Loading npm security reports…

@north-light/crouter@0.3.322: AI-agent control-surface risk | LPM Firewall

registry / @north-light/crouter / 0.3.322

@north-light/crouter@0.3.322

crtr — agent runtime with memory, plugins, and marketplaces

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall hook modifies a file inside the separately published Pi coding-agent dependency. This is an unconsented install-time mutation of a foreign AI-agent control surface.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm triggers postinstall.

Impact

The installed Pi coding agent's interactive tree-selection behavior is altered without an explicit user command.

Mechanism

The hook calls a patcher that replaces the dependency's root-ordering source and renames the replacement into place.

Policy narrative

On installation, npm runs the package's postinstall hook. Before checking for CI, that hook invokes a patcher which locates @earendil-works/pi-coding-agent and replaces its interactive tree-selector source. The replacement changes root ordering in an external AI-agent dependency, so the package mutates another agent's control behavior automatically in the consumer environment.

AI rationale

The automatic lifecycle hook performs a concrete source rewrite of a foreign AI-agent dependency. Under the install-control-surface policy, that unconsented postinstall mutation is block-eligible.

Evidence

package.jsonscripts/postinstall.mjsscripts/patch-pi-tree-root-ordering.mjsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/tree-selector.js

Decision evidence

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/runtime-selector.mjsView file

1import { spawnSync } from 'node:child_process'; L2: import { existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/runtime-selector.mjsView on unpkg · L1

58try { L59: const mod = await import(pathToFileURL(join(dirname(entryPath), 'core', 'termrender', 'termrender.js')).href); L60: if (mod.isRendererReady()) return;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/runtime-selector.mjsView on unpkg · L58

dist/core/runtime/stamp/channel.jsView file

1var m=Object.defineProperty;var o=(n,t)=>m(n,"name",{value:t,configurable:!0});import{createHash as f}from"node:crypto";const i=Symbol.for("@crouton-kit/crtr:stamp-channel"),g=16;f...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/runtime/stamp/channel.jsView on unpkg · L1

dist/commands/sys/feedback.jsView file

1var h=Object.defineProperty;var a=(r,e)=>h(r,"name",{value:e,configurable:!0});import{spawnSync as y}from"node:child_process";import{mkdirSync as g,writeFileSync as w}from"node:fs"... L2: `)[0].trim();return`[feedback] ${n.length>80?n.slice(0,79)+"\u2026":n}`}a(L,"deriveTitle");function j(r,e){const t=[`| crtr version | \`${e.version}\` |`,`| platform | ${e.platform... L3: `)+` L4: `}a(j,"buildBody");async function q(r,e,t,n,o){const s=process.env[R];try{const i=await fetch(r,{method:"POST",headers:{"content-type":"application/json",...s!==void 0&&s!==""?{aut... L5: `).filter(o=>o.startsWith("http")).pop()??t.stdout.trim()}:{error:t.error!==void 0?`gh not available: ${t.error.message}`:t.stderr?.trim()||`gh exited ${t.status}`}}a(F,"deliverToG...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/sys/feedback.jsView on unpkg · L1

dist/hook-authoring.jsView file

1var B=Object.defineProperty;var o=(e,r)=>B(e,"name",{value:r,configurable:!0});import{spawn as R}from"node:child_process";import{Console as T}from"node:console";import{posixProcess... L2: `),c=d("hook_handler_failed",`handler failed for ${f.value.op}`)}const a=I(c,f.value);a.valid||(i.write(`hook handler ${f.value.op} returned an invalid response: ${a.message} L3: `),c=d("invalid_hook_response",a.message))}catch(m){i.write(`hook executable failed: ${b(m)} L4: `),c=d("hook_executable_failed","hook executable could not read its request")}_(s,c)}o(X,"runHookExecutable");async function Y(e,r){const t=e[0];return t===void 0||t===""?d("local_... L5: `)}o(_,"writeResponse");async function D(e){const r=[];for await(const t of e)r.push(Buffer.isBuffer(t)?t:Buffer.from(t));return Buffer.concat(r

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hook-authoring.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/hook-authoring.js L1: var B=Object.defineProperty;var o=(e,r)=>B(e,"name",{value:r,configurable:!0});import{spawn as R}from"node:child_process";import{Console as T}from"node:console";import{posixProcess... L2: `),c=d("hook_handler_failed",`handler failed for ${f.value.op}`)}const a=I(c,f.value);a.valid||(i.write(`hook handler ${f.value.op} returned an invalid response: ${a.message} L3: `),c=d("invalid_hook_response",a.message))}catch(m){i.write(`hook executable failed: ${b(m)} L4: `),c=d("hook_executable_failed","hook executable could not read its request")}_(s,c)}o(X,"runHookExecutable");async function Y(e,r){const t=e[0];return t===void 0||t===""?d("local_... L5: `)}o(_,"writeResponse");async func

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/hook-authoring.js

dist/core/runtime/nerd-font.jsView file

1var u=Object.defineProperty;var e=(t,n)=>u(t,"name",{value:n,configurable:!0});import{spawnSync as i}from"node:child_process";import{readdirSync as c}from"node:fs";import{homedir a... L2: `))if(f.test(o))return o.split(",")[0].trim();return""}e(y,"queryFontconfig");function S(t=process.platform,n=d()){if(t!=="darwin"){const o=y();if(o!==null&&o!=="")return{installed...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/runtime/nerd-font.jsView on unpkg · L1

dist/clients/attach/photon_rs_bg.wasmView file

•path = dist/clients/attach/photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/clients/attach/photon_rs_bg.wasmView on unpkg

dist/clients/attach/viewer.jsView file

•path = dist/clients/attach/viewer.js kind = oversized_source_file sizeBytes = 9683130 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/clients/attach/viewer.jsView on unpkg

bin/runtime-selector.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/runtime-selector.mjs#virtual:normalized:round1View on unpkg

bin/runtime-generation-manifest.mjsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.154 matchedPath = bin/runtime-generation-manifest.mjs matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.154 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-generation-manifest.mjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 69-109json

69 "scripts/patch-pi-tree-root-ordering.mjs",

70 "scripts/install-runtime.mjs",

71 "scripts/pack-minify.mjs",

72 "scripts/runtime-lock.mjs",

73 "scripts/self-update.mjs",

74 "runtime.lock.json"

75 ],

76 "scripts": {

77 "build": "node scripts/build.mjs",

78 "activate": "npm run build && npm run install-runtime && crtr sys daemon restart",

79 "activate:pull": "git pull && npm install && npm run activate",

80 "build:api": "tsc -p packages/crouter-api/tsconfig.json",

81 "build:env-docker": "tsc -p packages/crouter-env-docker/tsconfig.json",

82 "build:sdk": "tsc -p packages/crouter-sdk/tsconfig.json",

83 "typecheck:pi-packages": "npx tsc -p src/builtin-pi-packages/pi-crtr-extensions/tsconfig.json",

84 "test:build-output": "node scripts/build-concurrency-test.mjs",

85 "check:cli-no-canvas": "node scripts/check-cli-no-canvas.mjs",

86 "check:cli-cold-start": "node scripts/check-cli-cold-start.mjs",

87 "check:daemon-no-barrel": "node scripts/check-daemon-no-barrel.mjs",

88 "check:quote-style": "node scripts/check-quote-style.mjs",

89 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L89

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L89

90 "install-runtime": "node scripts/install-runtime.mjs",

91 "prepack": "node scripts/runtime-lock.mjs prepack && node scripts/pack-minify.mjs prepack",

92 "postpack": "node scripts/pack-minify.mjs postpack && node scripts/runtime-lock.mjs postpack",

93 "dev": "tsx --conditions=crtr-src src/cli.ts",

94 "link": "npm link",

95 "prepublishOnly": "npm run build",

96 "test": "CRTR_NO_DAEMON_AUTOSTART=1 node --conditions=crtr-src --import tsx/esm --import ./scripts/test-env-scrub.mjs --test --test-force-exit --test-concurrency=$(node -p 'Math.max(4, require(`node:os`).availableParallelism() - 1)') --test-timeout=10000 'src/**/__tests__/*.test.ts'",

97 "test:integration": "npm run build:api && CRTR_NO_DAEMON_AUTOSTART=1 node --conditions=crtr-src --import tsx/esm --import ./scripts/test-env-scrub.mjs --test --test-concurrency=$(node -p 'Math.min(8, Math.max(2, require(`node:os`).availableParallelism() - 1))') --test-timeout=60000 'src/**/__tests__/integration/*.test.ts' 'packages/crouter-sdk/src/**/__tests__/integration/*.test.ts'",

98 "test:seam": "npm run build && npm run test:seam:built",

99 "test:seam:built": "CRTR_NO_DAEMON_AUTOSTART=1 node --import ./scripts/test-env-scrub.mjs --test --test-concurrency=$(node -p 'Math.min(4, Math.max(2, require(`node:os`).availableParallelism() - 2))') --test-timeout=180000 'dist/**/__tests__/seam/*.test.js'",

100 "test:all": "npm test && npm run test:integration && npm run test:seam"

101 },

102 "overrides": {

103 "@earendil-works/pi-ai": "0.85.1",

104 "@earendil-works/pi-agent-core": "0.85.1",

105 "@earendil-works/pi-tui": "0.85.1"

106 },

107 "repository": {

108 "type": "git",

109 "url": "git+https://github.com/vallum-security/crouter.git"

bin/runtime-selector.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/runtime-selector.mjsView on unpkg · L1

3import { homedir } from 'node:os';

dist/core/runtime/stamp/channel.jsView file

Lines 1-2javascript

1var m=Object.defineProperty;var o=(n,t)=>m(n,"name",{value:t,configurable:!0});import{createHash as f}from"node:crypto";

dist/commands/sys/feedback.jsView file

Lines 1-8javascript

1var h=Object.defineProperty;var a=(r,e)=>h(r,"name",{value:e,configurable:!0});import{spawnSync as y}from"node:child_process";

dist/hook-authoring.jsView file

Lines 1-6javascript

1var B=Object.defineProperty;var o=(e,r)=>B(e,"name",{value:r,configurable:!0});import{spawn as R}from"node:child_process";

dist/core/runtime/nerd-font.jsView file

Lines 1-3javascript

1var u=Object.defineProperty;var e=(t,n)=>u(t,"name",{value:n,configurable:!0});import{spawnSync as i}from"node:child_process";

dist/clients/attach/photon_rs_bg.wasmView file

•path = dist/clients/attach/photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/clients/attach/photon_rs_bg.wasmView on unpkg

dist/clients/attach/viewer.jsView file

•path = dist/clients/attach/viewer.js kind = oversized_source_file sizeBytes = 9683130 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/clients/attach/viewer.jsView on unpkg

bin/runtime-selector.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/runtime-selector.mjs#virtual:normalized:round1View on unpkg

bin/runtime-generation-manifest.mjsView file

•matchType = normalized_sha256 matchedPackage = @crouton-kit/crouter@0.3.154 matchedPath = bin/runtime-generation-manifest.mjs matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.154 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-generation-manifest.mjsView on unpkg

Lines 38-78javascript

38 * Only the missing-selection case qualifies. A selection that exists but

39 * fails validation is a real defect to report, not something to paper over,

40 * and a source checkout keeps its explicit `npm run install-runtime` because

41 * its `dist/` may be stale or absent.

42 */

43function installFirstGeneration(command) {

44 if (isSourceCheckout() || !existsSync(join(PACKAGE_ROOT, 'dist', 'index.js'))) return false;

45 process.stderr.write(`${command}: first run — installing the runtime generation (one-time)\n`);

46 const result = spawnSync(process.execPath, [join(PACKAGE_ROOT, 'scripts', 'install-runtime.mjs'), PACKAGE_ROOT], { cwd: PACKAGE_ROOT, stdio: 'inherit' });

47 return result.status === 0;

48}

49

50/**

51 * The other half of what postinstall did: provision the pinned termrender

52 * venv, from the generation that was just selected so the code that renders

53 * is the code that provisioned. Best-effort, exactly as postinstall was — a

54 * renderer that will not provision (no `uv`, no network) is reported and the

55 * command still runs; every render path re-attempts on first use.

56 */

57async function provisionFirstRenderer(command, entryPath) {

58 try {

59 const mod = await import(pathToFileURL(join(dirname(entryPath), 'core', 'termrender', 'termrender.js')).href);

60 if (mod.isRendererReady()) return;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/runtime-selector.mjsView on unpkg · L58

61 process.stderr.write(`${command}: first run — provisioning the markdown renderer (one-time)\n`);

62 mod.ensureRenderer();

63 if (!mod.isRendererReady()) process.stderr.write(`${command}: renderer not provisioned; it will be retried on first render.\n`);

64 } catch (error) {

65 process.stderr.write(`${command}: renderer provisioning skipped: ${errorMessage(error)}\n`);

66 }

67}

68

69function fail(command, detail) {

70 process.stderr.write(`${command}: invalid runtime selection: ${detail}\n${remediation()}\n`);

71 process.exitCode = 1;

72 return null;

73}

74

75function errorMessage(error) {

76 return error instanceof Error ? error.message : String(error);

77}

78