@viraatdas/rudder@3.8.3
A TUI for managing coding agents: run Claude Code, Codex and opencode side by side, each in its own isolated jj workspace.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe transfer is part of an explicit cloud launch and defaults to the package-aligned Rudder Cloud service, so the inspected behavior does not establish a covert attack. Because credentials are included without recipient-specific confirmation and the control-plane destination is configurable, this is a concrete conditional exposure risk.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user invokes a cloud launch that uploads a local workspace snapshot.
Impact
Saved credentials may become available to the selected remote control plane and workspace; the inspected source does not establish later misuse.
Mechanism
The package creates the snapshot with credential inclusion enabled when the cloud vault is inactive, then places the archive in the launch request body.
AI rationale
The transfer is part of an explicit cloud launch and defaults to the package-aligned Rudder Cloud service, so the inspected behavior does not establish a covert attack. Because credentials are included without recipient-specific confirmation and the control-plane destination is configurable, this is a concrete conditional exposure risk.
Evidence
dist/cloud.js~/.claude/.credentials.json~/.codex/auth.json
Network endpoints1
rudder-cloud-control.fly.dev
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit cloud launch builds a workspace snapshot and includes credentials when the cloud vault is not active; it sends the archive in the launch request body.
- The cloud endpoint defaults to Rudder Cloud, but the source also allows RUDDER_CLOUD_URL to select the control plane; the snapshot path has no recipient-specific credential confirmation.
- The flagged credential reads and requests in the quota and credential-parity code serve cloud account status or send Codex quota requests to chatgpt.com.
- The unresolved receiver locations resolve to text extraction, secret-token redaction, subprocess logging, WebSocket header handling, and paste conversion; their inspected behavior does not establish an account action.
- The package exposes Rudder through its CLI entrypoint and uses a postinstall script; the inspected install setup is separate from the cloud snapshot transfer.
Evidence against
- The credential transfer requires a user-invoked cloud launch; the default control-plane host is the package's Rudder Cloud service.
- The source shows no separate credential-specific confirmation before saved credentials are included in a snapshot sent to a configurable control plane.
Source & flagged code
21 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg1scripts.postinstall = node scripts/postinstall.mjs
Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution.
L1: import { spawnSync } from "node:child_process";
L2: import { createHash, randomUUID } from "node:crypto";
...
L10: // ~/.rudder/bin/jj/<version>/ and puts that directory on PATH for itself and
L11: // everything it starts: the native dashboard, workers and agents all inherit
L12: // it. A jj the user installed (brew, cargo, a distro package) always wins.
...
L15: // (`git worktree add --orphan`), and stock macOS and Debian 12 ship git 2.39,
L16: // so every isolated agent would fail to start on exactly the machines that have
L17: // nothing installed. 0.40.0 is also what the cloud worker
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L1•scripts.postinstall = node scripts/postinstall.mjs
Findings
17 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/cloud.js
HighUnverified Remote Native Payload Installpackage.json
HighTrigger Reachable Persistencedist/improve/schedule.js
HighSemantic Analysis Limiteddist/improve/collect.js
HighKnown Malware Source Similaritydist/usage.js
HighKnown Malware Source Similaritydist/util.js
HighKnown Malware Source Similaritydist/backends.js
HighKnown Malware Source Similaritydist/board/daemon.js
HighKnown Malware Source Similaritydist/handoff.js
HighKnown Malware Source Similaritydist/run-manager.js
Affected versions and remediation
This report applies to @viraatdas/rudder@3.8.3.
See all versions of @viraatdas/rudder for other recorded verdicts.
- Review the evidence and your use of @viraatdas/rudder@3.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.