Loading npm security reports…
Shared Copilot agent rules and guidelines for RouterHub projects
LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall script that changes the consumer .npmrc and writes broad coding-agent instruction files into the project. Those files are the control surface for Cursor, Claude Code, and GitHub Copilot.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgnpm install runs postinstall.js through the package postinstall lifecycle script.
package.jsonView on unpkg · L28Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
postinstall.jsView on unpkgThat script appends frozen-lockfile=false, enable-pre-post-scripts=true, and side-effects-cache=false to the consumer project .npmrc.
postinstall.jsView on unpkg · L76That script appends frozen-lockfile=false, enable-pre-post-scripts=true, and side-effects-cache=false to the consumer project .npmrc.
postinstall.jsView on unpkg · L80That script appends frozen-lockfile=false, enable-pre-post-scripts=true, and side-effects-cache=false to the consumer project .npmrc.
postinstall.jsView on unpkg · L88This report applies to @routerhub/agent-rules@1.5.147.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L28Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L28npm install runs postinstall.js through the package postinstall lifecycle script.
package.jsonView on unpkg · L28That script appends frozen-lockfile=false, enable-pre-post-scripts=true, and side-effects-cache=false to the consumer project .npmrc.
postinstall.jsView on unpkg · L76That script appends frozen-lockfile=false, enable-pre-post-scripts=true, and side-effects-cache=false to the consumer project .npmrc.
postinstall.jsView on unpkg · L80That script appends frozen-lockfile=false, enable-pre-post-scripts=true, and side-effects-cache=false to the consumer project .npmrc.
postinstall.jsView on unpkg · L88Source file is highly similar to a previously finalized malicious package; route for source-aware review.
postinstall.jsView on unpkg