Loading npm security reports…
Shared Copilot agent rules and guidelines for RouterHub projects
LPM flags this version as an AI-agent control-surface risk. On npm install, postinstall.js mutates the consumer project's .npmrc so package lifecycle scripts keep running, then writes broad agent instruction files and Claude skills into the project root.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json registers a postinstall script that runs node postinstall.js on every install.
package.jsonView on unpkg · L28Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage ships non-JavaScript build or shell helper files.
skills/loop-review/scripts/check-review.shView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
postinstall.jsView on unpkgpostinstall.js locates the consumer project root and appends .npmrc settings including enable-pre-post-scripts=true, side-effects-cache=false, and frozen-lockfile=false when those keys are absent.
postinstall.jsView on unpkg · L82This report applies to @routerhub/agent-rules@1.5.151.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L28Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L28package.json registers a postinstall script that runs node postinstall.js on every install.
package.jsonView on unpkg · L28Package ships non-JavaScript build or shell helper files.
skills/loop-review/scripts/check-review.shView on unpkgpostinstall.js locates the consumer project root and appends .npmrc settings including enable-pre-post-scripts=true, side-effects-cache=false, and frozen-lockfile=false when those keys are absent.
postinstall.jsView on unpkg · L82Source file is highly similar to a previously finalized malicious package; route for source-aware review.
postinstall.jsView on unpkg