registry / @viraatdas/rudder / 2.10.18

@viraatdas/rudder@2.10.18

A Claude Code-style terminal app for running coding agents with worktree-isolated runs.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 599 KB of source, external domains: 127.0.0.1, api.anthropic.com, github.com, jj-vcs.github.io, models.dev, registry.npmjs.org, rudder-cloud-control.fly.dev, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 6-46json

6 "homepage": "https://rudder.viraat.dev",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/viraatdas/rudder.git"

10 },

11 "type": "module",

12 "bin": {

13 "rudder": "dist/index.js"

14 },

15 "scripts": {

16 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

17 "build": "npm run clean && tsc -p tsconfig.json && npm run build-board && npm run build-native && npm run copy-native && npm run chmod-cli",

18 "build-board": "esbuild src/board/ui/index.tsx --bundle --minify --format=esm --jsx=automatic --jsx-import-source=preact --outfile=dist/board/board.js && esbuild src/board/ui/board.css --bundle --minify --outfile=dist/board/board.css",

19 "build-native": "cargo build --release --manifest-path native/Cargo.toml",

20 "check": "tsc -p tsconfig.json --noEmit",

21 "test": "tsc -p tsconfig.json && npm run chmod-cli && node --test tests/*.test.mjs",

22 "test:worker-scroll": "cargo test --manifest-path native/Cargo.toml top_origin_scroll_region_history_scrolls_like_terminal_scrollback && cargo test --manifest-path native/Cargo.toml worker_wheel && cargo test --manifest-path native/Cargo.toml wheel_scroll && cargo test --manifest-path native/Cargo.toml worker_page && cargo test --manifest-path native/Cargo.toml codex_alternate_screen_page_key",

23 "copy-native": "node -e \"const fs=require('fs');const path=require('path');const sources=[path.join('target','release','rudder-native'),path.join('native','target','release','rudder-native')];const src=sources.find((candidate)=>fs.existsSync(candidate));const dest=path.join('dist','native','rudder-native');if(src){fs.mkdirSync(path.dirname(dest),{recursive:true});fs.copyFileSync(src,dest);fs.chmodSync(dest,0o755);}else if(fs.existsSync(dest)){fs.unlinkSync(dest);}\"",

24 "chmod-cli": "node -e \"require('fs').chmodSync('dist/index.js',0o755)\"",

25 "prepack": "npm run build",

26 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "start": "node dist/index.js"

28 },

29 "files": [

30 "dist/",

31 "assets/",

32 "scripts/postinstall.mjs",

33 "README.md",

34 "package.json"

35 ],

36 "publishConfig": {

37 "access": "public"

38 },

39 "engines": {

40 "node": ">=22"

41 },

42 "devDependencies": {

43 "@types/node": "^22.15.3",

44 "@types/ws": "^8.5.13",

45 "esbuild": "^0.24.0",

46 "preact": "^10.25.0",

dist/util.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash, randomUUID } from "node:crypto";

3import fs from "node:fs";

4import fsp from "node:fs/promises";

5import os from "node:os";

dist/cloud.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

3import fsp from "node:fs/promises";

4import os from "node:os";

5import path from "node:path";

6import

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Ensures jj (Jujutsu) is installed. Rudder uses jj as its required internal

3// version-control substrate, so a fresh `npm install -g @viraatdas/rudder`

4// should leave the user ready to run. This runs on install and NEVER fails the

5// install: on any problem it prints guidance and exits 0.

6import { spawnSync } from "node:child_process";

8const TAG = "[rudder postinstall]";

dist/native/rudder-nativeView file

•path = dist/native/rudder-native kind = native_binary sizeBytes = 2609536 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/rudder-nativeView on unpkg

assets/sounds/ping.mp3View file

•path = assets/sounds/ping.mp3 kind = high_entropy_blob sizeBytes = 40704 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/sounds/ping.mp3View on unpkg

dist/board/daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @viraatdas/rudder@2.10.17 matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:2.10.17 similarity = 0.818 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/board/daemon.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/util.jsView file

