registry / @crouton-kit/crouter / 0.3.153

@crouton-kit/crouter@0.3.153

crtr — agent runtime with memory, plugins, and marketplaces

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Install-time behavior creates a package-owned immutable runtime under ~/.crouter/runtime and patches a precisely pinned direct dependency. Runtime networking observed is localhost/Unix-socket service behavior; issue submission requires an explicit feedback command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall; explicit crtr sys feedback or runtime web-server commands

Impact

No confirmed malicious attack surface or unconsented broad AI-agent control-surface mutation.

Mechanism

package-owned runtime bootstrap, pinned dependency compatibility patch, and local agent service

Rationale

The lifecycle behavior is substantial but source-aligned: it builds and integrity-checks a package-owned runtime and applies a narrow version-pinned compatibility patch. No concrete malicious chain, secret theft, exfiltration, or foreign/broad agent-control mutation was identified.

Evidence

package.jsonscripts/postinstall.mjsscripts/install-runtime.mjsscripts/patch-pi-tree-root-ordering.mjsbin/runtime-selector.mjsdist/clients/web/server.js~/.crouter/runtime~/.crouter/feedbacknode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/tree-selector.js

Network endpoints2

github.com/crouton-labs/crouter/issues127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

postinstall runs scripts/postinstall.mjs.
Postinstall patches one pinned pi dependency file and installs a runtime under ~/.crouter/runtime.

Evidence against

scripts/postinstall.mjs skips runtime installation in CI and treats failures as non-fatal.
scripts/install-runtime.mjs packages this package, uses npm ci --ignore-scripts, and validates/seals the generated runtime.
bin/runtime-selector.mjs dynamically imports only a validated entry inside the selected runtime generation.
Feedback network action is only the explicit crtr sys feedback command via gh.
dist/clients/web/server.js serves a local HTTP endpoint and proxies to a local Unix socket.
No credential harvesting, covert exfiltration, foreign agent-config mutation, or remote payload download was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 495 file(s), 5.83 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.exa.ai, bit.ly, dashboard.exa.ai, docs.expo.dev, github.com, mail.google.com, platform.claude.com, pure.md, react.dev, reactrouter.com, www.linkedin.com, www.w3.org

Oversized source lightweight scan

dist/clients/attach/viewer.js6.87 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsShellDynamicRequireHighEntropyStringsMinifiedUrlStringsapi.anthropic.comdocs.expo.devgithub.complatform.claude.com

Source & flagged code

13 flagged

package.jsonView file

Lines 62-102json

62 }

63 },

64 "files": [

65 "dist",

66 "bin",

67 "!bin/__tests__",

68 "docs",

69 "scripts/postinstall.mjs",

70 "scripts/patch-pi-tree-root-ordering.mjs",

71 "scripts/install-runtime.mjs",

72 "scripts/runtime-lock.mjs",

73 "runtime.lock.json"

74 ],

75 "scripts": {

76 "build": "node scripts/build.mjs",

77 "build:api": "tsc -p packages/crouter-api/tsconfig.json",

78 "typecheck:pi-packages": "npx tsc -p src/builtin-pi-packages/pi-crtr-extensions/tsconfig.json && npx tsc -p src/builtin-pi-packages/pi-mode-switch/tsconfig.json",

79 "test:build-output": "node scripts/test-runner.mjs build-output",

80 "lint:web-px": "node scripts/lint-web-px.mjs",

81 "check:cli-no-canvas": "node scripts/check-cli-no-canvas.mjs",

82 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 "install-runtime": "node scripts/install-runtime.mjs",

84 "prepack": "node scripts/runtime-lock.mjs prepack",

85 "postpack": "node scripts/runtime-lock.mjs postpack",

86 "dev": "tsx --conditions=crtr-src src/cli.ts",

87 "link": "npm link",

88 "prepublishOnly": "npm run build",

89 "test": "node scripts/test-runner.mjs fast",

90 "test:full": "node scripts/test-runner.mjs full",

91 "test:full:cheap": "node scripts/test-runner.mjs cheap",

92 "test:full:process": "node scripts/test-runner.mjs process",

93 "test:full:live": "node scripts/test-runner.mjs live",

94 "test:full:heavy": "node scripts/test-runner.mjs heavy"

