@slopus/rig@0.2.20

Opinionated coding-agent harness with strong defaults for provider-aligned workflows.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has no install lifecycle hook and its flagged primitives are explicit, package-aligned CLI/plugin SDK functions. The bootstrap dynamic require is bundled tooling code; inspection found no concrete exfiltration, stealth persistence, or malicious execution chain.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Explicit execution of the rig CLI or use of its Happy plugin SDK.

Impact

No credential harvesting, remote payload retrieval, or foreign agent-control-surface mutation was established.

Mechanism

User-invoked coding-agent and plugin-harness functionality.

AI rationale

Evidence

package.jsondist/plugin-sdk/createHappyPluginClient.jsdist/plugin-sdk/executePluginWorkspaceCommand.jsdist/plugin-sdk/resolvePluginWorkspaceFilePath.jsdist/plugin-sdk/startHappySystemPromptHook.jsdist/worklet-bootstrap.js

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

No preinstall, install, or postinstall script is declared.
The package exposes a user-invoked rig CLI.
Plugin API traffic uses an authenticated local socket path.
Workspace file writes reject paths escaping the workspace.

Evidence against

Plugin SDK can run a supplied command through bash.
Plugin SDK supports system-prompt and network handler registration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 992 KB of source, external domains: happy-plugin.test

Oversized source lightweight scan

dist/main.js13.1 MB file, sampled 256 KB

Source & flagged code

8 flagged

dist/worklet-bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = @slopus/rig@0.2.17 matchedPath = dist/worklet-bootstrap.js matchedIdentity = npm:QHNsb3B1cy9yaWc:0.2.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/worklet-bootstrap.jsView on unpkg

1import { createRequire as createBundleRequire } from "node:module"; const require = createBundleRequire(import.meta.url); L2: var __create = Object.create;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/worklet-bootstrap.jsView on unpkg · L1

dist/main.jsView file

•path = dist/main.js kind = oversized_source_file sizeBytes = 13716841 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/main.jsView on unpkg

•path = dist/main.js kind = oversized_cli_entrypoint sizeBytes = 13716841 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.jsView on unpkg

dist/plugin-sdk/developmentRunner.jsView file

•matchType = normalized_sha256 matchedPackage = @slopus/rig@0.2.17 matchedPath = dist/plugin-sdk/developmentRunner.js matchedIdentity = npm:QHNsb3B1cy9yaWc:0.2.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/developmentRunner.jsView on unpkg

dist/plugin-sdk/createHappyPluginClient.jsView file

•matchType = normalized_sha256 matchedPackage = @slopus/rig@0.2.17 matchedPath = dist/plugin-sdk/createHappyPluginClient.js matchedIdentity = npm:QHNsb3B1cy9yaWc:0.2.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/createHappyPluginClient.jsView on unpkg

dist/plugin-sdk/createHappyPluginTestHost.jsView file

•matchType = normalized_sha256 matchedPackage = @slopus/rig@0.2.17 matchedPath = dist/plugin-sdk/createHappyPluginTestHost.js matchedIdentity = npm:QHNsb3B1cy9yaWc:0.2.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/createHappyPluginTestHost.jsView on unpkg

dist/plugin-sdk/startHappyComputeProvider.jsView file

•matchType = normalized_sha256 matchedPackage = @slopus/rig@0.2.17 matchedPath = dist/plugin-sdk/startHappyComputeProvider.js matchedIdentity = npm:QHNsb3B1cy9yaWc:0.2.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/startHappyComputeProvider.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/worklet-bootstrap.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/worklet-bootstrap.jsView on unpkg

1import { createRequire as createBundleRequire } from "node:module"; const require = createBundleRequire(import.meta.url); L2: var __create = Object.create;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/worklet-bootstrap.jsView on unpkg · L1

dist/main.jsView file

•path = dist/main.js kind = oversized_source_file sizeBytes = 13716841 magicHex = [redacted]

Medium

Findings

5 High6 Medium4 Low

HighKnown Malware Source Similaritydist/plugin-sdk/developmentRunner.js

HighKnown Malware Source Similaritydist/worklet-bootstrap.js

HighKnown Malware Source Similaritydist/plugin-sdk/createHappyPluginClient.js

HighKnown Malware Source Similaritydist/plugin-sdk/createHappyPluginTestHost.js

HighKnown Malware Source Similaritydist/plugin-sdk/startHappyComputeProvider.js

MediumDynamic Requiredist/worklet-bootstrap.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/main.js

MediumOversized Cli Entrypointdist/main.js

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @slopus/rig@0.2.20.

See all versions of @slopus/rig for other recorded verdicts.

Review the evidence and your use of @slopus/rig@0.2.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-15 20:10:13.354Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.