Loading npm security reports…

@volter/supercode@0.5.262: Suspicious npm security report (Warn) | LPM Firewall

registry / @volter/supercode / 0.5.262

@volter/supercode@0.5.262

Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.

AI Security Review

scanned 13h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The npm postinstall automatically installs this package's Teams skill into installed Claude and Codex harness skill directories. This is a guarded, first-party agent extension setup; no concrete attack beyond that lifecycle integration was established.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing or upgrading the package through npm when the process is the machine's own Supercode installation.

Impact

Agent harnesses receive Supercode Teams instructions without a separate install command; the observed behavior is an agent extension lifecycle risk.

Mechanism

The postinstall imports the skill installer, which copies the shipped skill into the Claude and Codex homes and can replace an unedited skill previously marked as package-written.

AI rationale

The postinstall automatically installs a first-party skill into Claude and Codex harness configuration, creating an agent extension lifecycle risk under the stated policy. Its guarded replacement logic and the inspected skill content do not establish a concrete attack, so this warrants a warning rather than a block.

Evidence

package.jsonlib/release.mjslib/skills.mjsskills/supercode-teams/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence with false-positive risk.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/release.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/supercode.jsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = bin/supercode.js matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/supercode.jsView on unpkg

7L8: const { spawnSync } = require("child_process"); L9: const { pathToFileURL } = require("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/supercode.jsView on unpkg · L7

lib/skills.mjsView file

8Install-time code directly mutates a foreign AI-agent control surface: L12: // `supercode teams connect` (sdk/teams bin/workspace.mjs). L13: import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'; L14: import { createHash } from 'node:crypto'; ... L25: const HARNESS_HOMES = [ L26: { harness: 'claude', home: () => process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude') }, L27: { harness: 'codex', home: () => process.env.CODEX_HOME || join(homedir(), '.codex') }, L28: ]; ... L73: try { L74: mkdirSync(folder, { recursive: true }); L75: // written beside it and moved into place, so a harness reading skills never sees half of one ... L77: rmSync(staged, { recursive: true, force: true }); L78: c

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/skills.mjsView on unpkg · L8

lib/mcp.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/mcp.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/mcp.mjsView on unpkg

lib/release.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/release.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/release.mjsView on unpkg

lib/workflow.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/workflow.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/workflow.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "@volter/supercode",

3 "version": "0.5.262",

4 "description": "Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.",

5 "repository": { "type": "git", "url": "git+https://github.com/volter-ai/supercode.git" },

6 "homepage": "https://github.com/volter-ai/supercode#readme",

7 "bugs": { "url": "https://github.com/volter-ai/supercode/issues" },

8 "license": "MIT OR Apache-2.0",

9 "keywords": ["ai", "agent", "llm", "coding", "cli", "openrouter", "claude", "codex"],

10 "bin": { "supercode": "bin/supercode.js" },

11 "files": ["bin/", "lib/", "skills/"],

12 "engines": { "node": ">=16" },

13 "scripts": { "postinstall": "node lib/release.mjs" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "dependencies": {

15 "@volter/supercode-orchestrator": "0.5.100",

16 "@volter/supercode-harness-sdk": "0.3.78",

17 "@volter/supercode-teams": "0.3.144"

18 },

19 "optionalDependencies": {

20 "@volter/supercode-cli-darwin-arm64": "0.5.262",

21 "@volter/supercode-cli-darwin-x64": "0.5.262",

22 "@volter/supercode-cli-linux-x64": "0.5.262",

23 "@volter/supercode-cli-linux-arm64": "0.5.262",

24 "@volter/supercode-cli-win32-x64": "0.5.262"

25 }

26}

27

bin/supercode.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// The `supercode` front door. A command that has moved to TypeScript (lib/commands.mjs) is served here, in Node; every

3// other command goes to the native binary, which ships in a platform-specific optional dependency

4// (`@volter/supercode-cli-<os>-<cpu>`, npm installs only the one matching the host), with argv, stdio (so the

5// interactive REPL/TTY works) and the exit code forwarded as before (arc t_08d00e09, route step 2).

6"use strict";

7

8const { spawnSync } = require

lib/skills.mjsView file

Lines 1-28javascript

1// `supercode skills install`: the skills this release carries (skills/<name>/SKILL.md beside lib/), put into every

2// agent harness's skills folder in this OS user's home, and the messaging tools registered with each harness

3// (t_266912ff). A release ships its skills: a machine had them only where someone linked a checkout of agent-skills

4// by hand, so an agent on a machine (or under WSL) with none did not know supercode.

5//

6// Idempotent. A skill folder this installs carries a marker (`.supercode-release`: the release that wrote it and a hash

7// of what it wrote) and is replaced whole when another release's; a folder or link someone else put there is theirs,

8// and so is one edited since supercode wrote it (its files no longer hash to its marker's): both are left alone, said

9// in the report. Only this OS user's home is written (under sudo, root's): a Windows install does not reach a WSL

lib/mcp.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/mcp.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/mcp.mjsView on unpkg

lib/release.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/release.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/release.mjsView on unpkg

lib/workflow.mjsView file

•matchType = normalized_sha256 matchedPackage = @volter/supercode@0.5.249 matchedPath = lib/workflow.mjs matchedIdentity = npm:QHZvbHRlci9zdXBlcmNvZGU:0.5.249 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/workflow.mjsView on unpkg