Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

recess-cli@1.9.1: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / recess-cli / 1.9.1

recess-cli@1.9.1

Safe Recess administration and family AI tools from the command line.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically replaces the package-owned Recess skill directories for Codex and Claude. Explicit `recess setup` may fetch authenticated Markdown skill updates.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; explicit recess setup

Impact

Changes instructions visible to Codex/Claude under recess-cli-owned skill directories.

Mechanism

agent skill installation and authenticated Markdown skill update

Rationale

The package has a real install-time AI-agent skill mutation, warranting a warning under the lifecycle policy. Its scope and validation do not establish malicious behavior.

Evidence

package.jsonscripts/postinstall.mjsdist/setup.jsdist/skill-update.jsdist/config.js~/.codex/skills/recess-cli~/.claude/skills/recess-cliskill/recess-cli

Network endpoints2

api.recess.ggrecess.gg

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

npm postinstall imports setup and invokes installSkill unattended.
installSkill writes bundled content into Codex and Claude skill directories.
Setup can later fetch and write server-provided Markdown skill files.

Evidence against

The installed paths are package-owned recess-cli skill directories, not broad agent settings.
Remote bundle paths are limited to contained .md files.
No credential exfiltration, shell execution, or foreign control-surface mutation found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 14 file(s), 225 KB of source, external domains: 127.0.0.1, api.recess.gg, recess.gg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

30L31: const { installSkill } = await import(setupModule); L32: const destinations = await installSkill();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.mjsView on unpkg · L30

25async function main() { // Rule 2: a published tarball ships `dist/` and no `src/`; a checkout has // both. Only the former is a real end-user install. const isCheckout = fs.existsSync(path.resolve(here, "..", "src")); if (isCheckout || !fs.existsSync(setupModule)) return; const { installSkill } = await import(setupModule); const destinations = await installSkill();

Medium

Suspicious Lifecycle Evidence

npm postinstall imports setup and invokes installSkill unattended.

scripts/postinstall.mjsView on unpkg · L25

Findings

1 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencescripts/postinstall.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

91%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainerskaelin

Version2.6.1

PublishedAug 20, 2026

LicenseUNLICENSED

Dependencies3

Integrityverified

Package size59.1 KB

Files19

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → recess

Runtimenode >=20

Artifact246 KB · 19 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsNoLicense

LPM CLI

Source & flagged code

4 flagged

package.jsonView file

Lines 37-59json

37 "esbuild": "^0.28.2",

38 "openapi-typescript": "^7.8.0",

39 "oxlint": "^1.28.0",

40 "oxlint-tsgolint": "^0.6.0",

41 "typescript": "^5.9.2",

42 "vitest": "^1.6.0",

43 "@tryrecess/typescript-config": "0.0.0"

44 },

45 "scripts": {

46 "build": "tsc",

47 "client:generate": "node scripts/generate-api-types.mjs",

48 "typecheck": "tsgo --noEmit",

49 "format": "oxfmt --ignore-path .oxfmtignore --check",

50 "format:fix": "oxfmt --ignore-path .oxfmtignore",

51 "lint": "oxlint --type-aware src/*.ts",

52 "lint:fix": "oxlint --type-aware --fix src/*.ts",

53 "test": "vitest run",

54 "install-local": "pnpm run build && make install-local",

55 "install-persistent": "pnpm run build && make install-persistent",

56 "install-skill": "pnpm run build && node scripts/install-skill.mjs",

57 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 }

59}

scripts/postinstall.mjsView file

Lines 5-45javascript

5// remembers to rerun `recess setup` — so an agent reads last release's command

6// reference against this release's CLI. That gap is the whole reason skill

7// changes felt like they needed a separate delivery channel.

8//

9// Three rules, because this runs unattended inside every install:

10// 1. Never fail the install. A read-only HOME, a sandboxed CI runner, or a

11// missing build all exit 0 — a skill copy is not worth a failed upgrade.

12// 2. Never run from a source checkout. In the monorepo `pnpm install` fires

13// postinstall for the workspace package too, where dist/ may be stale or

14

// absent; writing a developer's half-built skill into their real agent

15// directories would be a surprising side effect of `pnpm install`.

16// 3. Stay quiet on success. One line, on stderr, so it cannot pollute a

17// piped `--json` envelope if anything ever invokes this indirectly.

18import fs from "node:fs";

19import path from "node:path";

20import { fileURLToPath } from "node:url";

21

22const here = path.dirname(fileURLToPath(import.meta.url));

23const setupModule = path.resolve(here, "..", "dist", "setup.js");

24

25async function main() {

26 // Rule 2: a published tarball ships `dist/` and no `src/`; a checkout has

27 // both. Only the former is a real end-user install.

28 const isCheckout = fs.existsSync(path.resolve(here, "..", "src"));

29 if (isCheckout || !fs.existsSync(setupModule)) return;

30

31 const { installSkill } = await import(setupModule);

32 const destinations = await installSkill();

Medium

Suspicious Lifecycle Evidence

npm postinstall imports setup and invokes installSkill unattended.

scripts/postinstall.mjsView on unpkg · L25

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.mjsView on unpkg · L30

33 process.stderr.write(

34 `recess-cli: refreshed the agent skill for ${destinations

35 .map((destination) => destination.agent)

36 .join(" and ")}\n`

37 );

38}

39

40try {

41 await main();

42} catch {

43 // Rule 1. `recess setup` remains the explicit, error-reporting path.

44}

45