recess-cli@2.7.0

Safe Recess administration and family AI tools from the command line.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes an automatic lifecycle mutation of AI-agent skill directories, so a warning is warranted. The writes are narrowly scoped to Recess-owned skills and no concrete malicious payload, exfiltration, or broad settings modification was found.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing recess-cli through npm, which invokes postinstall.

Impact

An install can alter instructions loaded by supported AI-agent clients.

Mechanism

Automatic first-party agent skill replacement during postinstall.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/setup.js~/.codex/skills/recess-cli~/.claude/skills/recess-cli~/.codex/skills/recess-admin~/.claude/skills/recess-admin

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with low false-positive risk.

Evidence for warning

The package runs a postinstall script automatically during npm installation.
That script dynamically loads setup code and installs a bundled skill into both Codex and Claude user skill directories.
Installation replaces the existing recess-cli skill directories and deletes a prior recess-admin skill directory.

Evidence against

The lifecycle script skips source checkouts and suppresses failures.
The bundled installer targets named Recess skill subdirectories rather than arbitrary agent settings.
Network calls are tied to the configured Recess API and authenticated CLI functions; no credential harvesting or opaque payload execution was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

6 flagged

package.jsonView file

Lines 37-59json

37 "esbuild": "^0.28.2",

38 "openapi-typescript": "^7.8.0",

39 "oxlint": "^1.28.0",

40 "oxlint-tsgolint": "^0.6.0",

41 "typescript": "^5.9.2",

42 "vitest": "^1.6.0",

43 "@tryrecess/typescript-config": "0.0.0"

44 },

45 "scripts": {

46 "build": "tsc",

47 "client:generate": "node scripts/generate-api-types.mjs",

48 "typecheck": "tsgo --noEmit",

49 "format": "oxfmt --ignore-path .oxfmtignore --check",

50 "format:fix": "oxfmt --ignore-path .oxfmtignore",

51 "lint": "oxlint --type-aware src/*.ts src/commands/*.ts",

52 "lint:fix": "oxlint --type-aware --fix src/*.ts src/commands/*.ts",

53 "test": "vitest run",

54 "install-local": "pnpm run build && make install-local",

55 "install-persistent": "pnpm run build && make install-persistent",

56 "install-skill": "pnpm run build && node scripts/install-skill.mjs",

57 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 }

59}

dist/commands/onboarding.jsView file

Lines 550-590javascript

550 const body = grade === undefined ? {} : { grade };

551 return writeCommand(parsed, {

552 action: "provision or reconnect the kid's Math Academy account (vendor write; cannot be automatically undone)",

scripts/postinstall.mjsView file

Lines 10-45javascript

10// 1. Never fail the install. A read-only HOME, a sandboxed CI runner, or a

11// missing build all exit 0 — a skill copy is not worth a failed upgrade.

12// 2. Never run from a source checkout. In the monorepo `pnpm install` fires

13// postinstall for the workspace package too, where dist/ may be stale or

14// absent; writing a developer's half-built skill into their real agent

15// directories would be a surprising side effect of `pnpm install`.

16// 3. Stay quiet on success. One line, on stderr, so it cannot pollute a

17// piped `--json` envelope if anything ever invokes this indirectly.

18import fs

dist/auth.jsView file

•matchType = normalized_sha256 matchedPackage = recess-cli@2.6.0 matchedPath = dist/auth.js matchedIdentity = npm:cmVjZXNzLWNsaQ:2.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth.jsView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = recess-cli@2.6.1 matchedIdentity = npm:cmVjZXNzLWNsaQ:2.6.1 similarity = 0.880 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/onboarding.jsView file

570patternName = generic_password severity = medium line = 570

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/onboarding.jsView on unpkg · L570

Findings

3 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/auth.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/commands/onboarding.js

MediumDynamic Requirescripts/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to recess-cli@2.7.0.

See all versions of recess-cli for other recorded verdicts.

Review the evidence and your use of recess-cli@2.7.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-05 01:23:19.461Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.