@exla/rudder@3.5.0
A TUI for managing coding agents: run Claude Code, Codex and opencode side by side, each in its own isolated jj workspace.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe runtime launch path copies saved third-party credentials into a snapshot and sends it to the package’s default cloud endpoint without recipient-specific consent. This is concrete credential disclosure, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the cloud launch command, which invokes the snapshot and upload flow.
Impact
Rudder’s cloud service receives saved third-party service credentials that may enable access to those accounts.
Mechanism
The package copies default home paths into a snapshot, encodes the archive, and sends it in a cloud launch request.
Attack narrative
Running the cloud launch command causes the package to include saved Claude and Codex authentication files in a snapshot by default. It uploads that archive to Rudder’s cloud control plane without a recipient-specific confirmation, exposing those credentials to the service.
AI rationale
The runtime launch path copies saved third-party credentials into a snapshot and sends it to the package’s default cloud endpoint without recipient-specific consent. This is concrete credential disclosure, so the package should be blocked.
Evidence
dist/cloud.js~/.claude/.credentials.json~/.codex/auth.json
Network endpoints1
rudder-cloud-control.fly.dev
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default cloud snapshot paths include Claude credentials and Codex authentication data, and the path normalizer always adds those defaults.
- Snapshot creation includes credentials unless explicitly disabled and copies the normalized home paths.
- The cloud launch command creates that snapshot and posts its archive as a base64 payload, without a recipient-specific confirmation in that flow.
- The package defaults to Rudder’s cloud control plane and resolves the launch request against that endpoint.
Evidence against
- The transfer is triggered by a user-requested cloud launch, but that action does not specifically authorize sending saved third-party service credentials to Rudder’s server.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
21 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg1scripts.postinstall = node scripts/postinstall.mjs
Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution.
L1: import { spawnSync } from "node:child_process";
L2: import { createHash, randomUUID } from "node:crypto";
...
L10: // ~/.rudder/bin/jj/<version>/ and puts that directory on PATH for itself and
L11: // everything it starts: the native dashboard, workers and agents all inherit
L12: // it. A jj the user installed (brew, cargo, a distro package) always wins.
...
L15: // (`git worktree add --orphan`), and stock macOS and Debian 12 ship git 2.39,
L16: // so every isolated agent would fail to start on exactly the machines that have
L17: // nothing installed. 0.40.0 is also what the cloud worker
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L1•scripts.postinstall = node scripts/postinstall.mjs
Findings
17 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/cloud.js
HighUnverified Remote Native Payload Installpackage.json
HighTrigger Reachable Persistencedist/improve/schedule.js
HighSemantic Analysis Limiteddist/improve/collect.js
HighKnown Malware Source Similaritydist/usage.js
HighKnown Malware Source Similaritydist/util.js
HighKnown Malware Source Similaritydist/backends.js
HighKnown Malware Source Similaritydist/board/daemon.js
HighKnown Malware Source Similaritydist/handoff.js
HighKnown Malware Source Similaritydist/run-manager.js
Affected versions and remediation
This report applies to @exla/rudder@3.5.0.
See all versions of @exla/rudder for other recorded verdicts.
- Avoid installing @exla/rudder@3.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.