Loading npm security reports…

@volter/supercode@0.5.249: AI-agent control-surface risk | LPM Firewall

registry / @volter/supercode / 0.5.249

@volter/supercode@0.5.249

Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The postinstall automatically changes local AI-agent integrations by installing package skills and registering messaging tools. It also invokes native logic documented as repairing Codex hooks.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing or upgrading the package through npm, which runs its postinstall hook.

Impact

Agent behavior and available integrations may change without a separate setup command. The inspected source does not establish remote exfiltration or destructive activity.

Mechanism

The postinstall calls skills installation and native messaging-tool registration for the machine's own installation; the release code also calls native release-following behavior that repairs Codex hooks.

Policy narrative

On npm installation or upgrade, the postinstall checks whether this is the machine's own install and then installs its skills into the current user's Claude and Codex homes and registers native messaging tools. The release path also invokes native logic described as repairing Codex hooks. These are automatic agent control-surface changes; the inspected source does not identify a network recipient or prove data theft.

AI rationale

The npm postinstall automatically mutates installed agent integrations and invokes native logic that repairs Codex hooks, establishing unconsented install-time control-surface changes. This supports blocking under the install control-surface policy even though the skill installer preserves unrelated and user-edited skill folders.

Evidence

package.jsonlib/release.mjslib/skills.mjs~/.claude/skills~/.codex/skills

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/release.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node lib/release.mjs" }, "dependencies": { "@volter/supercode-orchestrator": "0.5.93", "@volter/supercode-harness-sdk": "0.3.77", "@volter/superc

High

Ai Review Evidence

package.json runs lib/release.mjs automatically after installation.

package.jsonView on unpkg · L13

bin/supercode.jsView file

7L8: const { spawnSync } = require("child_process"); L9: const { pathToFileURL } = require("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/supercode.jsView on unpkg · L7

lib/skills.mjsView file

8Install-time code directly mutates a foreign AI-agent control surface: L12: // `supercode teams connect` (sdk/teams bin/workspace.mjs). L13: import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'; L14: import { createHash } from 'node:crypto'; ... L25: const HARNESS_HOMES = [ L26: { harness: 'claude', home: () => process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude') }, L27: { harness: 'codex', home: () => process.env.CODEX_HOME || join(homedir(), '.codex') }, L28: ]; ... L73: try { L74: mkdirSync(folder, { recursive: true }); L75: // written beside it and moved into place, so a harness reading skills never sees half of one ... L77: rmSync(staged, { recursive: true, force: true }); L78: c

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/skills.mjsView on unpkg · L8

72} try { mkdirSync(folder, { recursive: true }); // written beside it and moved into place, so a harness reading skills never sees half of one const staged = join(folder, `.${name}.installing.${process.pid}`); rmSync(staged, { recursive: true, force: true }); cpSync(join(source, name), staged, { recursi

High

Ai Review Evidence

skills.mjs copies package skills into installed Claude and Codex harness homes, replacing eligible prior package-managed skill folders.

lib/skills.mjsView on unpkg · L72

lib/release.mjsView file

237// the machine's own install puts this release's skills into every harness here and registers its messaging tools // (lib/skills.mjs): a fresh machine's agents know supercode with no step of their own // Only as the home's owner: as root (`sudo -E npm i -g`, HOME kept) it would leave root-owned skill folders in the // user's ~/.claude and ~/.codex and register the tools with each harness a

High

Suspicious Lifecycle Evidence

That postinstall invokes skills installation and messaging-tool registration for the machine's own install without a separate user command.

lib/release.mjsView on unpkg · L237

Source & flagged code

6 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "@volter/supercode",

3 "version": "0.5.249",

4 "description": "Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.",

5 "repository": { "type": "git", "url": "git+https://github.com/volter-ai/supercode.git" },

6 "homepage": "https://github.com/volter-ai/supercode#readme",

7 "bugs": { "url": "https://github.com/volter-ai/supercode/issues" },

8 "license": "MIT OR Apache-2.0",

9 "keywords": ["ai", "agent", "llm", "coding", "cli", "openrouter", "claude", "codex"],

10 "bin": { "supercode": "bin/supercode.js" },

11 "files": ["bin/", "lib/", "skills/"],

12 "engines": { "node": ">=16" },

13 "scripts": { "postinstall": "node lib/release.mjs" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "dependencies": {

15 "@volter/supercode-orchestrator": "0.5.93",

16 "@volter/supercode-harness-sdk": "0.3.77",

17 "@volter/supercode-teams": "0.3.135"

High

Ai Review Evidence

package.json runs lib/release.mjs automatically after installation.

