Loading npm security reports…

projecta-rrr@1.25.2: AI-agent control-surface risk | LPM Firewall

registry / projecta-rrr / 1.25.2

projecta-rrr@1.25.2

A meta-prompting, context engineering and spec-driven development system for Claude Code by Projecta.ai

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall script that globally rewrites the user's Claude Code control surface. It copies the toolkit into ~/.claude, wires tool hooks into settings.json, and registers an MCP server.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall, which executes node bin/install.js --global --yes --skip-optimization and then node scripts/register-mcp.js.

Impact

Every later Claude Code session in that home directory loads this package's hooks and MCP server without a separate install-time consent prompt.

Mechanism

install(true) writes commands, agents, hooks, and settings.json without a location prompt, including PreToolUse hooks, then register-mcp.js adds rrr-search through the claude CLI or a direct settings.json edit. A detached bootstrap also starts.

Policy narrative

On npm install, postinstall forces a global non-interactive install. bin/install.js writes this package's commands, agents, and hook commands into the user's ~/.claude tree and merges PreToolUse and PostToolUse entries into settings.json, including hooks that match Bash, Task, and Read. scripts/register-mcp.js then registers the rrr-search MCP server with claude mcp add or by editing ~/.claude/settings.json. A background skills bootstrap is also spawned. The user does not get the interactive location prompt because --global and --yes are hardcoded in the lifecycle script.

AI rationale

The postinstall hook unconditionally mutates the user's global Claude Code settings, tool hooks, and MCP registration. That is an unconsented install-time write to a broad foreign agent control surface, so it is a publish block even though the files are this package's own Claude toolkit.

Evidence

package.jsonbin/install.js

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --global --yes --sk[redacted] && node scripts/register-mcp.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/install.js --global --yes --sk[redacted] && node scripts/register-mcp.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/hosted-setup.jsView file

27const readline = require('readline'); L28: const { execSync, spawnSync } = require('child_process'); L29:

High

Child Process

Package source references child process execution.

bin/hosted-setup.jsView on unpkg · L27

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = bin/hosted-setup.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/hosted-setup.jsView on unpkg

23L24: const fs = require('fs'); L25: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hosted-setup.jsView on unpkg · L23

bin/install.jsView file

135* Detect if running inside the projecta-rrr source repository root L136: * This prevents creating duplicate .claude/ when developing RRR itself L137: */ ... L319: function runDetectShimConflicts() { L320: const configDir = expandTilde(explicitConfigDir) || expandTilde(process.env.CLAUDE_CONFIG_DIR); L321: const userClaudeDir = configDir || path.join(os.homedir(), '.claude'); L322: const userRegistryPath = path.join(userClaudeDir, 'mcp.registry.json'); ... L354: const raw = JSON.parse(fs.readFileSync(userSettingsPath, 'utf8')); L355: const servers = (raw && raw.mcpServers) || {}; L356: Object.keys(servers).forEach((k) => { ... L425: // Resolve user config dir — same precedence as the main flow. L426: const configDir = expandTilde(explicitConfigDir) || expandTilde(process.env.CLAUDE_CO

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L135

105${yellow}Recommended: Install WSL2 (Windows Subsystem for Linux)${reset} L106: 1. Open PowerShell as Administrator L107: 2. Run: ${cyan}wsl --install${reset}

High

Shell

Package source references shell execution.

bin/install.jsView on unpkg · L105

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. onsole.error(` ${yellow}⚠ could not parse ${usersettingspath}: ${err.message}${reset}`); } } if (conflicts.length === 0) { console.log(` ${green}✓${reset} no shim conflicts detected`); return; } console.log(` ${yellow}⚠${reset} ${conflicts.length} shim conflict(s) detected:`); conflicts.foreach((c) => { console.log(` • ${c.source} → name="${c.name}" type=${c.type} url=${c.url}`); }); console.log(` ${yellow}how to fix:${reset} the legacy 'rrr-search' entry with type:'http' + fly.dev url will collide with the new shim-wrapped 'rrr-search-hosted' entry (claude-code#29688 double-spawn). to resolve: 1. rename your hand-edited

rrr/lib/search/index-manifest.jsView file

51const content = fs.readFileSync(manifestPath, 'utf8'); L52: const manifest = JSON.parse(content); L53:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

rrr/lib/search/index-manifest.jsView on unpkg · L51

hooks/rrr-update-cache-stats.shView file

•path = hooks/rrr-update-cache-stats.sh kind = build_helper sizeBytes = 3705 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/rrr-update-cache-stats.shView on unpkg

rrr/skills/upstream/anthropic/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = [redacted]-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

