registry / AI-agent control-surface risk / projecta-rrr
projecta-rrr
A meta-prompting, context engineering and spec-driven development system for Claude Code by Projecta.ai
This report shows the evidence for projecta-rrr@1.25.2. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe postinstall hook unconditionally mutates the user's global Claude Code settings, tool hooks, and MCP registration. That is an unconsented install-time write to a broad foreign agent control surface, so it is a publish block even though the files are this package's own Claude toolkit.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall, which executes node bin/install.js --global --yes --skip-optimization and then node scripts/register-mcp.js.
Impact
Every later Claude Code session in that home directory loads this package's hooks and MCP server without a separate install-time consent prompt.
Mechanism
install(true) writes commands, agents, hooks, and settings.json without a location prompt, including PreToolUse hooks, then register-mcp.js adds rrr-search through the claude CLI or a direct settings.json edit. A detached bootstrap also starts.
Policy narrative
On npm install, postinstall forces a global non-interactive install. bin/install.js writes this package's commands, agents, and hook commands into the user's ~/.claude tree and merges PreToolUse and PostToolUse entries into settings.json, including hooks that match Bash, Task, and Read. scripts/register-mcp.js then registers the rrr-search MCP server with claude mcp add or by editing ~/.claude/settings.json. A background skills bootstrap is also spawned. The user does not get the interactive location prompt because --global and --yes are hardcoded in the lifecycle script.
AI rationale
The postinstall hook unconditionally mutates the user's global Claude Code settings, tool hooks, and MCP registration. That is an unconsented install-time write to a broad foreign agent control surface, so it is a publish block even though the files are this package's own Claude toolkit.
Evidence
package.jsonbin/install.jsscripts/register-mcp.js~/.claude/settings.json~/.claude/hooks~/.claude/rrr
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 90.0% confidence with low false-positive risk.
Evidence for policy risk
- npm postinstall runs bin/install.js --global --yes --skip-optimization and then scripts/register-mcp.js with no separate consent step.
- When --global is set, install(true) runs non-interactively and later starts a detached external-skills bootstrap.
- The installer appends Claude Code PreToolUse and PostToolUse hooks under the user ~/.claude settings, including Bash and Task matchers.
- register-mcp.js calls claude mcp add, and if that fails it writes rrr-search into ~/.claude/settings.json mcpServers.
Evidence against
- The package describes itself as a Claude Code installer and the written hooks are its own shipped scripts.
- Hosted bearer setup is behind hosted-setup or --enable-hosted and is not the postinstall path.
- No runtime dependency on projecta-rrr itself was found in package.json.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
27 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/install.js --global --yes --sk[redacted] && node scripts/register-mcp.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/install.js --global --yes --sk[redacted] && node scripts/register-mcp.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/hosted-setup.jsView file
27const readline = require('readline');
L28: const { execSync, spawnSync } = require('child_process');
L29:
High
Child Process
Package source references child process execution.
bin/hosted-setup.jsView on unpkg · L27Findings
1 Critical20 High8 Medium6 Low
CriticalAi Agent Control Hijackbin/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/hosted-setup.js
HighShellbin/install.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighTrigger Reachable Persistencebin/install.js
HighRuntime Package Installbin/install.js
HighShips High Entropy Blobrrr/skills/upstream/anthropic/theme-factory/theme-showcase.pdf
HighSemantic Analysis Limitedbin/install.js
HighKnown Malware Source Similaritybin/install.js
HighKnown Malware Source Similarityrrr/lib/uat/cdp-browser.js
Affected versions and remediation
This report applies to projecta-rrr@1.25.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing projecta-rrr@1.25.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.