Loading npm security reports…

@routerhub/agent-rules@1.5.149: AI-agent control-surface risk | LPM Firewall

registry / @routerhub/agent-rules / 1.5.149

@routerhub/agent-rules@1.5.149

Shared Copilot agent rules and guidelines for RouterHub projects

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code alters a consuming project's package-manager settings and AI-agent control files. It also installs a review-suppression instruction for its generated artifacts.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Automatic npm postinstall when the package is installed as a dependency.

Impact

Unconsented persistence of package-controlled instructions and skills across Claude Code, Copilot, and compatible agents; future package updates can alter those instructions.

Mechanism

postinstall spawns a project-root rule generator that writes broad AI-agent configuration.

Policy narrative

The manifest automatically runs postinstall. That script locates the consuming project, changes .npmrc to enable dependency lifecycle execution, and spawns merge.js init. The init path writes package-provided instructions into AGENTS.md, CLAUDE.md, Copilot instruction files, and .claude skills without an explicit user command. It also creates a Copilot instruction telling reviewers to skip those generated files, weakening review of the package-controlled control surface.

Rationale

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces, including reviewer-suppression rules. No exfiltration is needed for this concrete control-hijack behavior.

Evidence

package.jsonpostinstall.jsmerge.js.npmrcAGENTS.mdCLAUDE.mdAGENTS.private.md.github/copilot-instructions.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

21"scripts": { "build": "node --check merge.js && node --check postinstall.js", "test:postinstall-init": "node tests/postinstall-init.test.js", "merge": "node merge.js", "sync": "node merge.js sync", "init": "node merge.js init", "watch": "node merge.js watch", "postinstall": "node postinstall.js" },

High

Suspicious Lifecycle Evidence

postinstall runs automatically on dependency installation.

package.jsonView on unpkg · L21

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

merge.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. output, copilotoutput]) { writefileifchanged(outputpath, merged); console.log(`✅ 规则已合并到 ${outputpath}`); } // 同步 skills syncskills(config); return; } // 2. 读取并解析私有规则的域标记 const privatecontent = readfileifexists(privaterulespath); const privatedomains = parseprivatedomains(privatecontent); // 3. 拼接全局规则内容 const globalcontent = globalrules .map((rule) => rule.content.trim()) .join("\n\n"); // 4. 生成 .github/copilot-instructions.md（全局规则 + 私有全局部分） let copilotcontent = "# copilot agent rules\n\n" + globalcontent; if (privatedomains.global) { copilotcontent += "\n\n---\n\n# 项目私有规则\n\n" + privatedomains.global; } writefilei

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

merge.jsView on unpkg

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.145 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.145 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

80if (!npm[redacted]("enable-pre-post-scripts")) { npm[redacted]("# 确保依赖包的 postinstall 生命周期脚本始终执行（由 agent-rules 自动添加）"); npm[redacted]("enable-pre-post-scripts=true"); }

High

Suspicious Lifecycle Evidence

It changes the consuming project's .npmrc to enable dependency lifecycle scripts.

postinstall.jsView on unpkg · L80

skills/screenshot-annotate/annotate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @routerhub/agent-rules@1.5.146 matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.146 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/screenshot-annotate/annotate.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-46json

1{

2 "name": "@routerhub/agent-rules",

3 "version": "1.5.149",

4 "description": "Shared Copilot agent rules and guidelines for RouterHub projects",

5 "main": "AGENTS.base.md",

6 "bin": {

7 "agent-rules": "merge.js"

8 },

9 "files": [

10 "AGENTS.base.md",

11 "rules/",

12 "skills/",

13 "merge.js",

14 "AGENTS.private.example.md",

15 "PULL_REQUEST_TEMPLATE.md",

16 "README.zh-CN.md",

17 "postinstall.js",

18 "package.json",

19 "CHANGELOG.md"

20 ],

21 "scripts": {

22 "build": "node --check merge.js && node --check postinstall.js",

23 "test:postinstall-init": "node tests/postinstall-init.test.js",

24 "merge": "node merge.js",

25 "sync": "node merge.js sync",

26 "init": "node merge.js init",

27 "watch": "node merge.js watch",

28 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

High

Suspicious Lifecycle Evidence

postinstall runs automatically on dependency installation.

package.jsonView on unpkg · L21

30 "repository": {

31 "type": "git",

32 "url": "git+https://github.com/PomexAITeam/agent-rules.git"

33 },

34 "keywords": [

35 "copilot",

36 "agent",

37 "rules",

38 "guidelines"

39 ],

40 "author": "RouterHub Team",

41 "license": "MIT",

42 "engines": {

43 "node": ">=16.0.0"

44 }

45}

46

merge.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. output, copilotoutput]) { writefileifchanged(outputpath, merged); console.log(`✅ 规则已合并到 ${outputpath}`); } // 同步 skills syncskills(config); return; } // 2. 读取并解析私有规则的域标记 const privatecontent = readfileifexists(privaterulespath); const privatedomains = parseprivatedomains(privatecontent); // 3. 拼接全局规则内容 const globalcontent = globalrules .map((rule) => rule.content.trim()) .join("\n\n"); // 4. 生成 .github/copilot-instructions.md（全局规则 + 私有全局部分） let copilotcontent = "# copilot agent rules\n\n" + globalcontent; if (privatedomains.global) { copilotcontent += "\n\n---\n\n# 项目私有规则\n\n" + privatedomains.global; } writefilei

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

merge.jsView on unpkg

postinstall.jsView file

Lines 60-100javascript

60}

61

62// 确保下游项目 .npmrc 中关闭 frozen-lockfile + 启用依赖 pre/post 脚本 + 关闭副作用缓存

63// frozen-lockfile=false：让 pnpm install 能在版本更新后直接执行

64// enable-pre-post-scripts=true：让 pnpm 始终执行依赖包的 postinstall 生命周期脚本，

65// 否则 pnpm 默认不会运行依赖的 postinstall，导致 agent-rules 更新后规则文件不刷新

66// side-effects-cache=false：pnpm 会按包内容哈希跨项目缓存"是否已执行过构建脚本"，

67// 一旦同一版本在本机任意项目装过一次，其他新项目直接装/更新该版本会被静默跳过 postinstall，

68// 而 agent-rules 的 postinstall 恰恰是往下游项目根目录写文件（不是往自身 node_modules 写副作用），

69// 关闭该缓存让 pnpm 每次都真正重新执行脚本

70

skills/screenshot-annotate/annotate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @routerhub/agent-rules@1.5.146 matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.146 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/screenshot-annotate/annotate.jsView on unpkg