rrr/skills/upstream/anthropic/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

rrr/skills/upstream/anthropic/theme-factory/theme-showcase.pdfView file

•path = [redacted]-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

rrr/skills/upstream/anthropic/theme-factory/theme-showcase.pdfView on unpkg

rrr/lib/uat/cdp-browser.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = rrr/lib/uat/cdp-browser.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rrr/lib/uat/cdp-browser.jsView on unpkg

rrr/lib/uat/vitest-browser-ai.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = rrr/lib/uat/vitest-browser-ai.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rrr/lib/uat/vitest-browser-ai.jsView on unpkg

rrr/lib/uat/zeroshot-validator.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = rrr/lib/uat/zeroshot-validator.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rrr/lib/uat/zeroshot-validator.jsView on unpkg

rrr/lib/mcp/discovery.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = rrr/lib/mcp/discovery.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rrr/lib/mcp/discovery.jsView on unpkg

rrr/lib/team-mode/manager.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = rrr/lib/team-mode/manager.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rrr/lib/team-mode/manager.jsView on unpkg

scripts/bootstrap-external-skills.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = scripts/bootstrap-external-skills.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bootstrap-external-skills.jsView on unpkg

scripts/security-gate.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = scripts/security-gate.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/security-gate.jsView on unpkg

rrr/hooks/session-start.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = rrr/hooks/session-start.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rrr/hooks/session-start.jsView on unpkg

rrr/lib/mcp/validate.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = rrr/lib/mcp/validate.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rrr/lib/mcp/validate.jsView on unpkg

rrr/lib/savings/harness.jsView file

•matchType = normalized_sha256 matchedPackage = projecta-rrr@1.25.0 matchedPath = rrr/lib/savings/harness.js matchedIdentity = npm:cHJvamVjdGEtcnJy:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

rrr/lib/savings/harness.jsView on unpkg

Lines 85-155javascript

85 .trim();

86 return { available: true, version };

87 } catch (e) {

88 // codex not in PATH — not an error, just not installed

89 return { available: false };

90 }

91}

92

93/**

94 * Print Windows bash remediation message

95 */

96function printWindowsBashWarning() {

97 console.log(`

98 ${orange}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${reset}

99 ${orange}⚠ BASH NOT FOUND${reset}

100 ${orange}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${reset}

101

102 RRR hooks and scripts require ${cyan}bash${reset} to run.

103 Without bash, hooks (statusline, notifications) will be skipped.

104

105 ${yellow}Recommended: Install WSL2 (Windows Subsystem for Linux)${reset}

106 1. Open PowerShell as Administrator

107 2. Run: ${cyan}wsl --install${reset}

High

Shell

Package source references shell execution.

bin/install.jsView on unpkg · L105

108 3. Restart your computer

109 4. Launch Ubuntu from Start menu

110 5. Run RRR inside Ubuntu: ${cyan}cd /mnt/c/your/project && claude${reset}

111

112 ${yellow}Alternative: Install Git for Windows${reset}

113 1. Download from: ${cyan}https://git-scm.com/download/win${reset}

114 2. Install with "Git Bash" option enabled

115 3. Run Claude Code from "Git Bash" terminal

116 4. Verify: ${cyan}bash --version${reset}

117

118 ${dim}Note: Core RRR commands (/rrr:help, /rrr:new-project, etc.) will

119 still work, but hooks and shell scripts will not run.${reset}

120`);

121}

122

123// Colors

124const cyan = '\x1b[36m';

125const green = '\x1b[32m';

126const yellow = '\x1b[33m';

127const orange = '\x1b[91m'; // bright red (more compatible than 256-color)

128const dim = '\x1b[2m';

129const reset = '\x1b[0m';

130

131// Get version from package.json

132const pkg = require('../package.json');

133

134/**

135 * Detect if running inside the projecta-rrr source repository root

136 * This prevents creating duplicate .claude/ when developing RRR itself

137 */

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L135

138function isRrrSourceRepo() {

139 const cwd = process.cwd();

140 const src = path.join(__dirname, '..');

141

142 // Check if cwd is the source repo root

143 if (path.resolve(cwd) !== path.resolve(src)) {

144 return false;

145 }

146

147 // Verify it's actually the RRR source repo by checking package.json name

148 // and presence of key source directories

149 try {

150 const cwdPkgPath = path.join(cwd, 'package.json');

151 if (!fs.existsSync(cwdPkgPath)) return false;

152

153 const cwdPkg = JSON.parse(fs.readFileSync(cwdPkgPath, 'utf8'));

154 if (cwdPkg.name !== 'projecta-rrr') return false;

155