1import { spawn, spawnSync } from "node:child_process"; L2: import { createHash, randomUUID } from "node:crypto"; ... L7: import readline from "node:readline/promises"; L8: import { stdin as input, stdout as output } from "node:process"; L9: const DEFAULT_PATH = [ ... L24: export function rudderHome() { L25: return path.resolve(process.env.RUDDER_HOME?.trim() || path.join(os.homedir(), ".rudder")); L26: } ... L65: const raw = await fsp.readFile(filePath, "utf8"); L66: return JSON.parse(raw); L67: } ... L160: const TOOL_INSTALL_HINTS = {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/util.jsView on unpkg · L1

dist/cloud.jsView file

1import { spawn } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L5: import path from "node:path"; L6: import { WebSocket } from "ws"; L7: import { currentBranch, currentCommit, findRepoRoot } from "./git.js"; ... L30: // Shell rc so PATH/aliases/env exports come along L31: "~/.zshrc", L32: "~/.zprofile", ... L60: // can ship; .ssh/.gnupg/keychains stay blocked because they contain L61: // private key material that isn't recoverable if leaked. L62: const SECRET_PATH_PARTS = new Set([ ... L250: method: "POST",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cloud.jsView on unpkg · L1

scripts/postinstall.mjsView file

5// install: on any problem it prints guidance and exits 0. L6: import { spawnSync } from "node:child_process"; L7: ... L13: try { L14: const probe = process.platform === "win32" ? "where" : "which"; L15: return spawnSync(probe, [cmd], { stdio: "ignore" }).status === 0; ... L34: warn(" Rust: cargo install jj-cli"); L35: warn(" Other: https://jj-vcs.github.io/jj/latest/install-and-setup/"); L36: warn("Then run: rudder doctor"); ... L39: function main() { L40: if (process.env.RUDDER_SKIP_POSTINSTALL) { L41: return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.mjsView on unpkg · L5

dist/native/rudder-nativeView file

•path = dist/native/rudder-native kind = native_binary sizeBytes = 2609536 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/rudder-nativeView on unpkg

assets/sounds/ping.mp3View file

•path = assets/sounds/ping.mp3 kind = high_entropy_blob sizeBytes = 40704 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/sounds/ping.mp3View on unpkg

dist/board/daemon.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/board/daemon.jsView on unpkg

Findings

4 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs

HighShips High Entropy Blobassets/sounds/ping.mp3

HighPrevious Version Dangerous Deltadist/board/daemon.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cloud.js

MediumShips Native Binarydist/native/rudder-native

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/util.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 6-46json

6 "homepage": "https://rudder.viraat.dev",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/viraatdas/rudder.git"

10 },

11 "type": "module",

12 "bin": {

13 "rudder": "dist/index.js"

14 },

15 "scripts": {

16 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

17 "build": "npm run clean && tsc -p tsconfig.json && npm run build-board && npm run build-native && npm run copy-native && npm run chmod-cli",

19 "build-native": "cargo build --release --manifest-path native/Cargo.toml",

20 "check": "tsc -p tsconfig.json --noEmit",

21 "test": "tsc -p tsconfig.json && npm run chmod-cli && node --test tests/*.test.mjs",

24 "chmod-cli": "node -e \"require('fs').chmodSync('dist/index.js',0o755)\"",

25 "prepack": "npm run build",

26 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "start": "node dist/index.js"

28 },

29 "files": [

30 "dist/",

31 "assets/",

32 "scripts/postinstall.mjs",

33 "README.md",

34 "package.json"

35 ],

36 "publishConfig": {

37 "access": "public"

38 },

39 "engines": {

40 "node": ">=22"

41 },

42 "devDependencies": {

43 "@types/node": "^22.15.3",

44 "@types/ws": "^8.5.13",

45 "esbuild": "^0.24.0",

46 "preact": "^10.25.0",

dist/util.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash, randomUUID } from "node:crypto";

3import fs from "node:fs";

4import fsp from "node:fs/promises";

5import os from "node:os";

dist/cloud.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

3import fsp from "node:fs/promises";

4import os from "node:os";

5import path from "node:path";

6import

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Ensures jj (Jujutsu) is installed. Rudder uses jj as its required internal

3// version-control substrate, so a fresh `npm install -g @viraatdas/rudder`

4// should leave the user ready to run. This runs on install and NEVER fails the

5// install: on any problem it prints guidance and exits 0.

6import { spawnSync } from "node:child_process";

8const TAG = "[rudder postinstall]";

dist/native/rudder-nativeView file

•path = dist/native/rudder-native kind = native_binary sizeBytes = 2609536 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/rudder-nativeView on unpkg

assets/sounds/ping.mp3View file

•path = assets/sounds/ping.mp3 kind = high_entropy_blob sizeBytes = 40704 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/sounds/ping.mp3View on unpkg

dist/board/daemon.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/board/daemon.jsView on unpkg