Loading npm security reports…

ruddr@0.4.0: AI-agent control-surface risk | LPM Firewall

registry / ruddr / 0.4.0

ruddr@0.4.0

Thin control plane for Codex, Claude Code, OpenCode, and Pi agent sessions: run, steer, observe, and a live TUI with diffs.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package fetches or builds and executes a binary that installs a Ruddr agent skill into home-level Claude and agent skill directories. This mutates broad AI-agent control surfaces without an explicit setup command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation.

Impact

Future Claude or compatible agent sessions can load package-authored delegation instructions.

Mechanism

Automatic binary download and execution followed by home-directory agent-skill installation.

Policy narrative

Installing the package triggers postinstall. The hook obtains a native executable, executes `skill install`, and the binary creates or replaces `ruddr-delegate/SKILL.md` below both `~/.claude/skills` and `~/.agents/skills`. This makes package-authored agent instructions available through broad, home-level agent control surfaces without a user invoking setup. The install path can fetch an executable release before running it.

AI rationale

This is an unconsented postinstall mutation of broad AI-agent control surfaces, preceded by automatic executable acquisition and execution. It meets the install-control-surface block policy even without proven secret theft.

Evidence

package.jsonscripts/npm-postinstall.cjsscripts/npm-binary.cjsskill.goskills/ruddr-delegate/SKILL.mdruddr~/.claude/skills/ruddr-delegate/SKILL.md

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/npm[redacted]

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/npm[redacted] Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: L5: const { spawnSync } = require("node:child_process"); L6: const { ensureBinary } = require("./npm-binary.cjs"); ... L12: log(`ruddr: installed binary at ${binary}`); L13: const skill = spawnSync(binary, ["skill", "install"], { stdio: ["ignore", "pipe", "pipe"] }); L14: if (skill.error || skill.status !== 0) ... L16: else log(`ruddr: ${String(skill.stdout).trim().split("\n").join("\nruddr: ")}`); L17: const bun = spawnSync("bun", ["--version"], { stdio: "ignore" }); L18: if (bun.error || bun.status !== 0) L19: log("ruddr: Bun 1.4 or newer is required for `ruddr tui` and the Claude, O

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

bin/ruddr.cjsView file

5L6: const { spawnSync } = require("node:child_process"); L7: const { ensureBinary } = require("../scripts/npm-binary.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ruddr.cjsView on unpkg · L5

tui/core.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

tui/core.ts#virtual:normalized:round1View on unpkg

scripts/npm-binary.cjsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.1 matchedPath = scripts/npm-binary.cjs matchedIdentity = npm:cnVkZHI:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-binary.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7c18b58619a01498 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = ruddr@0.4.1 matchedPath = scripts/npm-binary.cjs matchedIdentity = npm:cnVkZHI:0.4.1 similarity = 1.000 shingleOverlap = 17 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/npm-binary.cjsView on unpkg

opencode/runtime.tsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.1 matchedPath = opencode/runtime.ts matchedIdentity = npm:cnVkZHI:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

opencode/runtime.tsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = ruddr@0.3.4 matchedIdentity = npm:cnVkZHI:0.3.4 similarity = 0.636 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

opencode/runtime.tsView on unpkg

scripts/npm-postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.1 matchedPath = scripts/npm[redacted] matchedIdentity = npm:cnVkZHI:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-postinstall.cjsView on unpkg

tui/core.tsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.1 matchedPath = tui/core.ts matchedIdentity = npm:cnVkZHI:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tui/core.tsView on unpkg

pi/runtime.tsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.1 matchedPath = pi/runtime.ts matchedIdentity = npm:cnVkZHI:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

pi/runtime.tsView on unpkg

tui/git.tsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.1 matchedPath = tui/git.ts matchedIdentity = npm:cnVkZHI:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tui/git.tsView on unpkg