Loading npm security reports…

@routerhub/agent-rules@1.5.123: AI-agent control-surface risk | LPM Firewall

registry / @routerhub/agent-rules / 1.5.123

@routerhub/agent-rules@1.5.123

Shared Copilot agent rules and guidelines for RouterHub projects

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Unconsented postinstall changes consumer package-manager settings and writes AI-agent control surfaces. This makes the package's rules and skills automatically active in the host project.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm/pnpm installation

Impact

Consumer project agent behavior and future dependency lifecycle execution are modified.

Mechanism

postinstall-driven AI-agent configuration injection

Policy narrative

On installation, the package appends settings that enable dependency pre/post scripts and disable pnpm's side-effects cache, then launches its merge command in the consumer project. That command writes AGENTS.md, CLAUDE.md, Copilot instruction files, and copied Claude skills, creating an unconsented broad AI-agent control surface.

Rationale

The lifecycle hook performs broad, persistent AI-agent configuration mutation in a consuming project and changes package-manager lifecycle behavior. This meets the install-time foreign/broad control-surface block boundary.

Evidence

package.jsonpostinstall.jsmerge.js.npmrcAGENTS.mdCLAUDE.mdAGENTS.private.md.github/copilot-instructions.md.github/instructions/*.instructions.md.github/PULL_REQUEST_TEMPLATE.md.claude/skills/*

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

21"scripts": { "build": "node --check merge.js && node --check postinstall.js", "test:postinstall-init": "node tests/postinstall-init.test.js", "merge": "node merge.js", "sync": "node merge.js sync", "init": "node merge.js init", "watch": "node merge.js watch", "postinstall": "node postinstall.js" },

High

Suspicious Lifecycle Evidence

npm postinstall runs automatically.

package.jsonView on unpkg · L21

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

merge.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. sole.log(`✅ 规则已合并到 ${outputpath}`); } // 同步 skills syncskills(config); return; } // 2. 读取并解析私有规则的域标记 const privatecontent = readfileifexists(privaterulespath); const privatedomains = parseprivatedomains(privatecontent); // 3. 拼接全局规则内容 const globalcontent = globalrules .map((rule) => rule.content.trim()) .join("\n\n"); // 4. 生成 .github/copilot-instructions.md（全局规则 + 私有全局部分） let copilotcontent = "# copilot agent rules\n\n" + globalcontent; if (privatedomains.global) { copilotcontent += "\n\n---\n\n# 项目私有规则\n\n" + privatedomains.global; } ensureparentdir(copilotoutput); fs.writefilesync(copilotoutput, copilotcontent, "utf-8");

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

merge.jsView on unpkg

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.111 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.111 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 237cac60893b7f35 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @routerhub/agent-rules@1.5.111 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.111 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

97// 执行 init，首次安装时自动补齐 AGENTS.private.md 模板并生成规则输出文件 const syncProcess = spawn("node", [mergeScriptPath, "init"], { cwd: projectRoot, stdio: "inherit", });

High

Ai Review Evidence

Install then writes Copilot, Claude, and AGENTS control files into the consumer project.

postinstall.jsView on unpkg · L97

Source & flagged code

7 flagged

package.jsonView file

Lines 1-46json

1{

2 "name": "@routerhub/agent-rules",

3 "version": "1.5.123",

4 "description": "Shared Copilot agent rules and guidelines for RouterHub projects",

5 "main": "AGENTS.base.md",

6 "bin": {

7 "agent-rules": "merge.js"

8 },

9 "files": [

10 "AGENTS.base.md",

11 "rules/",

12 "skills/",

13 "merge.js",

14 "AGENTS.private.example.md",

15 "PULL_REQUEST_TEMPLATE.md",

16 "README.zh-CN.md",

17 "postinstall.js",

18 "package.json",

19 "CHANGELOG.md"

20 ],

21 "scripts": {

22 "build": "node --check merge.js && node --check postinstall.js",

23 "test:postinstall-init": "node tests/postinstall-init.test.js",

24 "merge": "node merge.js",

25 "sync": "node merge.js sync",

26 "init": "node merge.js init",

27 "watch": "node merge.js watch",

28 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

High

Suspicious Lifecycle Evidence

npm postinstall runs automatically.

package.jsonView on unpkg · L21

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/routerhub/agentRules"

33 },

34 "keywords": [

35 "copilot",

36 "agent",

37 "rules",

38 "guidelines"

39 ],

40 "author": "RouterHub Team",

41 "license": "MIT",

42 "engines": {

43 "node": ">=16.0.0"

44 }

45}

46

merge.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. sole.log(`✅ 规则已合并到 ${outputpath}`); } // 同步 skills syncskills(config); return; } // 2. 读取并解析私有规则的域标记 const privatecontent = readfileifexists(privaterulespath); const privatedomains = parseprivatedomains(privatecontent); // 3. 拼接全局规则内容 const globalcontent = globalrules .map((rule) => rule.content.trim()) .join("\n\n"); // 4. 生成 .github/copilot-instructions.md（全局规则 + 私有全局部分） let copilotcontent = "# copilot agent rules\n\n" + globalcontent; if (privatedomains.global) { copilotcontent += "\n\n---\n\n# 项目私有规则\n\n" + privatedomains.global; } ensureparentdir(copilotoutput); fs.writefilesync(copilotoutput, copilotcontent, "utf-8");

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

merge.jsView on unpkg

postinstall.jsView file

Lines 77-115javascript

77 npmrcEntries.push("# 允许 pnpm install 在依赖版本更新后直接执行（由 agent-rules 自动添加）");

78 npmrcEntries.push("frozen-lockfile=false");

79}

80if (!npmrcContent.includes("enable-pre-post-scripts")) {

81 npmrcEntries.push(