Loading npm security reports…

@routerhub/agent-rules@1.5.226: AI-agent control-surface risk | LPM Firewall

registry / @routerhub/agent-rules / 1.5.226

@routerhub/agent-rules@1.5.226

Shared Copilot agent rules and guidelines for RouterHub projects

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing this package runs postinstall.js, which changes the consumer .npmrc and then writes Copilot, Claude Code, and Cursor control files into the project. Team-level GitHub Copilot instructions, instruction files, a PR template, and .claude/skills are always generated. Those files are foreign agent control surfaces, not a package-owned extension directory.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm, pnpm, or yarn install of this package, which runs the postinstall script.

Impact

Copilot, Claude Code, and Cursor in the consuming repository load package-authored rules and skills, and later installs keep rerunning the hook because .npmrc is altered.

Mechanism

Install-hook mutation of foreign AI agent instruction and skill files

Policy narrative

On install, postinstall.js finds the consumer project root, appends pnpm settings that keep lifecycle scripts enabled, and runs merge.js init. That write path always drops GitHub Copilot instructions, path-scoped instruction files, a pull request template, and Claude Code skills into the repo, and it may also write CLAUDE.md and AGENTS.md when the local git user matches a bundled name list. The generated Copilot file tells code review to ignore those paths. Adding the dependency is enough to take over several AI coding agents in the consuming project.

AI rationale

The postinstall hook unconsented-writes Copilot, Claude Code, and Cursor control files in the consumer project and also weakens pnpm script gating via .npmrc. That is foreign and broad AI-agent control-surface mutation, so it is blocked rather than treated as first-party extension setup.

Evidence

package.jsonpostinstall.js

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/agent-browser-cleanup.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/agent-browser-cleanup.shView on unpkg

•path = scripts/agent-browser-cleanup.sh kind = build_helper sizeBytes = 4442 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser-cleanup.shView on unpkg

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.224 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.224 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d50b5f15aa258565 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @routerhub/agent-rules@1.5.224 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.224 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

skills/screenshot-annotate/annotate.cjsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.224 matchedPath = skills/screenshot-annotate/annotate.cjs matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.224 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/screenshot-annotate/annotate.cjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 10-48json

10 "files": [

11 "AGENTS.base.md",

12 "rules/",

13 "skills/",

14 "scripts/agent-browser-cleanup.sh",

15 "merge.js",

16 "AGENTS.private.example.md",

17 "PULL_REQUEST_TEMPLATE.md",

18 "postinstall.js",

19 "package.json",

20 "CHANGELOG.md",

21 "enabled-users.json"

22 ],

23 "scripts": {

24 "build": "node --check merge.js && node --check postinstall.js",

25 "test:postinstall-init": "node tests/postinstall-init.test.js",

26 "merge": "node merge.js",

27 "sync": "node merge.js sync",

28 "init": "node merge.js init",

29 "watch": "node merge.js watch",

30 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 },

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/PomexAITeam/agent-rules.git"

35 },

36 "keywords": [

37 "copilot",

38 "agent",

39 "rules",

40 "guidelines"

41 ],

42 "author": "RouterHub Team",

43 "license": "MIT",

44 "engines": {

45 "node": ">=16.0.0"

46 }

47}

48

scripts/agent-browser-cleanup.shView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/agent-browser-cleanup.shView on unpkg

•path = scripts/agent-browser-cleanup.sh kind = build_helper sizeBytes = 4442 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser-cleanup.shView on unpkg

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.224 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.224 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d50b5f15aa258565 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @routerhub/agent-rules@1.5.224 matchedPath = postinstall.js matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.224 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

skills/screenshot-annotate/annotate.cjsView file

•matchType = normalized_sha256 matchedPackage = @routerhub/agent-rules@1.5.224 matchedPath = skills/screenshot-annotate/annotate.cjs matchedIdentity = npm:QHJvdXRlcmh1Yi9hZ2VudC1ydWxlcw:1.5.224 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/screenshot-annotate/annotate.cjsView on unpkg