95 },

96 "overrides": {

97 "@earendil-works/pi-ai": "0.82.1",

98 "@earendil-works/pi-agent-core": "0.82.1",

99 "@earendil-works/pi-tui": "0.82.1"

100 },

101 "repository": {

102 "type": "git",

bin/runtime-selector.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/runtime-selector.mjsView on unpkg · L1

3import { homedir } from 'node:os';

4import { dirname, join, resolve } from 'node:path';

5import { fileURLToPath, pathToFileURL } from 'node:url';

6import { GENERATION_ID, contained, isValidPublishedGeneration, nodeVersionsCompatible, parseSelectionTarget, runtimeHome, validateManifestShape } from './runtime-generation-manifest.mjs';

8const ROOT = runtimeHome();

9const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');

10const FEEDBACK_REPO = 'crouton-labs/crouter';

12function remediation() {

13 return existsSync(join(PACKAGE_ROOT, '.git'))

14 ? 'Run `npm run build && npm run install-runtime` in the crouter source checkout, then retry.'

15 : 'Reinstall crouter, then retry.';

16}

18function fail(command, detail) {

19 process.stderr.write(`${command}: invalid runtime selection: ${detail}\n${remediation()}\n`);

20 process.exitCode = 1;

21 return null;

Lines 346-379javascript

346 reason !== undefined ? `reason: ${reason}` : undefined,

347 `installed generations under ${join(ROOT, 'generations')}:`,

348 ...listGenerationSummaries().map((line) => ` - ${line}`),

349 '',

350 `remediation: ${remediation()}`,

351 '',

352 ]

353 .filter((line) => line !== undefined)

354 .join('\n'),

355 );

356}

357

358export function selectRuntime(command, entryName) {

359 const result = tryResolveRuntime(entryName);

360 return result.ok ? result.runtime : fail(command, result.error);

361}

362

363export async function runSelected(command, entryName) {

364 const result = tryResolveRuntime(entryName);

365 if (result.ok) {

366 if (result.runtime.notice !== undefined) process.stderr.write(`${command}: ${result.runtime.notice}\n`);

367 await import(pathToFileURL(result.runtime.entryPath).href);

368 return;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/runtime-selector.mjsView on unpkg · L366

369 }

370

371 const argv = process.argv.slice(2);

372 const kind = entryName === 'cli' ? escapeHatchKind(argv) : null;

373 const hatchArgs = argv.slice(2);

374 if (kind === 'feedback') return runEscapeHatchFeedback(hatchArgs, result.error);

375 if (kind === 'doctor') return runEscapeHatchDoctor(result.error, undefined, hatchArgs);

376

377 fail(command, result.error);

378}

379

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = bin/runtime-selector.mjs matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-selector.mjsView on unpkg

dist/clients/attach/slash/dispatch.jsView file

Lines 544-584javascript

544 return true;

545}

546/** `/context`. Opens `crtr node inspect context` as a popup — a

547 * read-only nvim explorer over this node's + its subscriptions' context dirs.

548 * Self-contained popup — no node-focus, no return-pane. */

549function openContext(ctx) {

550 if (process.env['TMUX'] === undefined) {

551 ctx.notify('/context needs tmux');

552 return true;

553 }

554 // The popup runs server-side and won't reliably inherit CRTR_NODE_ID, so pass

555 // this viewer's node id explicitly (mirrors /promote, /resume-node).

