Loading npm security reports…
Thin control plane for Codex, Claude Code, OpenCode, Pi, and Factory Droid agent sessions: run, steer, observe, and a live TUI and web dashboard with diffs. One native binary.
LPM treats this as warn-only first-party agent extension lifecycle risk. The automatic postinstall invokes the package's native CLI to install its delegate skill. This is a first-party agent skill setup path; the inspected JavaScript does not establish what files the native command changes.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4The postinstall hook provisions and runs a native binary to install the package's Ruddr delegate skill automatically.
package.jsonView on unpkg · L49Package source references dynamic require/import behavior.
bin/ruddr.cjsView on unpkg · L5The postinstall hook provisions and runs a native binary to install the package's Ruddr delegate skill automatically.
scripts/npm-postinstall.cjsView on unpkg · L13This report applies to ruddr@0.6.3.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L49The postinstall hook provisions and runs a native binary to install the package's Ruddr delegate skill automatically.
package.jsonView on unpkg · L49Package source references dynamic require/import behavior.
bin/ruddr.cjsView on unpkg · L5The postinstall hook provisions and runs a native binary to install the package's Ruddr delegate skill automatically.
scripts/npm-postinstall.cjsView on unpkg · L13