registry / AI-agent control-surface risk / imhcode
imhcode
IMH-Code — Imam Hussain Coding Harness Platform. A fast-first multi-agent AI coding framework with intelligent model routing. 19 generic role-based agents (planner, nextjs-executor, laravel-executor, etc.), configurable testing strategy, and 7 token-savin
This report shows the evidence for imhcode@1.0.4. 2 of 13 known versions are blocked or flagged. The newest version, 2.0.5, is flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms unconsented persistent mutation of broad/foreign AI-agent control surfaces from the package entrypoint, plus shell persistence and dangerous permission-bypass agent execution modes. Although not an npm lifecycle hook and no data exfiltration was found, the global assistant-control overwrite is concrete blockable behavior under the firewall policy.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the imhcode binary with no subcommand
Impact
Package-supplied instructions and skills can affect future Claude/Gemini/Copilot sessions outside the current project, with PATH persistence and permission-bypass execution modes available for live agent runs.
Mechanism
Unprompted global assistant configuration and persistent shell/agent setup
Policy narrative
Running the package CLI without arguments performs initialization that overwrites global Claude, Gemini, and Copilot configuration files and skills with package-supplied agent instructions, removes existing skills directories, modifies shell startup PATH, and runs global npm/npx installation commands. This gives the package persistent influence over broad AI-agent control surfaces beyond a single project.
AI rationale
Source inspection confirms unconsented persistent mutation of broad/foreign AI-agent control surfaces from the package entrypoint, plus shell persistence and dangerous permission-bypass agent execution modes. Although not an npm lifecycle hook and no data exfiltration was found, the global assistant-control overwrite is concrete blockable behavior under the firewall policy.
Evidence
package.jsonbin/imhcode.jsAGENTS.mdCLAUDE.mdsrc/orchestrator/executor.tsdist/orchestrator/executor.js~/.imhcode/~/.claude/CLAUDE.md~/.claude/AGENTS.md~/.claude/skills~/.gemini/CLAUDE.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- bin/imhcode.js default entry runs runInit() when no command is supplied
- runInit() copies package CLAUDE.md, AGENTS.md, and skills/ into ~/.claude, ~/.gemini, and ~/.copilot
- runInit() removes existing assistant skills directories before copying package skills
- registerCliGlobally() writes shims to ~/.imhcode/bin and ~/.local/bin and appends PATH changes to shell rc files
- ensureCavemanAndGraphify() runs npm install -g skills and npx skills add during init
- src/dist executor adapters use opencode --dangerously-skip-permissions and codex --dangerously-bypass-approvals-and-sandbox for live runs
Evidence against
- package.json has no npm lifecycle install hooks
- No credential harvesting or exfiltration logic found in reviewed entrypoints
- Network activity is mostly package-manager/CLI installation invoked from init
- Primary behavior is an AI coding orchestration framework with bundled agents and skills
Behavioral surface
ChildProcessCryptoDynamicRequireEval
Source & flagged code
22 flagged · loading sourceskills/typeui-main/src/prompts/designSystem.tsView file
18async function loadInquirer(): Promise<InquirerModule["default"]> {
L19: const dynamicImport = new Function(
L20: "specifier",
Low
Eval
Package source references a known benign dynamic code generation pattern.
skills/typeui-main/src/prompts/designSystem.tsView on unpkg · L18bin/imhcode.jsView file
24const path = require('path');
L25: const { execSync, spawnSync } = require('child_process');
L26: const os = require('os');
...
L34: const CONFIG_FILE = 'imhcode.config.json';
L35: const GLOBAL_DIR = path.join(os.homedir(), '.imhcode');
L36: const LOCAL_DIR_NAME = '.imhcode';
...
L49: if (command === '--version' || command === '-v') {
L50: const pkg = require(path.join(__dirname, '..', 'package.json'));
L51: console.log(`${CLI_CMD} version: ${pkg.version}`);
...
L483: # 3. Run development server
L484: ${stack.includes('Next.js') ? 'cd frontend && npm run dev # → http://localhost:3000' : ''}
L485: ${stack.includes('Vue 3 / Nuxt 4') ? 'cd frontend && npm run dev # → http://localhost:3000' : ''}
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
bin/imhcode.jsView on unpkg · L24Findings
3 Critical3 High17 Medium5 Low
CriticalPersistence Backdoorbin/imhcode.js
CriticalTrigger Reachable Dangerous Capabilitybin/imhcode.js
CriticalPrevious Version Dangerous Deltabin/imhcode.js
HighEntrypoint Build Divergencebin/imhcode.js
HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirskills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.py
MediumDynamic Requirebin/imhcode.js
MediumNetwork
MediumShips Build Helperskills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.py
MediumStructural Risk Force Deep Review
MediumSecret Patternskills/graphify/skill-windows.md
Affected versions and remediation
This report applies to imhcode@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing imhcode@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
13 known versions2.0.5latestSuspiciousAgent extension lifecycle riskWarnPublishedJul 5, 2026, 12:56 PM2.0.4SuspiciousAgent extension lifecycle riskWarnPublishedJul 5, 2026, 12:07 PM2.0.2SuspiciousAgent extension lifecycle riskWarnPublishedJul 5, 2026, 11:55 AM2.0.1SuspiciousAI-agent capability abuseWarnPublishedJul 5, 2026, 10:59 AM