registry / @crouton-kit/crouter / 0.3.79

@crouton-kit/crouter@0.3.79

crtr — agent runtime with memory, plugins, and marketplaces

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

No concrete malicious chain, covert exfiltration, or broad AI-agent control-surface takeover was found. The install-time third-party agent dependency patch remains a real lifecycle risk and merits a warning.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; later explicit crtr CLI commands

Impact

Dependency behavior changes at install; user-invoked runtime may create local agent state and fetch configured marketplace content.

Mechanism

dependency patch plus agent runtime/bootstrap

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/cli.jsdist/core/bootstrap.jsdist/core/auto-update.jsdist/clients/web/server.jsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/tree-selector.js.crouter/~/.crouter/marketplaces/crouter-official-marketplace

Network endpoints4

github.com/crouton-labs/crouter-official-marketplace.gitfcm.googleapis.comupdates.push.services.mozilla.comweb.push.apple.com

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

postinstall rewrites a version-pinned pi-coding-agent file
CLI bootstrap clones an official marketplace on ordinary commands
CLI can run configured agent/plugin setup commands

Evidence against

postinstall change is a narrow, documented tree-order UI patch
no install-time credential harvesting or exfiltration found
web command is user-invoked, loopback by default, and requires a token off-loopback
push outbound endpoints are restricted to vendor push-service hosts

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 326 file(s), 4.26 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.exa.ai, bit.ly, claude.ai, dashboard.exa.ai, docs.expo.dev, feross.org, github.com, jimmy.warting.se, mail.google.com, platform.claude.com, platform.composio.dev, pure.md, react.dev, reactrouter.com, www.linkedin.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/clients/web/web-cmd.jsView file

12// single leaf: `crtr surface web serve`. L13: import { spawn } from 'node:child_process'; L14: import { defineBranch, defineLeaf } from '../../core/command.js';

High

Child Process

Package source references child process execution.

dist/clients/web/web-cmd.jsView on unpkg · L12

dist/clients/attach/slash-commands.jsView file

518/** Open `cmd` as a fire-and-forget tmux display-popup (same geometry as the canvas L519: * extensions). tmux runs the trailing string through `sh -c`; the popup owns its L520: * screen and closes itself when the command exits, dropping back to this pane. */

High

Shell

Package source references shell execution.

dist/clients/attach/slash-commands.jsView on unpkg · L518

dist/clients/attach/config-load.jsView file

124const pcaEntry = import.meta.resolve('@earendil-works/pi-coding-agent'); L125: const piTuiPath = createRequire(pcaEntry).resolve('@earendil-works/pi-tui'); L126: return (await import(pathToFileURL(piTuiPath).href));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/clients/attach/config-load.jsView on unpkg · L124

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView file

1import type { ExtensionAPI } from "@earendil-works/pi-coding-agent"; L2: import { execFile } from "node:child_process"; L3: import { promisify } from "node:util"; ... L25: const h = createHash("sha1").update(cwd).digest("hex").slice(0, 16); L26: return join(homedir(), ".crouter", "cache", `crouter-help-${h}.json`); L27: } ... L38: try { L39: const c = JSON.parse(readFileSync(file, "utf8")) as { text?: string; at?: number }; L40: if (typeof c.text === "string" && c.text && typeof c.at === "number" && Date.now() - c.at < TTL_MS) { ... L49: try { L50: const { stdout } = await run("crouter", ["-h"], { timeout: 10_000 }); L51: helpText = stdout.trim();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView on unpkg · L1

dist/core/self-update.jsView file

23export function selfUpdate() { L24: const res = spawnSync('npm', ['i', '-g', '@crouton-kit/crouter@latest'], { stdio: 'inherit' }); L25: if (res.status !== 0) { L26: throw general('npm install failed'); L27: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/self-update.jsView on unpkg · L23

dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2View file

•path = dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2 kind = high_entropy_blob sizeBytes = 23556 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2View on unpkg

dist/clients/attach/attach-cmd.jsView file

•path = dist/clients/attach/attach-cmd.js kind = oversized_source_file sizeBytes = 7121812 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/clients/attach/attach-cmd.jsView on unpkg

dist/clients/attach/input-controller.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @crouton-kit/crouter@0.3.45 matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.45 similarity = 0.492 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/clients/attach/input-controller.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/clients/web/web-cmd.jsView file

12// single leaf: `crtr surface web serve`. L13: import { spawn } from 'node:child_process'; L14: import { defineBranch, defineLeaf } from '../../core/command.js';

High

Child Process

Package source references child process execution.

dist/clients/web/web-cmd.jsView on unpkg · L12

Findings

1 Critical6 High5 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/clients/attach/input-controller.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/clients/web/web-cmd.js

HighShelldist/clients/attach/slash-commands.js

HighRuntime Package Installdist/core/self-update.js

HighShips High Entropy Blobdist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2

HighOversized Source Filedist/clients/attach/attach-cmd.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/clients/attach/config-load.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @crouton-kit/crouter@0.3.79.

See all versions of @crouton-kit/crouter for other recorded verdicts.

Review the evidence and your use of @crouton-kit/crouter@0.3.79 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-27 12:45:11.692Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.