registry / @viraatdas/rudder / 3.0.3
@viraatdas/rudder@3.0.3
A TUI for managing coding agents: run Claude Code, Codex and opencode side by side, each in its own isolated jj workspace.
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection found a postinstall hook limited to checking for and installing the package's required jj tool. Credential staging occurs in the explicit cloud-workspace flow, and the inspected agent-related files access expected local project or model data; no concrete attack behavior was identified.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Package installation may invoke the postinstall hook; cloud snapshots are created when the user invokes cloud workspace commands.
Impact
No unconsented credential transfer, unrelated control-surface mutation, or other concrete attack was established.
Mechanism
The hook checks for jj and may invoke Homebrew or Cargo to install it. Cloud operations can stage Claude credentials in a snapshot and send that snapshot through the Rudder Cloud client.
AI rationale
Source inspection found a postinstall hook limited to checking for and installing the package's required jj tool. Credential staging occurs in the explicit cloud-workspace flow, and the inspected agent-related files access expected local project or model data; no concrete attack behavior was identified.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook checks for jj and, if absent, attempts its standard installation through Homebrew or Cargo.
- Claude credentials can be staged into a cloud snapshot, but the inspected path creates that snapshot during an explicit cloud operation and sends it to Rudder Cloud.
- The Claude project directory and Codex model cache are read from their expected locations under the user's home directory.
- Improvement collection reads registered project sessions into redacted records, while its scheduler is a separate command.
- Rudder state is stored under its own home directory; the board daemon uses a per-process token and loopback protections.
- The inspected update-check and feedback files describe local update state and feedback that excludes prompts, diffs, and file contents.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
Source & flagged code
17 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/util.jsView file
•matchType = normalized_sha256
matchedPackage = @viraatdas/rudder@2.14.69
matchedPath = dist/util.js
matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:2.14.69
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/util.jsView on unpkgFindings
13 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/cloud.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs
HighTrigger Reachable Persistencedist/improve/schedule.js
HighSemantic Analysis Limiteddist/improve/collect.js
HighKnown Malware Source Similaritydist/util.js
HighKnown Malware Source Similaritydist/board/daemon.js
HighKnown Malware Source Similaritydist/handoff.js
HighKnown Malware Source Similaritydist/version-check.js
HighKnown Malware Source Similaritydist/feedback.js
HighKnown Malware Source Similaritydist/improve/state.js
Affected versions and remediation
This report applies to @viraatdas/rudder@3.0.3.
See all versions of @viraatdas/rudder for other recorded verdicts.
- Review the evidence and your use of @viraatdas/rudder@3.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.