registry / AI-agent control-surface risk / @crouton-kit/crouter

@crouton-kit/crouter

crtr — agent runtime with memory, plugins, and marketplaces

This report shows the evidence for @crouton-kit/crouter@0.3.154. 2 of 39 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The lifecycle hook concretely mutates a foreign AI-agent implementation during installation. Its narrow, version-checked patch does not remove the unconsented cross-package control-surface write.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation of @crouton-kit/crouter@0.3.154 outside CI

Impact

Alters the behavior of another AI-agent package for subsequent use.

Mechanism

postinstall source rewrite of @earendil-works/pi-coding-agent

Policy narrative

Installation runs a postinstall hook that locates a parent-installed @earendil-works/pi-coding-agent package and atomically rewrites its compiled tree-selector source. The mutation happens before the CI skip and survives as a node_modules modification, changing a foreign AI-agent package without an explicit user command.

AI rationale

The lifecycle hook concretely mutates a foreign AI-agent implementation during installation. Its narrow, version-checked patch does not remove the unconsented cross-package control-surface write.

Evidence

package.jsonscripts/postinstall.mjsscripts/patch-pi-tree-root-ordering.mjsscripts/install-runtime.mjsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/tree-selector.js~/.crouter/runtime

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
scripts/postinstall.mjs invokes the patch before its CI guard.
scripts/patch-pi-tree-root-ordering.mjs searches upward for @earendil-works/pi-coding-agent.
It rewrites that foreign agent's dist/modes/interactive/components/tree-selector.js.
The rewrite changes root ordering and persists in node_modules.

Evidence against

Patch is version-pinned and narrowly replaces one declared source statement.
No install-time credential harvesting or non-registry network endpoint was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

13 flagged

package.jsonView file

Lines 62-102json

62 }

63 },

64 "files": [

65 "dist",

66 "bin",

67 "!bin/__tests__",

68 "docs",

69 "scripts/postinstall.mjs",

70 "scripts/patch-pi-tree-root-ordering.mjs",

71 "scripts/install-runtime.mjs",

72 "scripts/runtime-lock.mjs",

73 "runtime.lock.json"

74 ],

75 "scripts": {

76 "build": "node scripts/build.mjs",

77 "build:api": "tsc -p packages/crouter-api/tsconfig.json",

78 "typecheck:pi-packages": "npx tsc -p src/builtin-pi-packages/pi-crtr-extensions/tsconfig.json && npx tsc -p src/builtin-pi-packages/pi-mode-switch/tsconfig.json",

79 "test:build-output": "node scripts/test-runner.mjs build-output",

80 "lint:web-px": "node scripts/lint-web-px.mjs",

81 "check:cli-no-canvas": "node scripts/check-cli-no-canvas.mjs",

82 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 "install-runtime": "node scripts/install-runtime.mjs",

84 "prepack": "node scripts/runtime-lock.mjs prepack",

85 "postpack": "node scripts/runtime-lock.mjs postpack",

86 "dev": "tsx --conditions=crtr-src src/cli.ts",

87 "link": "npm link",

88 "prepublishOnly": "npm run build",

89 "test": "node scripts/test-runner.mjs fast",

90 "test:full": "node scripts/test-runner.mjs full",

91 "test:full:cheap": "node scripts/test-runner.mjs cheap",

92 "test:full:process": "node scripts/test-runner.mjs process",

93 "test:full:live": "node scripts/test-runner.mjs live",

94 "test:full:heavy": "node scripts/test-runner.mjs heavy"

95 },

96 "overrides": {

97 "@earendil-works/pi-ai": "0.82.1",

98 "@earendil-works/pi-agent-core": "0.82.1",

99 "@earendil-works/pi-tui": "0.82.1"

100 },

101 "repository": {

102 "type": "git",

bin/runtime-selector.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/runtime-selector.mjsView on unpkg · L1

3import { homedir } from 'node:os';

dist/clients/attach/slash/dispatch.jsView file

Lines 544-584javascript

544 return true;

545}

546/** `/context`. Opens `crtr node inspect context` as a popup — a

547 * read-only nvim explorer over this node's + its subscriptions' context dirs.

548 * Self-contained popup — no node-focus, no return-pane. */

549function openContext(ctx) {

550 if

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView file

Lines 1-21typescript

1import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/self-update.jsView file

Lines 3-43javascript

3// (core) previously imported from commands/update.ts (commands layer).

4import { spawnSync } from 'node:child_process';

5import { fileURLToPath } from 'node:url';

6import { join, dirname } from 'node:path';

7import { readFileSync }

dist/clients/attach/viewer.jsView file

•path = dist/clients/attach/viewer.js kind = oversized_source_file sizeBytes = 7199424 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/clients/attach/viewer.jsView on unpkg

dist/clients/web/server.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/clients/web/server.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clients/web/server.jsView on unpkg

dist/core/runtime/resume-root.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/core/runtime/resume-root.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/resume-root.jsView on unpkg

dist/core/view/transport-local.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/core/view/transport-local.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/view/transport-local.jsView on unpkg

bin/runtime-generation-manifest.mjsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = bin/runtime-generation-manifest.mjs matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-generation-manifest.mjsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/runtime-selector.mjsView file

1import { spawnSync } from 'node:child_process'; L2: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/runtime-selector.mjsView on unpkg · L1

Findings

9 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/runtime-selector.mjs

HighShelldist/clients/attach/slash/dispatch.js

HighRuntime Package Installdist/core/self-update.js

HighKnown Malware Source Similaritydist/clients/web/server.js

HighKnown Malware Source Similaritydist/core/runtime/resume-root.js

HighKnown Malware Source Similaritydist/core/view/transport-local.js

HighKnown Malware Source Similaritybin/runtime-generation-manifest.mjs

HighKnown Malware Source Similaritybin/runtime-selector.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/runtime-selector.mjs

Affected versions and remediation

This report applies to @crouton-kit/crouter@0.3.154.

The versions list below shows the verdict for each recorded version.

Avoid installing @crouton-kit/crouter@0.3.154. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-29 18:39:11.542Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

39 known versions

0.3.154latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 29, 2026, 6:35 PM 0.3.153Clean—AllowPublishedJul 29, 2026, 5:22 PM 0.3.150Clean—AllowPublishedJul 28, 2026, 10:06 PM 0.3.125MaliciousSoft block: AI-agent control surfaceBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code