Loading npm security reports…

@volter/supercode@0.5.252: Suspicious npm security report (Warn) | LPM Firewall

registry / @volter/supercode / 0.5.252

@volter/supercode@0.5.252

Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation can write package-shipped skills into Claude and Codex user configuration directories. This is an automatic agent configuration change, though the inspected code uses a guarded first-party skill installation flow.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

The npm postinstall lifecycle runs the release script; if the package is the machine's active installation, that script calls the skill installer.

Impact

Agent environments may gain or receive updated Supercode skills without a separate explicit skills-install command.

Mechanism

The installer copies each shipped skill directory into the harness skills folder and writes a release marker, while retaining symlinks and folders it did not previously manage.

AI rationale

The postinstall flow automatically installs first-party Supercode skills into Claude and Codex homes, creating a concrete agent-extension lifecycle risk. The inspected behavior is a guarded, package-owned setup rather than evidence of a malicious attack.

Evidence

package.jsonlib/release.mjslib/skills.mjs~/.claude/skills/~/.codex/skills/

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence with false-positive risk.

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/release.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/supercode.jsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = bin/supercode.js matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/supercode.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 6de37407ff13b5c2 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @volter/supercode@0.5.249 matchedPath = bin/supercode.js matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 shingleOverlap = 8 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/supercode.jsView on unpkg

7L8: const { spawnSync } = require("child_process"); L9: const { pathToFileURL } = require("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/supercode.jsView on unpkg · L7

lib/skills.mjsView file

8Install-time code directly mutates a foreign AI-agent control surface: L12: // `supercode teams connect` (sdk/teams bin/workspace.mjs). L13: import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'; L14: import { createHash } from 'node:crypto'; ... L25: const HARNESS_HOMES = [ L26: { harness: 'claude', home: () => process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude') }, L27: { harness: 'codex', home: () => process.env.CODEX_HOME || join(homedir(), '.codex') }, L28: ]; ... L73: try { L74: mkdirSync(folder, { recursive: true }); L75: // written beside it and moved into place, so a harness reading skills never sees half of one ... L77: rmSync(staged, { recursive: true, force: true }); L78: c

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/skills.mjsView on unpkg · L8

lib/mcp.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/mcp.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/mcp.mjsView on unpkg

lib/release.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/release.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/release.mjsView on unpkg

lib/workflow.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/workflow.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/workflow.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "@volter/supercode",

3 "version": "0.5.252",

4 "description": "Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.",

5 "repository": { "type": "git", "url": "git+https://github.com/volter-ai/supercode.git" },

6 "homepage": "https://github.com/volter-ai/supercode#readme",

7 "bugs": { "url": "https://github.com/volter-ai/supercode/issues" },

8 "license": "MIT OR Apache-2.0",

9 "keywords": ["ai", "agent", "llm", "coding", "cli", "openrouter", "claude", "codex"],

10 "bin": { "supercode": "bin/supercode.js" },

11 "files": ["bin/", "lib/", "skills/"],

12 "engines": { "node": ">=16" },

13 "scripts": { "postinstall": "node lib/release.mjs" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "dependencies": {

15 "@volter/supercode-orchestrator": "0.5.96",

16 "@volter/supercode-harness-sdk": "0.3.78",

17 "@volter/supercode-teams": "0.3.137"

18 },

19 "optionalDependencies": {

20 "@volter/supercode-cli-darwin-arm64": "0.5.252",

21 "@volter/supercode-cli-darwin-x64": "0.5.252",

22 "@volter/supercode-cli-linux-x64": "0.5.252",

23 "@volter/supercode-cli-linux-arm64": "0.5.252",

24 "@volter/supercode-cli-win32-x64": "0.5.252"

25 }

26}

27

bin/supercode.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// The `supercode` front door. A command that has moved to TypeScript (lib/commands.mjs) is served here, in Node; every

3// other command goes to the native binary, which ships in a platform-specific optional dependency

4// (`@volter/supercode-cli-<os>-<cpu>`, npm installs only the one matching the host), with argv, stdio (so the

5// interactive REPL/TTY works) and the exit code forwarded as before (arc t_08d00e09, route step 2).

6"use strict";

7

8const { spawnSync } = require

lib/skills.mjsView file

Lines 1-28javascript

1// `supercode skills install`: the skills this release carries (skills/<name>/SKILL.md beside lib/), put into every

2// agent harness's skills folder in this OS user's home, and the messaging tools registered with each harness

3// (t_266912ff). A release ships its skills: a machine had them only where someone linked a checkout of agent-skills

4// by hand, so an agent on a machine (or under WSL) with none did not know supercode.

5//

6// Idempotent. A skill folder this installs carries a marker (`.supercode-release`: the release that wrote it and a hash

7// of what it wrote) and is replaced whole when another release's; a folder or link someone else put there is theirs,

8// and so is one edited since supercode wrote it (its files no longer hash to its marker's): both are left alone, said

9// in the report. Only this OS user's home is written (under sudo, root's): a Windows install does not reach a WSL

lib/mcp.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/mcp.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/mcp.mjsView on unpkg

lib/release.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/release.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/release.mjsView on unpkg

lib/workflow.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/workflow.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/workflow.mjsView on unpkg