package.jsonView on unpkg · L13

18 },

19 "optionalDependencies": {

20 "@volter/supercode-cli-darwin-arm64": "0.5.249",

21 "@volter/supercode-cli-darwin-x64": "0.5.249",

22 "@volter/supercode-cli-linux-x64": "0.5.249",

23 "@volter/supercode-cli-linux-arm64": "0.5.249",

24 "@volter/supercode-cli-win32-x64": "0.5.249"

25 }

26}

27

bin/supercode.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// The `supercode` front door. A command that has moved to TypeScript (lib/commands.mjs) is served here, in Node; every

3// other command goes to the native binary, which ships in a platform-specific optional dependency

4// (`@volter/supercode-cli-<os>-<cpu>`, npm installs only the one matching the host), with argv, stdio (so the

5// interactive REPL/TTY works) and the exit code forwarded as before (arc t_08d00e09, route step 2).

6"use strict";

7

8const { spawnSync } = require

lib/skills.mjsView file

Lines 1-28javascript

1// `supercode skills install`: the skills this release carries (skills/<name>/SKILL.md beside lib/), put into every

2// agent harness's skills folder in this OS user's home, and the messaging tools registered with each harness

3// (t_266912ff). A release ships its skills: a machine had them only where someone linked a checkout of agent-skills

4// by hand, so an agent on a machine (or under WSL) with none did not know supercode.

5//

6// Idempotent. A skill folder this installs carries a marker (`.supercode-release`: the release that wrote it and a hash

7// of what it wrote) and is replaced whole when another release's; a folder or link someone else put there is theirs,

8// and so is one edited since supercode wrote it (its files no longer hash to its marker's): both are left alone, said

9// in the report. Only this OS user's home is written (under sudo, root's): a Windows install does not reach a WSL

lib/release.mjsView file

Lines 217-250javascript

217 const followed = spawnSync(native, ['__teams-follow-release'], { stdio: ['ignore', 'ignore', 'pipe'], encoding: 'utf8', env: { ...process.env, SUPERCODE_NODE_BIN: process.env.SUPERCODE_NODE_BIN || process.execPath } });

218

Lines 52-92javascript

52 if (!existsSync(source)) return ['this release carries no skills'];

53 const skills = readdirSync(source, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync(join(source, entry.name, 'SKILL.md'))).map((entry) => entry.name);

54 const report = [];

55 for (const { harness, home } of HARNESS_HOMES) {

56 const root = home();

57 if (!existsSync(root)) { report.push(`${harness}: not installed for this user (${root}); after installing it, run \`supercode skills install\``); continue; }

58 const folder = join(root, 'skills');

59 for (const name of skills) {

60 const target = join(folder, name);

61 let stat = null;

62 try { stat = lstatSync(target); } catch { /* absent */ }

63 if (stat?.isSymbolicLink()) { report.push(`${harness} ${name}: kept, a link someone made (${readlinkSync(target)})`); continue; }

64 if (stat && !existsSync(join(target, MARKER))) { report.push(`${harness} ${name}: kept, a folder supercode did not write`); continue; }

65 const shipped = digest(files(join(source, name)));

66 if (stat) {

67 // `<release> <hash>`; a marker of a release before the hash (the release alone) is supercode's, unchecked

68 const [wrote, hash] = readFileSync(join(target, MARKER), 'utf8').trim().split(/\s+/);

69 const now = digest(files(target));

70 if (hash && hash !== now) { report.push(`${harness} ${name}: kept, edited since supercode ${wrote} wrote it (remove it to take ${version}'s)`); continue; }

71 if (wrote === String(version) && now === shipped) { report.push(`${harness} ${name}: current (${version})`); continue; }

72 }

73 try {

74 mkdirSync(folder, { recursive: true });

75 // written beside it and moved into place, so a harness reading skills never sees half of one

76 const staged = join(folder, `.${name}.installing.${process.pid}`);

77 rmSync(staged, { recursive: true, force: true });

78 cpSync(join(source, name), staged, { recursive: true });

High

Ai Review Evidence

skills.mjs copies package skills into installed Claude and Codex harness homes, replacing eligible prior package-managed skill folders.

lib/skills.mjsView on unpkg · L72

79 writeFileSync(join(staged, MARKER), `${version} ${shipped}\n`);

80 const old = join(folder, `.${name}.old.${process.pid}`);

81 if (stat) renameSync(target, old);

82 renameSync(staged, target);

83 if (stat) rmSync(old, { recursive: true, force: true });

84 report.push(`${harness} ${name}: ${stat ? 'refreshed' : 'installed'} (${version})`);

85 } catch (error) { report.push(`${harness} ${name}: not written (${error.message})`); }

86 }

87 }

88 if (process.platform === 'win32') report.push('WSL distributions are not written from Windows: run `supercode skills install` inside each one with supercode installed');

89 return report;

90}

91

92/** The messaging tools registered with each harness, by this release's native (its `__register-message-tools`). */