@crouton-kit/crouter: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@crouton-kit/crouter: AI-agent control-surface risk | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/runtime-selector.mjsView file

1import { spawnSync } from 'node:child_process'; L2: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/runtime-selector.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = bin/runtime-selector.mjs matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-selector.mjsView on unpkg

366if (result.runtime.notice !== undefined) process.stderr.write(`${command}: ${result.runtime.notice}\n`); L367: await import(pathToFileURL(result.runtime.entryPath).href); L368: return;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/runtime-selector.mjsView on unpkg · L366

dist/clients/attach/slash/dispatch.jsView file

564/** Open `cmd` as a fire-and-forget tmux display-popup (same geometry as the canvas L565: * extensions). tmux runs the trailing string through `sh -c`; the popup owns its L566: * screen and closes itself when the command exits, dropping back to this pane. */

High

Shell

Package source references shell execution.

dist/clients/attach/slash/dispatch.jsView on unpkg · L564

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView file

1import type { ExtensionAPI } from "@earendil-works/pi-coding-agent"; L2: import { execFile } from "node:child_process"; L3: import { promisify } from "node:util"; ... L25: const h = createHash("sha1").update(cwd).digest("hex").slice(0, 16); L26: return join(homedir(), ".crouter", "cache", `crouter-help-${h}.json`); L27: } ... L38: try { L39: const c = JSON.parse(readFileSync(file, "utf8")) as { text?: string; at?: number }; L40: if (typeof c.text === "string" && c.text && typeof c.at === "number" && Date.now() - c.at < TTL_MS) { ... L49: try { L50: const { stdout } = await run("crouter", ["-h"], { timeout: 10_000 }); L51: helpText = stdout.trim();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView on unpkg · L1

dist/core/self-update.jsView file

23export function selfUpdate() { L24: const res = spawnSync('npm', ['i', '-g', '@crouton-kit/crouter@latest'], { stdio: 'inherit' }); L25: if (res.status !== 0) { L26: throw general('npm install failed'); L27: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/self-update.jsView on unpkg · L23

dist/clients/attach/viewer.jsView file

•path = dist/clients/attach/viewer.js kind = oversized_source_file sizeBytes = 7199424 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/clients/attach/viewer.jsView on unpkg

dist/clients/web/server.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/clients/web/server.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clients/web/server.jsView on unpkg

dist/core/runtime/resume-root.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/core/runtime/resume-root.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/resume-root.jsView on unpkg

dist/core/view/transport-local.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/core/view/transport-local.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/view/transport-local.jsView on unpkg

bin/runtime-generation-manifest.mjsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = bin/runtime-generation-manifest.mjs matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-generation-manifest.mjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 62-102json

62 }

63 },

64 "files": [

65 "dist",

66 "bin",

67 "!bin/__tests__",

68 "docs",

69 "scripts/postinstall.mjs",

70 "scripts/patch-pi-tree-root-ordering.mjs",

71 "scripts/install-runtime.mjs",

72 "scripts/runtime-lock.mjs",

73 "runtime.lock.json"

74 ],

75 "scripts": {

76 "build": "node scripts/build.mjs",

77 "build:api": "tsc -p packages/crouter-api/tsconfig.json",

78 "typecheck:pi-packages": "npx tsc -p src/builtin-pi-packages/pi-crtr-extensions/tsconfig.json && npx tsc -p src/builtin-pi-packages/pi-mode-switch/tsconfig.json",

79 "test:build-output": "node scripts/test-runner.mjs build-output",

80 "lint:web-px": "node scripts/lint-web-px.mjs",

81 "check:cli-no-canvas": "node scripts/check-cli-no-canvas.mjs",

82 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 "install-runtime": "node scripts/install-runtime.mjs",

84 "prepack": "node scripts/runtime-lock.mjs prepack",

85 "postpack": "node scripts/runtime-lock.mjs postpack",

86 "dev": "tsx --conditions=crtr-src src/cli.ts",

87 "link": "npm link",

88 "prepublishOnly": "npm run build",

89 "test": "node scripts/test-runner.mjs fast",

90 "test:full": "node scripts/test-runner.mjs full",

91 "test:full:cheap": "node scripts/test-runner.mjs cheap",

92 "test:full:process": "node scripts/test-runner.mjs process",

93 "test:full:live": "node scripts/test-runner.mjs live",

94 "test:full:heavy": "node scripts/test-runner.mjs heavy"

95 },

96 "overrides": {

97 "@earendil-works/pi-ai": "0.82.1",

98 "@earendil-works/pi-agent-core": "0.82.1",

99 "@earendil-works/pi-tui": "0.82.1"

100 },

101 "repository": {

102 "type": "git",

bin/runtime-selector.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/runtime-selector.mjsView on unpkg · L1

3import { homedir } from 'node:os';

dist/clients/attach/slash/dispatch.jsView file

Lines 544-584javascript

544 return true;

545}

546/** `/context`. Opens `crtr node inspect context` as a popup — a

547 * read-only nvim explorer over this node's + its subscriptions' context dirs.

548 * Self-contained popup — no node-focus, no return-pane. */

549function openContext(ctx) {

550 if

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView file

Lines 1-21typescript

1import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/self-update.jsView file

Lines 3-43javascript

3// (core) previously imported from commands/update.ts (commands layer).

4import { spawnSync } from 'node:child_process';

5import { fileURLToPath } from 'node:url';

6import { join, dirname } from 'node:path';

7import { readFileSync }

dist/clients/attach/viewer.jsView file

•path = dist/clients/attach/viewer.js kind = oversized_source_file sizeBytes = 7199424 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/clients/attach/viewer.jsView on unpkg

dist/clients/web/server.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/clients/web/server.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clients/web/server.jsView on unpkg

dist/core/runtime/resume-root.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/core/runtime/resume-root.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/resume-root.jsView on unpkg

dist/core/view/transport-local.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/core/view/transport-local.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/view/transport-local.jsView on unpkg

bin/runtime-generation-manifest.mjsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = bin/runtime-generation-manifest.mjs matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-generation-manifest.mjsView on unpkg