registry / Credential exfiltration / @viraatdas/rudder / 3.1.15

@viraatdas/rudder@3.1.15

A TUI for managing coding agents: run Claude Code, Codex and opencode side by side, each in its own isolated jj workspace.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The cloud-worker command is user-invoked, but its default upload silently forwards saved third-party authentication material to Rudder’s cloud service without recipient-specific consent. The verified credential transfer supports blocking publication.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user runs a cloud-worker launch command such as `rudder cloud` or `rudder sail`.

Impact

The cloud worker receives saved credentials that can grant access to the associated third-party accounts.

Mechanism

The default snapshot includes local agent credential files and may extract Claude credentials from macOS Keychain; the launch path encodes the snapshot as base64 and posts it to Rudder Cloud.

Attack narrative

When a user starts a cloud worker, the package’s default snapshot includes saved Claude and Codex credentials and can also stage Claude credentials from macOS Keychain. It sends the resulting archive to the publisher-selected Rudder Cloud endpoint without a separate affirmative choice to transfer those third-party credentials.

AI rationale

Evidence

dist/cloud.jsdist/main.js~/.claude/.credentials.json~/.codex/auth.json

Network endpoints1

rudder-cloud-control.fly.dev

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/cloud.js defaults snapshots to include local Claude and Codex credential files, among other service configurations.
Credential inclusion is enabled unless explicitly disabled; snapshot creation copies the default paths and can extract Claude credentials from the macOS Keychain.
The cloud and sail CLI dispatch to the launch path, which embeds the snapshot as base64 and posts it to the cloud launch endpoint without a credential-specific confirmation.
The default cloud control endpoint is Rudder’s publisher-selected service.
The transfer occurs when a user launches a cloud worker, but the source does not require affirmative consent to include saved third-party credentials.

Evidence against

The transfer is part of the package’s cloud-worker workflow and is triggered by a user command; it is not performed by the install hook.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

Source & flagged code

21 flagged

package.jsonView file

Lines 18-58json

18 "repository": {

19 "type": "git",

20 "url": "git+https://github.com/viraatdas/rudder.git"

21 },

22 "type": "module",

23 "bin": {

24 "rudder": "dist/index.js"

25 },

26 "scripts": {

27 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

28 "build": "npm run clean && tsc -p tsconfig.json && npm run build-board && npm run build-native && npm run copy-native && npm run chmod-cli",

29 "build-board": "esbuild src/board/ui/index.tsx --bundle --minify --format=esm --jsx=automatic --jsx-import-source=preact --outfile=dist/board/board.js && esbuild src/board/ui/board.css --bundle --minify --outfile=dist/board/board.css",

30 "build-native": "cargo build --release --manifest-path native/Cargo.toml",

31 "check": "tsc -p tsconfig.json --noEmit",

32 "test": "tsc -p tsconfig.json && npm run chmod-cli && node --test tests/*.test.mjs",

33 "test:tui": "node --test tests/tui/*.test.mjs",

34 "test:worker-scroll": "cargo test --manifest-path native/Cargo.toml top_origin_scroll_region_history_scrolls_like_terminal_scrollback && cargo test --manifest-path native/Cargo.toml worker_wheel && cargo test --manifest-path native/Cargo.toml wheel_scroll && cargo test --manifest-path native/Cargo.toml worker_page && cargo test --manifest-path native/Cargo.toml codex_alternate_screen_page_key",

35 "copy-native": "node scripts/copy-native.mjs",

36 "chmod-cli": "node -e \"require('fs').chmodSync('dist/index.js',0o755)\"",

37 "prepack": "npm run build",

38 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 "start": "node dist/index.js",

40 "test:tui:report": "rm -rf .tui-report tui-report.html && node --test --test-reporter=spec --test-reporter-destination=stdout --test-reporter=tui-integration-tests/reporter --test-reporter-destination=tui-report.html tests/tui/*.test.mjs",

41 "mutate:tui": "node tests/tui/mutate.mjs"

42 },

43 "files": [

44 "dist/",

45 "assets/",

46 "scripts/copy-native.mjs",

47 "scripts/postinstall.mjs",

48 "README.md",

49 "package.json"

50 ],

51 "publishConfig": {

52 "access": "public"

53 },

54 "engines": {

55 "node": ">=22"

56 },

57 "devDependencies": {

58 "@types/node": "^22.15.3",

dist/util.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash, randomUUID } from "node:crypto";

3import fs from "node:fs";

4import fsp from "node:fs/promises";

dist/improve/schedule.jsView file

Lines 1-27javascript

1import os from "node:os";

2import path from "node:path";

3import { promises as fs } from "node:fs";

4import { ensureDir, pathExists, runCommand, shortenHome } from

dist/cloud.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cloud.js: "~/.claude/.credentials.json", "~/.claude/settings.json", "~/.claude/hooks", "~/.claude/CLAUDE.md", "~/.claude.json", "~/.codex/auth.json", "~/.codex/config.toml", "~/.codex/AGENTS.md",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cloud.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/cloud.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cloud.jsView on unpkg

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Ensures jj (Jujutsu) is installed. Rudder uses jj as its required internal

3// version-control substrate, so a fresh `npm install -g @viraatdas/rudder`

4// should leave the user ready to run. This runs on install and NEVER fails the

5// install: on any problem it prints guidance and exits 0.

6import { spawnSync } from "node:child_process";

8const TAG

dist/native/darwin-x64/rudder-nativeView file

•path = dist/native/darwin-x64/rudder-native kind = native_binary sizeBytes = 5136656 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-x64/rudder-nativeView on unpkg

dist/improve/collect.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/improve/collect.jsView on unpkg

dist/usage.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/usage.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/usage.jsView on unpkg

dist/backends.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/backends.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backends.jsView on unpkg

dist/board/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/board/daemon.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/board/daemon.jsView on unpkg

dist/handoff.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/handoff.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handoff.jsView on unpkg

dist/run-manager.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/run-manager.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/run-manager.jsView on unpkg

dist/task-summary.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/task-summary.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/task-summary.jsView on unpkg

dist/version-check.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/version-check.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/version-check.jsView on unpkg

dist/feedback.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/feedback.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/feedback.jsView on unpkg

dist/improve/state.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/improve/state.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/improve/state.jsView on unpkg

dist/models.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/models.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/models.jsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/util.jsView file

•matchType = normalized_sha256 matchedPackage = @viraatdas/rudder@3.1.14 matchedPath = dist/util.js matchedIdentity = npm:QHZpcmFhdGRhcy9ydWRkZXI:3.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util.jsView on unpkg

Findings

17 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/cloud.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs

HighTrigger Reachable Persistencedist/improve/schedule.js

HighSemantic Analysis Limiteddist/improve/collect.js

HighKnown Malware Source Similaritydist/cloud.js

HighKnown Malware Source Similaritydist/usage.js

HighKnown Malware Source Similaritydist/util.js

HighKnown Malware Source Similaritydist/backends.js

HighKnown Malware Source Similaritydist/board/daemon.js

HighKnown Malware Source Similaritydist/handoff.js

Affected versions and remediation

This report applies to @viraatdas/rudder@3.1.15.

See all versions of @viraatdas/rudder for other recorded verdicts.

Avoid installing @viraatdas/rudder@3.1.15. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-17 00:30:21.256Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other credential exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other credential exfiltration packages