@viraatdas/rudder@2.14.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@viraatdas/rudder@2.14.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/util.jsView file

1import { spawn, spawnSync } from "node:child_process"; L2: import { createHash, randomUUID } from "node:crypto"; ... L7: import readline from "node:readline/promises"; L8: import { stdin as input, stdout as output } from "node:process"; L9: const DEFAULT_PATH = [ ... L24: export function rudderHome() { L25: return path.resolve(process.env.RUDDER_HOME?.trim() || path.join(os.homedir(), ".rudder")); L26: } ... L65: const raw = await fsp.readFile(filePath, "utf8"); L66: return JSON.parse(raw); L67: } ... L160: const TOOL_INSTALL_HINTS = {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/util.jsView on unpkg · L1

dist/cloud.jsView file

1Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/main.js -> dist/cloud.js L1: import { spawn } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L5: import path from "node:path"; L6: import { WebSocket } from "ws"; L7: import { currentBranch, currentCommit, findRepoRoot } from "./git.js"; ... L30: // Shell rc so PATH/aliases/env exports come along L31: "~/.zshrc", L32: "~/.zprofile", ... L60: // can ship; .ssh/.gnupg/keychains stay blocked because they contain L61: // private key material that isn't recoverable if leaked. L62: const SECRET_PATH_PARTS = new Set([ ... L263: method: "POST",

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cloud.jsView on unpkg · L1

1import { spawn } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L5: import path from "node:path"; L6: import { WebSocket } from "ws"; L7: import { currentBranch, currentCommit, findRepoRoot } from "./git.js"; ... L30: // Shell rc so PATH/aliases/env exports come along L31: "~/.zshrc", L32: "~/.zprofile", ... L60: // can ship; .ssh/.gnupg/keychains stay blocked because they contain L61: // private key material that isn't recoverable if leaked. L62: const SECRET_PATH_PARTS = new Set([ ... L263: method: "POST",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cloud.jsView on unpkg · L1

scripts/postinstall.mjsView file

5// install: on any problem it prints guidance and exits 0. L6: import { spawnSync } from "node:child_process"; L7: ... L13: try { L14: const probe = process.platform === "win32" ? "where" : "which"; L15: return spawnSync(probe, [cmd], { stdio: "ignore" }).status === 0; ... L34: warn(" Rust: cargo install jj-cli"); L35: warn(" Other: https://jj-vcs.github.io/jj/latest/install-and-setup/"); L36: warn("Then run: rudder doctor"); ... L39: function main() { L40: if (process.env.RUDDER_SKIP_POSTINSTALL) { L41: return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.mjsView on unpkg · L5

dist/native/darwin-x64/rudder-nativeView file

•path = dist/native/darwin-x64/rudder-native kind = native_binary sizeBytes = 3608436 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-x64/rudder-nativeView on unpkg

assets/sounds/ping.mp3View file

•path = assets/sounds/ping.mp3 kind = high_entropy_blob sizeBytes = 40704 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/sounds/ping.mp3View on unpkg

dist/improve/collect.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/improve/collect.jsView on unpkg

dist/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @viraatdas/rudder@2.12.18 matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:2.12.18 similarity = 0.980 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 6-46json

6 "homepage": "https://rudder.viraat.dev",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/viraatdas/rudder.git"

10 },

11 "type": "module",

12 "bin": {

13 "rudder": "dist/index.js"

14 },

15 "scripts": {

16 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

17 "build": "npm run clean && tsc -p tsconfig.json && npm run build-board && npm run build-native && npm run copy-native && npm run chmod-cli",

18 "build-board": "esbuild src/board/ui/index.tsx --bundle --minify --format=esm --jsx=automatic --jsx-import-source=preact --outfile=dist/board/board.js && esbuild src/board/ui/board.css --bundle --minify --outfile=dist/board/board.css",

19 "build-native": "cargo build --release --manifest-path native/Cargo.toml",

20 "check": "tsc -p tsconfig.json --noEmit",

21 "test": "tsc -p tsconfig.json && npm run chmod-cli && node --test tests/*.test.mjs",

22 "test:worker-scroll": "cargo test --manifest-path native/Cargo.toml top_origin_scroll_region_history_scrolls_like_terminal_scrollback && cargo test --manifest-path native/Cargo.toml worker_wheel && cargo test --manifest-path native/Cargo.toml wheel_scroll && cargo test --manifest-path native/Cargo.toml worker_page && cargo test --manifest-path native/Cargo.toml codex_alternate_screen_page_key",

23 "copy-native": "node scripts/copy-native.mjs",

24 "chmod-cli": "node -e \"require('fs').chmodSync('dist/index.js',0o755)\"",

25 "prepack": "npm run build",

26 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "start": "node dist/index.js"

28 },

29 "files": [

30 "dist/",

31 "assets/",

32 "scripts/copy-native.mjs",

33 "scripts/postinstall.mjs",

34 "README.md",

35 "package.json"

36 ],

37 "publishConfig": {

38 "access": "public"

39 },

40 "engines": {

41 "node": ">=22"

42 },

43 "devDependencies": {

44 "@types/node": "^22.15.3",

45 "@types/ws": "^8.5.13",

46 "esbuild": "^0.24.0",

dist/util.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash, randomUUID } from "node:crypto";

3import fs from "node:fs";

4import fsp from "node:fs/promises";

dist/cloud.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

3import fsp from "node:fs/promises";

4import os from "node:os";

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Ensures jj (Jujutsu) is installed. Rudder uses jj as its required internal

3// version-control substrate, so a fresh `npm install -g @viraatdas/rudder`

4// should leave the user ready to run. This runs on install and NEVER fails the

5// install: on any problem it prints guidance and exits 0.

6import { spawnSync } from "node:child_process";

7

8const TAG

dist/native/darwin-x64/rudder-nativeView file

•path = dist/native/darwin-x64/rudder-native kind = native_binary sizeBytes = 3608436 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-x64/rudder-nativeView on unpkg

assets/sounds/ping.mp3View file

•path = assets/sounds/ping.mp3 kind = high_entropy_blob sizeBytes = 40704 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/sounds/ping.mp3View on unpkg

dist/improve/collect.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/improve/collect.jsView on unpkg

dist/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @viraatdas/rudder@2.12.18 matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:2.12.18 similarity = 0.980 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main.jsView on unpkg