556 const nodeId = (ctx.nodeId ?? process.env['CRTR_NODE_ID'] ?? '').trim();

557 if (nodeId === '') {

558 ctx.notify('/context: no node to root on (viewer has no node id)');

559 return true;

560 }

561 popup(`crtr node inspect context --node ${shellQuote(nodeId)}`);

562 return true;

563}

564/** Open `cmd` as a fire-and-forget tmux display-popup (same geometry as the canvas

565 * extensions). tmux runs the trailing string through `sh -c`; the popup owns its

566 * screen and closes itself when the command exits, dropping back to this pane. */

High

Shell

Package source references shell execution.

dist/clients/attach/slash/dispatch.jsView on unpkg · L564

567function popup(cmd) {

568 try {

569 execFile('tmux', ['display-popup', '-E', '-w', '90%', '-h', '85%', ...surfaceTmuxStyleArgs(), cmd], () => {

570 /* best-effort: popup is self-contained */

571 });

572 }

573 catch {

574 /* best-effort */

575 }

576}

577/** Single-quote a string for safe interpolation into a `sh -c` command line. */

578function shellQuote(s) {

579 return `'${s.replace(/'/g, `'\\''`)}'`;

580}

581// ---------------------------------------------------------------------------

582function usage(ctx, form) {

583 ctx.notify(`Usage: ${form}`);

584 return true;

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView file

Lines 1-21typescript

1import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView on unpkg · L1

4import { mkdirSync, readFileSync, writeFileSync } from "node:fs";

5import { homedir } from "node:os";

6import { createHash } from "node:crypto";

7import { dirname, join } from "node:path";

9const run = promisify(execFile);

11// `crtr -h` is the auto-loaded tool guide. Capturing it costs a real subprocess:

12// bare `crtr -h` is the one invocation that must build the FULL command tree, so

13// it loads every subtree's module graph — ~250ms on a laptop, ~320ms in the

14// guest container. The guide's content is static per crouter version + installed

15// plugins, so that cost must never sit in front of a turn. The TTL only exists

16// to pick a tree change (an upgrade, a newly installed plugin) up eventually.

17const TTL_MS = 15_000;

19// The TTL cache is also persisted to disk, keyed by cwd (skills resolve by

20// scope, so the guide is cwd-specific). Every broker/node is a FRESH process, so

21// the in-memory cache alone is always cold at session_start — each boot would

dist/core/self-update.jsView file

Lines 3-43javascript

3// (core) previously imported from commands/update.ts (commands layer).

4import { spawnSync } from 'node:child_process';

5import { fileURLToPath } from 'node:url';

6import { join, dirname } from 'node:path';

7import { readFileSync } from 'node:fs';

8import { listAllPlugins, listAllMarketplaces } from './resolver.js';

9import { pull, fetch, currentSha, remoteSha } from './git.js';

10import { updateState } from './config.js';

11import { nowIso } from './fs-utils.js';

12import { general, network } from './errors.js';

13const __filename = fileURLToPath(import.meta.url);

14const __dirname = dirname(__filename);

15// src/core/self-update.ts → up to src/ → up to pkg root

16const PKG_ROOT = join(__dirname, '..', '..');

17const PACKAGE_JSON_PATH = join(PKG_ROOT, 'package.json');

18export function currentVersion() {

19 const raw = readFileSync(PACKAGE_JSON_PATH, 'utf8');

20 const parsed = JSON.parse(raw);

21 return parsed.version;

22}

23export function selfUpdate() {

24 const res = spawnSync('npm', ['i', '-g', '@crouton-kit/crouter@latest'], { stdio: 'inherit' });

25 if (res.status !== 0) {

26 throw general('npm install failed');

27 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/self-update.jsView on unpkg · L23

28}

29/** Check whether a newer crtr version is available on npm.

