Loading npm security reports…

ruddr@0.3.3: AI-agent control-surface risk | LPM Firewall

registry / ruddr / 0.3.3

ruddr@0.3.3

Thin control plane for Codex, Claude Code, OpenCode, and Pi agent sessions: run, steer, observe, and a live TUI with diffs.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically downloads and runs a native executable, which installs an agent skill into shared user-level Claude and agent skill directories. This changes AI-agent behavior without an explicit user setup command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation

Impact

A package installation can add or replace instructions used by AI-agent tooling across the user's environment.

Mechanism

downloaded native binary installs a shared AI-agent skill

Policy narrative

During npm postinstall, the package downloads a platform binary from GitHub and executes its skill install command. The embedded Go implementation selects ~/.claude/skills and ~/.agents/skills by default, creates a ruddr-delegate directory, and replaces SKILL.md there. This is an automatic write to broad, third-party AI-agent control surfaces rather than an explicit user-invoked setup action.

AI rationale

The source establishes an automatic postinstall chain that downloads and executes a binary which writes a skill into shared AI-agent directories. This meets the install-time foreign AI-agent control-surface mutation block policy.

Evidence

package.jsonscripts/npm-postinstall.cjsscripts/npm-binary.cjsskill.goruddr~/.claude/skills/ruddr-delegate/SKILL.md~/.agents/skills/ruddr-delegate/SKILL.md

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/npm[redacted]

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/npm[redacted] Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: L5: const { spawnSync } = require("node:child_process"); L6: const { ensureBinary } = require("./npm-binary.cjs"); ... L12: log(`ruddr: installed binary at ${binary}`); L13: const skill = spawnSync(binary, ["skill", "install"], { stdio: ["ignore", "pipe", "pipe"] }); L14: if (skill.error || skill.status !== 0) ... L16: else log(`ruddr: ${String(skill.stdout).trim().split("\n").join("\nruddr: ")}`); L17: const bun = spawnSync("bun", ["--version"], { stdio: "ignore" }); L18: if (bun.error || bun.status !== 0) L19: log("ruddr: Bun 1.4 or newer is required for `ruddr tui` and the Claude, O

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

bin/ruddr.cjsView file

5L6: const { spawnSync } = require("node:child_process"); L7: const { ensureBinary } = require("../scripts/npm-binary.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ruddr.cjsView on unpkg · L5

scripts/npm-postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.0 matchedPath = scripts/npm[redacted] matchedIdentity = npm:cnVkZHI:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-postinstall.cjsView on unpkg

scripts/npm-binary.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = ruddr@0.3.4 matchedIdentity = npm:cnVkZHI:0.3.4 similarity = 0.591 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/npm-binary.cjsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 1-24json

1{

2 "name": "ruddr",

3 "version": "0.3.3",

4 "description": "Thin control plane for Codex, Claude Code, OpenCode, and Pi agent sessions: run, steer, observe, and a live TUI with diffs.",

5 "license": "MIT",

6 "type": "module",

7 "bin": {

8 "ruddr": "bin/ruddr.cjs",

9 "rudder": "bin/ruddr.cjs"

10 },

11 "files": [

12 "bin/",

13 "scripts/npm-binary.cjs",

14 "scripts/npm-postinstall.cjs",

15 "tui/",

16 "adapter/",

17 "claude/",

18 "opencode/",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

19 "pi/",

20 "skills/",

21 "*.go",

22 "go.mod",

23 "go.sum",

24 "checksums.json",

Lines 38-69json

38 ],

39 "repository": {

40 "type": "git",

41 "url": "git+https://github.com/safzanpirani/ruddr.git"

42 },

43 "homepage": "https://github.com/safzanpirani/ruddr#readme",

44 "bugs": {

45

bin/ruddr.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// npm launcher: runs the native Ruddr binary that lives beside the TUI and

3// adapter sources in this package, so the binary's sibling lookup finds them.

4"use strict";

5

6const { spawnSync } = require("node:child_process");

7const { ensureBinary }

scripts/npm-postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.0 matchedPath = scripts/npm[redacted] matchedIdentity = npm:cnVkZHI:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-postinstall.cjsView on unpkg

scripts/npm-binary.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = ruddr@0.3.4 matchedIdentity = npm:cnVkZHI:0.3.4 similarity = 0.591 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/npm-binary.cjsView on unpkg