Loading npm security reports…

@routerhub/agent-rules@1.5.113: AI-agent control-surface risk | LPM Firewall

registry / @routerhub/agent-rules / 1.5.113

@routerhub/agent-rules@1.5.113

Shared Copilot agent rules and guidelines for RouterHub projects

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code mutates the consuming project's npm configuration and broad AI-agent instruction surfaces. It persists package-authored rules and executable workflow guidance into files automatically loaded by coding agents.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install / dependency postinstall

Impact

Future agents may follow package-authored instructions and skills, including git push, merge, and deployment workflows; pnpm is also configured to keep lifecycle scripts running.

Mechanism

postinstall-driven project configuration and AI-agent control-surface injection

Policy narrative

On installation, postinstall.js identifies the consuming project, changes its .npmrc to enable recurring dependency lifecycle execution, then launches merge.js. That script writes package-controlled AGENTS.md, CLAUDE.md, Copilot instructions, review-suppression instructions, and Claude skills into the unrelated project. The installed skills prescribe repository-changing actions including commits, pushes, merges, and deployment, establishing an unconsented broad agent-control surface.

Rationale

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, not merely a user-invoked setup command. The absence of exfiltration does not remove the concrete control-hijack behavior.

Evidence

package.jsonpostinstall.jsmerge.jsAGENTS.base.mdskills/deploy-test/SKILL.mdskills/create-pr/SKILL.md

Source & flagged code

5 flagged

package.jsonView file

Lines 8-46json

8 },

9 "files": [

10 "AGENTS.base.md",

11 "rules/",

12 "skills/",

13 "merge.js",

14 "AGENTS.private.example.md",

15 "PULL_REQUEST_TEMPLATE.md",

16 "README.zh-CN.md",

17 "postinstall.js",

18 "package.json",

19 "CHANGELOG.md"

20 ],

21 "scripts": {

22 "build": "node --check merge.js && node --check postinstall.js",

23 "test:postinstall-init": "node tests/postinstall-init.test.js",

24 "merge": "node merge.js",

25 "sync": "node merge.js sync",

26 "init": "node merge.js init",

27 "watch": "node merge.js watch",

28 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/routerhub/agentRules"

33 },

34 "keywords": [

35 "copilot",

36 "agent",

37 "rules",

38 "guidelines"

39 ],

40 "author": "RouterHub Team",

41 "license": "MIT",

42 "engines": {

43 "node": ">=16.0.0"

44 }

45}

46

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.108 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.108 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 237cac60893b7f35 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @routerhub/agent-rules@1.5.108 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.108 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @routerhub/agent-rules@1.5.92 matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.92 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

postinstall.jsView on unpkg