30 * Warns to stderr if network unavailable; returns {current, latest} or null if unreachable. */

31export function selfCheck() {

32 const res = spawnSync('npm', ['view', '@crouton-kit/crouter', 'version'], { encoding: 'utf8' });

33 if (res.status !== 0) {

34 return null;

35 }

36 const latest = res.stdout.trim();

37 const current = currentVersion();

38 return { current, latest };

39}

40/** Pull updates for all installed marketplaces and standalone plugins. */

41export function contentUpdate() {

42 const marketplaces = listAllMarketplaces();

43 for (const mkt of marketplaces) {

dist/clients/attach/viewer.jsView file

•path = dist/clients/attach/viewer.js kind = oversized_source_file sizeBytes = 7199358 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/clients/attach/viewer.jsView on unpkg

dist/clients/web/server.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/clients/web/server.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clients/web/server.jsView on unpkg

dist/core/runtime/resume-root.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/core/runtime/resume-root.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/resume-root.jsView on unpkg

dist/core/view/transport-local.jsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = dist/core/view/transport-local.js matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/view/transport-local.jsView on unpkg

bin/runtime-generation-manifest.mjsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.125 matchedPath = bin/runtime-generation-manifest.mjs matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.125 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-generation-manifest.mjsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/runtime-selector.mjsView file

1import { spawnSync } from 'node:child_process'; L2: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/runtime-selector.mjsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-selector.mjsView on unpkg

366if (result.runtime.notice !== undefined) process.stderr.write(`${command}: ${result.runtime.notice}\n`); L367: await import(pathToFileURL(result.runtime.entryPath).href); L368: return;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/runtime-selector.mjsView on unpkg · L366

dist/clients/attach/slash/dispatch.jsView file

564/** Open `cmd` as a fire-and-forget tmux display-popup (same geometry as the canvas L565: * extensions). tmux runs the trailing string through `sh -c`; the popup owns its L566: * screen and closes itself when the command exits, dropping back to this pane. */

High

Shell

Package source references shell execution.

dist/clients/attach/slash/dispatch.jsView on unpkg · L564

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView file

1import type { ExtensionAPI } from "@earendil-works/pi-coding-agent"; L2: import { execFile } from "node:child_process"; L3: import { promisify } from "node:util"; ... L25: const h = createHash("sha1").update(cwd).digest("hex").slice(0, 16); L26: return join(homedir(), ".crouter", "cache", `crouter-help-${h}.json`); L27: } ... L38: try { L39: const c = JSON.parse(readFileSync(file, "utf8")) as { text?: string; at?: number }; L40: if (typeof c.text === "string" && c.text && typeof c.at === "number" && Date.now() - c.at < TTL_MS) { ... L49: try { L50: const { stdout } = await run("crouter", ["-h"], { timeout: 10_000 }); L51: helpText = stdout.trim();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView on unpkg · L1

dist/core/self-update.jsView file

23export function selfUpdate() { L24: const res = spawnSync('npm', ['i', '-g', '@crouton-kit/crouter@latest'], { stdio: 'inherit' }); L25: if (res.status !== 0) { L26: throw general('npm install failed'); L27: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/self-update.jsView on unpkg · L23

dist/clients/attach/viewer.jsView file

•path = dist/clients/attach/viewer.js kind = oversized_source_file sizeBytes = 7199358 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/clients/attach/viewer.jsView on unpkg

dist/clients/web/server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clients/web/server.jsView on unpkg

dist/core/runtime/resume-root.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/resume-root.jsView on unpkg

dist/core/view/transport-local.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/view/transport-local.jsView on unpkg

bin/runtime-generation-manifest.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-generation-manifest.mjsView on unpkg

Findings

9 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/runtime-selector.mjs

HighShelldist/clients/attach/slash/dispatch.js

HighRuntime Package Installdist/core/self-update.js

HighKnown Malware Source Similaritydist/clients/web/server.js

HighKnown Malware Source Similaritydist/core/runtime/resume-root.js

HighKnown Malware Source Similaritydist/core/view/transport-local.js

HighKnown Malware Source Similaritybin/runtime-generation-manifest.mjs

HighKnown Malware Source Similaritybin/runtime-selector.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/runtime-selector.mjs

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/clients/attach/viewer.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings