ruddr@0.5.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

ruddr@0.5.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/npm[redacted]

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/npm[redacted] Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: L5: const { spawnSync } = require("node:child_process"); L6: const { ensureBinary } = require("./npm-binary.cjs"); ... L12: log(`ruddr: installed binary at ${binary}`); L13: const skill = spawnSync(binary, ["skill", "install"], { stdio: ["ignore", "pipe", "pipe"] }); L14: if (skill.error || skill.status !== 0) ... L16: else log(`ruddr: ${String(skill.stdout).trim().split("\n").join("\nruddr: ")}`); L17: const bun = spawnSync("bun", ["--version"], { stdio: "ignore" }); L18: if (bun.error || bun.status !== 0) L19: log("ruddr: Bun 1.4 or newer is required for `ruddr tui`, `ruddr web`, and

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

bin/ruddr.cjsView file

5L6: const { spawnSync } = require("node:child_process"); L7: const { ensureBinary } = require("../scripts/npm-binary.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ruddr.cjsView on unpkg · L5

web/client/diffs.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

web/client/diffs.ts#virtual:normalized:round1View on unpkg

scripts/npm-postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.3.3 matchedPath = scripts/npm[redacted] matchedIdentity = npm:cnVkZHI:0.3.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-postinstall.cjsView on unpkg

pi/runtime.tsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.0 matchedPath = pi/runtime.ts matchedIdentity = npm:cnVkZHI:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

pi/runtime.tsView on unpkg

tui/git.tsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.0 matchedPath = tui/git.ts matchedIdentity = npm:cnVkZHI:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tui/git.tsView on unpkg

scripts/npm-binary.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = ruddr@0.3.4 matchedIdentity = npm:cnVkZHI:0.3.4 similarity = 0.591 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/npm-binary.cjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-24json

1{

2 "name": "ruddr",

3 "version": "0.5.1",

4 "description": "Thin control plane for Codex, Claude Code, OpenCode, Pi, and Factory Droid agent sessions: run, steer, observe, and a live TUI and web dashboard with diffs.",

5 "license": "MIT",

6 "type": "module",

7 "bin": {

8 "ruddr": "bin/ruddr.cjs",

9 "rudder": "bin/ruddr.cjs"

10 },

11 "files": [

12 "bin/",

13 "scripts/npm-binary.cjs",

14 "scripts/npm-postinstall.cjs",

15 "tui/",

16 "adapter/",

17 "claude/",

18 "opencode/",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

19 "pi/",

20 "droid/",

21 "web/",

22 "skills/",

23 "*.go",

24 "go.mod",

Lines 42-75json

42 "type": "git",

43 "url": "git+https://github.com/safzanpirani/ruddr.git"

44 },

45 "homepage": "https://github.com/safzanpirani/ruddr#readme",

46 "bugs": {

47 "url": "https://github.com/safzanpirani/ruddr/issues"

48 },

bin/ruddr.cjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// npm launcher: runs the native Ruddr binary that lives beside the TUI and

3// adapter sources in this package, so the binary's sibling lookup finds them.

4"use strict";

5

6const { spawnSync } = require("node:child_process");

7const { ensureBinary }

web/client/diffs.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

web/client/diffs.ts#virtual:normalized:round1View on unpkg

scripts/npm-postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.3.3 matchedPath = scripts/npm[redacted] matchedIdentity = npm:cnVkZHI:0.3.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-postinstall.cjsView on unpkg

pi/runtime.tsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.0 matchedPath = pi/runtime.ts matchedIdentity = npm:cnVkZHI:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

pi/runtime.tsView on unpkg

tui/git.tsView file

•matchType = normalized_sha256 matchedPackage = ruddr@0.4.0 matchedPath = tui/git.ts matchedIdentity = npm:cnVkZHI:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tui/git.tsView on unpkg

scripts/npm-binary.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = ruddr@0.3.4 matchedIdentity = npm:cnVkZHI:0.3.4 similarity = 0.591 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/npm-binary.cjsView on unpkg