@viraatdas/rudder@3.1.21
A TUI for managing coding agents: run Claude Code, Codex and opencode side by side, each in its own isolated jj workspace.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe inspected source confirms that saved agent credentials are included in cloud snapshots by default and transferred to a publisher-selected remote service without recipient-specific consent. This is concrete credential disclosure, so publication should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user starts a Rudder Cloud workspace or launches a cloud task.
Impact
The remote recipient receives third-party account credentials, which can expose those accounts to access from the cloud workspace.
Mechanism
The default snapshot includes local agent authentication files; its archive is sent in a cloud launch request. The default recipient is the Rudder Cloud control plane, and the configured HTTPS destination is not restricted to a host allowlist.
Attack narrative
When a user starts a cloud workspace, Rudder packages local agent authentication files into a snapshot and sends the archive to its cloud control plane. This transfer has no credential-specific approval step, exposing saved third-party credentials to the remote recipient.
AI rationale
The inspected source confirms that saved agent credentials are included in cloud snapshots by default and transferred to a publisher-selected remote service without recipient-specific consent. This is concrete credential disclosure, so publication should be blocked.
Evidence
dist/cloud.js
Network endpoints1
rudder-cloud-control.fly.dev
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The cloud snapshot allowlist includes local Claude and Codex authentication files.
- Snapshot creation includes credentials by default, and path normalization adds the package’s default allowlist.
- Cloud launch embeds the snapshot archive in its request and posts it to the launch endpoint.
- The default recipient is the Rudder Cloud control plane; an environment setting can change the destination to an HTTPS URL.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
21 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg1scripts.postinstall = node scripts/postinstall.mjs
Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution.
L1: import { spawnSync } from "node:child_process";
L2: import { createHash, randomUUID } from "node:crypto";
...
L10: // ~/.rudder/bin/jj/<version>/ and puts that directory on PATH for itself and
L11: // everything it starts: the native dashboard, workers and agents all inherit
L12: // it. A jj the user installed (brew, cargo, a distro package) always wins.
...
L15: // (`git worktree add --orphan`), and stock macOS and Debian 12 ship git 2.39,
L16: // so every isolated agent would fail to start on exactly the machines that have
L17: // nothing installed. 0.40.0 is also what the cloud worker
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L1•scripts.postinstall = node scripts/postinstall.mjs
Findings
17 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/cloud.js
HighUnverified Remote Native Payload Installpackage.json
HighTrigger Reachable Persistencedist/improve/schedule.js
HighSemantic Analysis Limiteddist/improve/collect.js
HighKnown Malware Source Similaritydist/usage.js
HighKnown Malware Source Similaritydist/util.js
HighKnown Malware Source Similaritydist/backends.js
HighKnown Malware Source Similaritydist/board/daemon.js
HighKnown Malware Source Similaritydist/handoff.js
HighKnown Malware Source Similaritydist/run-manager.js
Affected versions and remediation
This report applies to @viraatdas/rudder@3.1.21.
See all versions of @viraatdas/rudder for other recorded verdicts.
- Avoid installing @viraatdas/rudder@3.1.21. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.