Loading npm security reports…

@routerhub/agent-rules@1.5.145: AI-agent control-surface risk | LPM Firewall

registry / @routerhub/agent-rules / 1.5.145

@routerhub/agent-rules@1.5.145

Shared Copilot agent rules and guidelines for RouterHub projects

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code mutates the consuming project's package-manager and broad AI-agent control files without an explicit user command. It also installs instructions that suppress review of its generated artifacts.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm lifecycle postinstall

Impact

Changes agent behavior across the consuming project and makes generated control files less likely to be reviewed.

Mechanism

project-root AI-agent configuration injection and lifecycle-policy mutation

Policy narrative

On installation, postinstall locates the consuming project, changes .npmrc to ensure lifecycle execution, and starts bundled initialization there. The initializer writes AGENTS.md, CLAUDE.md, Copilot instructions, and Claude skills, then adds an instruction directing code review to skip these generated files. This is unconsented install-time mutation of broad AI-agent control surfaces.

Rationale

The package has no observed exfiltration, but its automatic postinstall changes consuming-project lifecycle policy and injects broad agent instructions plus review-suppression rules. This meets the blocking policy for unconsented install-time mutation of a foreign/broad AI-agent control surface.

Evidence

package.jsonpostinstall.jsmerge.js.npmrcAGENTS.mdCLAUDE.md.github/copilot-instructions.md.github/instructions/.claude/skills/

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

28"postinstall": "node postinstall.js"

High

Suspicious Lifecycle Evidence

package.json registers an automatic postinstall hook.

package.jsonView on unpkg · L28

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

merge.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. output, copilotoutput]) { writefileifchanged(outputpath, merged); console.log(`✅ 规则已合并到 ${outputpath}`); } // 同步 skills syncskills(config); return; } // 2. 读取并解析私有规则的域标记 const privatecontent = readfileifexists(privaterulespath); const privatedomains = parseprivatedomains(privatecontent); // 3. 拼接全局规则内容 const globalcontent = globalrules .map((rule) => rule.content.trim()) .join("\n\n"); // 4. 生成 .github/copilot-instructions.md（全局规则 + 私有全局部分） let copilotcontent = "# copilot agent rules\n\n" + globalcontent; if (privatedomains.global) { copilotcontent += "\n\n---\n\n# 项目私有规则\n\n" + privatedomains.global; } writefilei

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

merge.jsView on unpkg

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.131 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.131 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

88if (npm[redacted] > 0) { const newEntry = "\n" + npm[redacted]("\n") + "\n"; fs.appendFileSync(npmrcPath, newEntry);

High

Suspicious Lifecycle Evidence

postinstall appends lifecycle and cache settings to the consuming project's .npmrc.

postinstall.jsView on unpkg · L88

98const syncProcess = spawn("node", [mergeScriptPath, "init"], { cwd: projectRoot, stdio: "inherit", });

High

Suspicious Lifecycle Evidence

postinstall runs merge initialization in the consuming project root.

postinstall.jsView on unpkg · L98

Source & flagged code

7 flagged

package.jsonView file

Lines 8-46json

8 },

9 "files": [

10 "AGENTS.base.md",

11 "rules/",

12 "skills/",

13 "merge.js",

14 "AGENTS.private.example.md",

15 "PULL_REQUEST_TEMPLATE.md",

16 "README.zh-CN.md",

17 "postinstall.js",

18 "package.json",

19 "CHANGELOG.md"

20 ],

21 "scripts": {

22 "build": "node --check merge.js && node --check postinstall.js",

23 "test:postinstall-init": "node tests/postinstall-init.test.js",

24 "merge": "node merge.js",

25 "sync": "node merge.js sync",

26 "init": "node merge.js init",

27 "watch": "node merge.js watch",

28 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

High

Suspicious Lifecycle Evidence

package.json registers an automatic postinstall hook.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "repository": {

31 "type": "git",

32 "url": "git+https://github.com/PomexAITeam/agent-rules.git"

33 },

34 "keywords": [

35 "copilot",

36 "agent",

37 "rules",

38 "guidelines"

39 ],

40 "author": "RouterHub Team",

41 "license": "MIT",

42 "engines": {

43 "node": ">=16.0.0"

44 }

45}

46

merge.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. output, copilotoutput]) { writefileifchanged(outputpath, merged); console.log(`✅ 规则已合并到 ${outputpath}`); } // 同步 skills syncskills(config); return; } // 2. 读取并解析私有规则的域标记 const privatecontent = readfileifexists(privaterulespath); const privatedomains = parseprivatedomains(privatecontent); // 3. 拼接全局规则内容 const globalcontent = globalrules .map((rule) => rule.content.trim()) .join("\n\n"); // 4. 生成 .github/copilot-instructions.md（全局规则 + 私有全局部分） let copilotcontent = "# copilot agent rules\n\n" + globalcontent; if (privatedomains.global) { copilotcontent += "\n\n---\n\n# 项目私有规则\n\n" + privatedomains.global; } writefilei

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

merge.jsView on unpkg

postinstall.jsView file

Lines 68-115javascript

68// 而 agent-rules 的 postinstall 恰恰是往下游项目根目录写文件（不是往自身 node_modules 写副作用），

69// 关闭该缓存让 pnpm 每次都真正重新执行脚本

70const npmrcPath = path.join(projectRoot, ".npmrc");

71let npmrcContent = "";

72if (fs.existsSync(npmrcPath)) {