registry / recess-cli / 2.0.0
recess-cli@2.0.0
Safe Recess administration and family AI tools from the command line.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe automatic postinstall hook writes a package-owned skill into agent skill directories and removes a named superseded skill, which warrants a lifecycle risk warning. The inspected code does not establish a broader agent control-surface attack or credential exfiltration.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the published npm package runs its postinstall hook.
Impact
Agent behavior may change when it reads the refreshed package-owned skill; the installer also deletes the specifically named superseded skill directory.
Mechanism
The hook imports the bundled setup module, which removes the existing recess-cli skill directory and copies the package’s bundled skill into Codex and Claude skill locations.
AI rationale
The automatic postinstall hook writes a package-owned skill into agent skill directories and removes a named superseded skill, which warrants a lifecycle risk warning. The inspected code does not establish a broader agent control-surface attack or credential exfiltration.
Evidence
package.jsonscripts/postinstall.mjsdist/setup.js~/.codex/skills/recess-cli~/.claude/skills/recess-cli~/.codex/skills/recess-admin~/.claude/skills/recess-admin
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall hook automatically.
- The hook imports the packaged setup module and installs a skill during published-package installs.
- The installer targets Codex and Claude skill directories, removes the existing recess-cli skill directory, and copies in the bundled skill.
- The installer also removes a specifically named superseded skill directory.
Evidence against
- The reviewed authentication flow sends its sign-in assertion to the Recess API origin configured for the CLI.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.mjsView file
30L31: const { installSkill } = await import(setupModule);
L32: const destinations = await installSkill();
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/postinstall.mjsView on unpkg · L30Findings
3 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/auth.js
HighPrevious Version Dangerous Deltadist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to recess-cli@2.0.0.
See all versions of recess-cli for other recorded verdicts.
- Review the evidence and your use of recess-cli@2.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.