Loading npm security reports…
Thin control plane for Codex, Claude Code, OpenCode, and Pi agent sessions: run, steer, observe, and a live TUI with diffs.
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically fetches or builds and executes a binary that installs a Ruddr skill into broad, third-party agent skill locations. This changes AI-agent control surfaces without an explicit user command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4Package source references dynamic require/import behavior.
bin/ruddr.cjsView on unpkg · L5A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
tui/core.ts#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
opencode/runtime.tsView on unpkgThis report applies to ruddr@0.4.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
tui/core.ts#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
opencode/runtime.tsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L58Package source references dynamic require/import behavior.
bin/ruddr.cjsView on unpkg · L5