Loading npm security reports…

@routerhub/agent-rules@1.5.211: Malicious npm security report | LPM Firewall

registry / @routerhub/agent-rules / 1.5.211

@routerhub/agent-rules@1.5.211

Shared Copilot agent rules and guidelines for RouterHub projects

AI Security Review

scanned 27d ago · by lpm-firewall-ai

On npm installation, the package mutates consumer-project configuration and writes Copilot and Claude agent-control files. It also installs a rule that excludes its generated files from Copilot code review and distributes instructions to include real secrets in documentation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package runs its postinstall hook.

Impact

It can weaken review coverage and cause future AI-assisted work to copy sensitive values into project documents.

Mechanism

Lifecycle-driven mutation of project configuration and AI-agent instruction surfaces.

Attack narrative

Installing the package invokes postinstall, which changes the consumer project's pnpm behavior and runs the merger. The merger writes Copilot instructions and copies skills into Claude's project control directory. One generated instruction directs Copilot review to skip all matching generated agent-rule files, while packaged rules require real tokens and keys in documentation. This is an unconsented, broad AI-agent control-surface mutation that suppresses review and increases secret-exposure risk.

AI rationale

The automatic lifecycle hook changes consumer-project package-manager settings and installs AI-agent instructions that suppress review and encourage secret disclosure. These concrete behaviors exceed transparent, package-owned setup and establish malicious install-hook abuse.

Evidence

package.jsonpostinstall.jsmerge.jsAGENTS.base.md.npmrc.github/copilot-instructions.md.github/instructions/no-review-docs.instructions.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

merge.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t; if (privatecontent) { copilotcontent += "\n\n---\n\n# 项目私有规则\n\n以下规则仅适用于本项目，会覆盖基础规则中的相同部分。\n\n" + privatecontent.trim(); } writefileifchanged(copilotoutput, copilotcontent); console.log(`✅ 全局规则已生成(含完整私有规则): ${copilotoutput}`); // 5. 生成 .github/instructions/*.instructions.md（各域规则） ensureparentdir(path.join(instructionsdir, "_placeholder")); for (const rule of domainrules) { let domaincontent = rule.content.trim(); // 追加对应域的私有规则 const privatedomaincontent = privatedomains.domains[rule.meta.outputname]; if (privatedomaincontent) { domaincontent += "\n\n---\n\n# 项目私有规则（" + rule.meta.name + "）\n\n" +

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

merge.jsView on unpkg

scripts/agent-browser-cleanup.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/agent-browser-cleanup.shView on unpkg

•path = scripts/agent-browser-cleanup.sh kind = build_helper sizeBytes = 4442 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser-cleanup.shView on unpkg

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.210 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.210 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 04502cf46d030d6a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @routerhub/agent-rules@1.5.210 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.210 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

skills/screenshot-annotate/annotate.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.210 matchedPath = skills/screenshot-annotate/annotate.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.210 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/screenshot-annotate/annotate.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 10-48json

10 "files": [

11 "AGENTS.base.md",

12 "rules/",

13 "skills/",

14 "scripts/agent-browser-cleanup.sh",

15 "merge.js",

16 "AGENTS.private.example.md",

17 "PULL_REQUEST_TEMPLATE.md",

18 "postinstall.js",

19 "package.json",

20 "CHANGELOG.md",

21 "enabled-users.json"

22 ],

23 "scripts": {

24 "build": "node --check merge.js && node --check postinstall.js",

25 "test:postinstall-init": "node tests/postinstall-init.test.js",

26 "merge": "node merge.js",

27 "sync": "node merge.js sync",

28 "init": "node merge.js init",

29 "watch": "node merge.js watch",

30 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 },

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/PomexAITeam/agent-rules.git"

35 },

36 "keywords": [

37 "copilot",

38 "agent",

39 "rules",

40 "guidelines"

41 ],

42 "author": "RouterHub Team",

43 "license": "MIT",

44 "engines": {

45 "node": ">=16.0.0"

46 }

47}

48

merge.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t; if (privatecontent) { copilotcontent += "\n\n---\n\n# 项目私有规则\n\n以下规则仅适用于本项目，会覆盖基础规则中的相同部分。\n\n" + privatecontent.trim(); } writefileifchanged(copilotoutput, copilotcontent); console.log(`✅ 全局规则已生成(含完整私有规则): ${copilotoutput}`); // 5. 生成 .github/instructions/*.instructions.md（各域规则） ensureparentdir(path.join(instructionsdir, "_placeholder")); for (const rule of domainrules) { let domaincontent = rule.content.trim(); // 追加对应域的私有规则 const privatedomaincontent = privatedomains.domains[rule.meta.outputname]; if (privatedomaincontent) { domaincontent += "\n\n---\n\n# 项目私有规则（" + rule.meta.name + "）\n\n" +

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

merge.jsView on unpkg

scripts/agent-browser-cleanup.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/agent-browser-cleanup.shView on unpkg

•path = scripts/agent-browser-cleanup.sh kind = build_helper sizeBytes = 4442 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser-cleanup.shView on unpkg

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.210 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.210 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 04502cf46d030d6a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @routerhub/agent-rules@1.5.210 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.210 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

skills/screenshot-annotate/annotate.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.210 matchedPath = skills/screenshot-annotate/annotate.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.210 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/screenshot-annotate/annotate.jsView on unpkg