registry / @viraatdas/rudder / 2.12.17

@viraatdas/rudder@2.12.17

A Claude Code-style terminal app for running coding agents with worktree-isolated runs.

Static Scan Results

scanned 29d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 755 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, github.com, jj-vcs.github.io, models.dev, registry.npmjs.org, rudder-cloud-control.fly.dev, www.apple.com, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 6-46json

6 "homepage": "https://rudder.viraat.dev",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/viraatdas/rudder.git"

10 },

11 "type": "module",

12 "bin": {

13 "rudder": "dist/index.js"

14 },

15 "scripts": {

16 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

17 "build": "npm run clean && tsc -p tsconfig.json && npm run build-board && npm run build-native && npm run copy-native && npm run chmod-cli",

18 "build-board": "esbuild src/board/ui/index.tsx --bundle --minify --format=esm --jsx=automatic --jsx-import-source=preact --outfile=dist/board/board.js && esbuild src/board/ui/board.css --bundle --minify --outfile=dist/board/board.css",

19 "build-native": "cargo build --release --manifest-path native/Cargo.toml",

20 "check": "tsc -p tsconfig.json --noEmit",

21 "test": "tsc -p tsconfig.json && npm run chmod-cli && node --test tests/*.test.mjs",

22 "test:worker-scroll": "cargo test --manifest-path native/Cargo.toml top_origin_scroll_region_history_scrolls_like_terminal_scrollback && cargo test --manifest-path native/Cargo.toml worker_wheel && cargo test --manifest-path native/Cargo.toml wheel_scroll && cargo test --manifest-path native/Cargo.toml worker_page && cargo test --manifest-path native/Cargo.toml codex_alternate_screen_page_key",

23 "copy-native": "node scripts/copy-native.mjs",

24 "chmod-cli": "node -e \"require('fs').chmodSync('dist/index.js',0o755)\"",

25 "prepack": "npm run build",

26 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "start": "node dist/index.js"

28 },

29 "files": [

30 "dist/",

31 "assets/",

32 "scripts/copy-native.mjs",

33 "scripts/postinstall.mjs",

34 "README.md",

35 "package.json"

36 ],

37 "publishConfig": {

38 "access": "public"

39 },

40 "engines": {

41 "node": ">=22"

42 },

43 "devDependencies": {

44 "@types/node": "^22.15.3",

45 "@types/ws": "^8.5.13",

46 "esbuild": "^0.24.0",

dist/util.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash, randomUUID } from "node:crypto";

3import fs from "node:fs";

4import fsp from "node:fs/promises";

dist/cloud.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

3import fsp from "node:fs/promises";

4import os from "node:os";

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Ensures jj (Jujutsu) is installed. Rudder uses jj as its required internal

3// version-control substrate, so a fresh `npm install -g @viraatdas/rudder`

4// should leave the user ready to run. This runs on install and NEVER fails the

5// install: on any problem it prints guidance and exits 0.

6import { spawnSync } from "node:child_process";

8const TAG

dist/native/darwin-x64/rudder-nativeView file

•path = dist/native/darwin-x64/rudder-native kind = native_binary sizeBytes = 3331220 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-x64/rudder-nativeView on unpkg

assets/sounds/ping.mp3View file

•path = assets/sounds/ping.mp3 kind = high_entropy_blob sizeBytes = 40704 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/sounds/ping.mp3View on unpkg

dist/backends.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @viraatdas/rudder@2.12.10 matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:2.12.10 similarity = 0.787 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/backends.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code