https://github.com/volter-ai/supercode#readme",

7 "bugs": { "url": "https://github.com/volter-ai/supercode/issues" },

8 "license": "MIT OR Apache-2.0",

9 "keywords": ["ai", "agent", "llm", "coding", "cli", "openrouter", "claude", "codex"],

10 "bin": { "supercode": "bin/supercode.js" },

11 "files": ["bin/", "lib/"],

12 "engines": { "node": ">=16" },

13 "scripts": { "postinstall": "node lib/release.mjs" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "dependencies": {

15 "@volter/supercode-orchestrator": "0.5.90",

16 "@volter/supercode-harness-sdk": "0.3.76",

17 "@volter/supercode-teams": "0.3.102"

Medium

Ai Review Evidence

package.json automatically runs lib/release.mjs after installation.

package.jsonView on unpkg · L13

18 },

19 "optionalDependencies": {

20 "@volter/supercode-cli-darwin-arm64": "0.5.224",

21 "@volter/supercode-cli-darwin-x64": "0.5.224",

22 "@volter/supercode-cli-linux-x64": "0.5.224",

23 "@volter/supercode-cli-linux-arm64": "0.5.224",

24 "@volter/supercode-cli-win32-x64": "0.5.224"

25 }

26}

27

bin/supercode.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// The `supercode` front door. A command that has moved to TypeScript (lib/commands.mjs) is served here, in Node; every

3// other command goes to the native binary, which ships in a platform-specific optional dependency

4// (`@volter/supercode-cli-<os>-<cpu>`, npm installs only the one matching the host), with argv, stdio (so the

5// interactive REPL/TTY works) and the exit code forwarded as before (arc t_08d00e09, route step 2).

6"use strict";

7

8const { spawnSync } = require

lib/release.mjsView file

Lines 1-65javascript

1// One release is one install (RELEASING.md): the machine daemon runs the Teams package of the release its clients

2// are. A connector unit written before one-release installs names a separately installed global package, which an npm

3// upgrade does not move by itself. This package's postinstall (the install or upgrade act, never an ordinary command,

4// so no command restarts the daemon) moves it: the native rewrites the unit to this release's own Teams package (the

5// one installed inside this package) and installs its service again (`__teams-follow-release`, teams.rs

6// follow_release). Only the machine's own supercode moves it; `supercode teams connect --install` is the act by hand.

7import { existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs';