@exla/rudder@3.8.3
A TUI for managing coding agents: run Claude Code, Codex and opencode side by side, each in its own isolated jj workspace.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe cloud-launch path includes saved third-party credentials by default and uploads them to a package-selected cloud endpoint without recipient-specific confirmation. This is concrete credential disclosure; the scanner’s source-similarity label was not used as evidence.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user runs the cloud launch command.
Impact
Saved agent credentials are disclosed to the cloud service and may allow access to the associated accounts.
Mechanism
Snapshot creation includes default home paths containing agent credential files, then sends the archive in a POST request to the configured cloud service, whose default is rudder-cloud-control.fly.dev.
Attack narrative
Running the cloud launch command stages credentials from default paths such as the Claude and Codex home directories. It then uploads the snapshot archive to Rudder Cloud. The inspected launch path does not request separate consent to share those third-party credentials.
AI rationale
The cloud-launch path includes saved third-party credentials by default and uploads them to a package-selected cloud endpoint without recipient-specific confirmation. This is concrete credential disclosure; the scanner’s source-similarity label was not used as evidence.
Evidence
dist/cloud.js
Network endpoints1
rudder-cloud-control.fly.dev
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- A cloud launch creates a snapshot with credentials included by default and no credential-consent check appears in that path.
- The snapshot includes saved Claude and Codex credentials and is sent in a POST request to Rudder Cloud’s default endpoint.
- The quota-check code separately sends a saved Codex token to the intended ChatGPT usage endpoint; this does not account for the cloud snapshot transfer.
Evidence against
- Cloud launch is an explicit product command, and the package describes the cloud workspace as a feature; the inspected launch path does not ask separately before including saved agent credentials.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
21 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg1scripts.postinstall = node scripts/postinstall.mjs
Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution.
L1: import { spawnSync } from "node:child_process";
L2: import { createHash, randomUUID } from "node:crypto";
...
L10: // ~/.rudder/bin/jj/<version>/ and puts that directory on PATH for itself and
L11: // everything it starts: the native dashboard, workers and agents all inherit
L12: // it. A jj the user installed (brew, cargo, a distro package) always wins.
...
L15: // (`git worktree add --orphan`), and stock macOS and Debian 12 ship git 2.39,
L16: // so every isolated agent would fail to start on exactly the machines that have
L17: // nothing installed. 0.40.0 is also what the cloud worker
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L1•scripts.postinstall = node scripts/postinstall.mjs
Findings
17 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/cloud.js
HighUnverified Remote Native Payload Installpackage.json
HighTrigger Reachable Persistencedist/improve/schedule.js
HighSemantic Analysis Limiteddist/improve/collect.js
HighKnown Malware Source Similaritydist/usage.js
HighKnown Malware Source Similaritydist/util.js
HighKnown Malware Source Similaritydist/backends.js
HighKnown Malware Source Similaritydist/board/daemon.js
HighKnown Malware Source Similaritydist/handoff.js
HighKnown Malware Source Similaritydist/run-manager.js
Affected versions and remediation
This report applies to @exla/rudder@3.8.3.
See all versions of @exla/rudder for other recorded verdicts.
- Avoid installing @exla/rudder@3.8.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.