ruddr@0.6.6: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

ruddr@0.6.6: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/npm[redacted]

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/npm[redacted] Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L15: L16: function platformTarget() { L17: const goos = { darwin: "darwin", linux: "linux", win32: "windows" }[process.platform]; ... L22: L23: function assetName(target) { L24: return `ruddr-${target.goos}-${target.goarch}${target.extension}`; L25: } L26: L27: function binaryPath() { L28: if (process.env.RUDDR_BINARY) return process.env.RUDDR_BINARY; L29: const target = platformTarget(); L30: return path.join(packageRoot, `ruddr${target ? target.extension : ""}`); L4: L5: const { spawnSync } = require("node:child_process"); L6: const { ensureBinary } = require("./npm-binary.cjs"); ...

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

49"postinstall": "node scripts/npm[redacted]" }, "dev

Medium

Suspicious Lifecycle Evidence

The automatic install hook provisions the native binary and runs its first-party skill installer.

package.jsonView on unpkg · L49

bin/ruddr.cjsView file

5L6: const { spawnSync } = require("node:child_process"); L7: const { ensureBinary } = require("../scripts/npm-binary.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ruddr.cjsView on unpkg · L5

scripts/npm-postinstall.cjsView file

10ensureBinary({ log }) .then((binary) => { log(`ruddr: installed binary at ${binary}`); const skill = spawnSync(binary, ["skill", "install"], { stdio: ["ignore", "pipe", "pipe"] }); if (skill.error || skill.status !== 0) log(`

Medium

Suspicious Lifecycle Evidence

The automatic install hook provisions the native binary and runs its first-party skill installer.

scripts/npm-postinstall.cjsView on unpkg · L10

Source & flagged code

5 flagged

package.jsonView file

Lines 1-58json

1{

2 "name": "ruddr",

3 "version": "0.6.6",

4 "description": "Thin control plane for Codex, Claude Code, OpenCode, Pi, and Factory Droid agent sessions: run, steer, observe, and a live TUI and web dashboard with diffs. One native binary.",

5 "license": "MIT",

6 "type": "module",

7 "bin": {

8 "ruddr": "bin/ruddr.cjs",

9 "rudder": "bin/ruddr.cjs"

10 },

11 "files": [

12 "bin/",

13 "scripts/npm-binary.cjs",

14 "scripts/npm-postinstall.cjs",

15 "skills/",

16 "checksums.json",

17 "README.md",

18 "THIRD_PARTY_NOTICES.md",

19 "LICENSE"

20 ],

21 "engines": {

22 "node": ">=18"

23 },

24 "os": [

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/safzanpirani/ruddr.git"

32 },

33 "homepage": "https://github.com/safzanpirani/ruddr#readme",

34 "bugs": {

35 "url": "https://github.com/safzanpirani/ruddr/issues"

36 },

37 "keywords": [

38 "codex",

39 "claude-code",

40 "opencode",

41 "droid",

42 "agent",

43 "tui",

44 "cli"

45 ],

46 "scripts": {

47 "build:web": "bun scripts/build-web.ts",

48 "test:web": "bun test web scripts",

49 "postinstall": "node scripts/npm-postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 },

51 "devDependencies": {

Medium

Suspicious Lifecycle Evidence

The automatic install hook provisions the native binary and runs its first-party skill installer.

package.jsonView on unpkg · L49

52 "@pierre/diffs": "1.5.1",

53 "@pierre/trees": "1.0.0-beta.6",

54 "@types/bun": "^1.4.2",

55 "typescript": "^5.9.3"

56 }

57}

58

bin/ruddr.cjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// npm launcher: runs the native Ruddr binary, fetching it on first use when

3// the postinstall hook did not run.

4"use strict";

5

6const { spawnSync } = require("node:child_process");

7const { ensureBinary }

scripts/npm-postinstall.cjsView file

Lines 1-22javascript

1// Fetches the platform binary at install time so the first `ruddr` call is

2// instant. Failures only warn: the launcher retries on first use.

3"use strict";

4

5const { spawnSync } = require("node:child_process");

6const { ensureBinary } =