@exla/rudder@3.5.4
A TUI for managing coding agents: run Claude Code, Codex and opencode side by side, each in its own isolated jj workspace.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe cloud attach path automatically transfers saved third-party credentials to the package’s default cloud recipient unless a vault is active. This is concrete credential disclosure without a separate recipient-specific consent gate, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user runs `rudder cloud` and the workspace attach flow needs to upload a snapshot.
Impact
Saved credentials for other services may be disclosed to the configured Rudder Cloud control plane.
Mechanism
The snapshot includes default credential paths unless credentials are explicitly disabled. The cloud flow enables inclusion when no vault is active, encodes the archive in the request body, and posts it to the cloud attach endpoint.
Attack narrative
When a cloud workspace snapshot is needed, the package includes saved agent credentials by default unless a cloud vault is active. It sends that archive to the configured Rudder Cloud endpoint without a separate affirmative prompt to share those credentials. The user’s request to open a cloud workspace does not establish recipient-specific consent to export saved credentials.
AI rationale
The cloud attach path automatically transfers saved third-party credentials to the package’s default cloud recipient unless a vault is active. This is concrete credential disclosure without a separate recipient-specific consent gate, so the package should be blocked.
Evidence
dist/cloud.js~/.claude/.credentials.json~/.codex/auth.json
Network endpoints1
rudder-cloud-control.fly.dev
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default snapshot paths include Claude credentials and Codex authentication data, and path normalization always includes those defaults.
- Snapshot creation includes credentials unless explicitly disabled; the cloud attach flow enables them whenever no cloud vault is active and sends the archive in a POST request.
- Running `rudder cloud` opens the cloud workspace and reaches this attach flow without a separate credential-sharing confirmation.
- The request resolves against the configured cloud URL, which defaults to rudder-cloud-control.fly.dev, and sends the request body there.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
21 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg1scripts.postinstall = node scripts/postinstall.mjs
Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution.
L1: import { spawnSync } from "node:child_process";
L2: import { createHash, randomUUID } from "node:crypto";
...
L10: // ~/.rudder/bin/jj/<version>/ and puts that directory on PATH for itself and
L11: // everything it starts: the native dashboard, workers and agents all inherit
L12: // it. A jj the user installed (brew, cargo, a distro package) always wins.
...
L15: // (`git worktree add --orphan`), and stock macOS and Debian 12 ship git 2.39,
L16: // so every isolated agent would fail to start on exactly the machines that have
L17: // nothing installed. 0.40.0 is also what the cloud worker
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L1•scripts.postinstall = node scripts/postinstall.mjs
Findings
17 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/cloud.js
HighUnverified Remote Native Payload Installpackage.json
HighTrigger Reachable Persistencedist/improve/schedule.js
HighSemantic Analysis Limiteddist/improve/collect.js
HighKnown Malware Source Similaritydist/cloud.js
HighKnown Malware Source Similaritydist/usage.js
HighKnown Malware Source Similaritydist/util.js
HighKnown Malware Source Similaritydist/backends.js
HighKnown Malware Source Similaritydist/board/daemon.js
HighKnown Malware Source Similaritydist/handoff.js
Affected versions and remediation
This report applies to @exla/rudder@3.5.4.
See all versions of @exla/rudder for other recorded verdicts.
- Avoid installing @exla/rudder@3.5.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.