ruvector@0.3.26
CAUTION· startup onlyPublisher claims: "Self-learning vector database for Node.js: native HNSW vector search, ONNX embeddings, GNN, attention, SONA routing and an MCP server for agents." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher ruvnet · publishing for 420 daysInstalls 648KLast detonated 2d ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- ruv.io (its own)Also huggingface.co, githubusercontent.com, run.app, unpkg.com, nodejs.org, rustup.rs, microsoft.com, crates.io, schemastore.org, jsdelivr.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it under the guard. Startup only; authenticated tool behavior not tested. The code names no credential variable and talks to ruv.io, its own; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- npx -y ruvector
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-12 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Privileged sudo command; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 31 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
11sprocessdependency install exit 0
31sclaimedstartup only: exited (0) before answering · task type (ADR-139) harness MetaHarness, Darwin, Flywheel, routing, safety, and workspace capabilities help [command] display help for command
31sprocessscript backend runs setup only
31sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known packagebin/cli.js:595 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(chalk.gray(' Optional extras (RaBitQ, DiskANN, router, graph, rvlite, quantum): npx ruvector add --list'));Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsbin/mcp-server.js:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// cannot cover $HOME secrets such as ~/.ssh or ~/.npmrc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandbin/cli.js:4715 · Privileged sudo command — agent may execute with elevated privileges
AST05'Bash(sudo rm:*)',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Destructive file system command detectedbin/cli.js:6752 · Destructive file system command detected
AST05// data.patterns keyed by "<task>:<ext>|<agent>" (the same state formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebin/cli.js:593 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(chalk.gray('\n Install GNN with: npx ruvector install gnn'));Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/extras.js:33 · npx invocation of non-well-known package — may execute untrusted code
AST06usage: 'npx ruvector route --help',Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Direct script execution from GitHub raw URLbin/cli.js:1846 · Direct script execution from GitHub raw URL — unverified code source
AST06console.log(chalk.white(' curl -fsSL https://raw.githubusercontent.com/ruvnet/ruvector/main/install.sh | bash'));Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbin/cli.js:1034 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.white(` Input shape: ${chalk.yellow(`[${inputDim}]`)}`));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebin/cli.js:769 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(chalk.white(' npx ruvector install graph-node # Install graph database'));Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbin/cli.js:1042 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.green(`\nLayer config saved to: ${options.output}`));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Remote installer piped to shellbin/cli.js:1880 · Remote installer piped to shell
AST07console.log(chalk.white(' curl --proto \'=https\' --tlsv1.2 -sSf https://sh.rustup.rs | sh'));Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patternbin/cli.js:1880 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06console.log(chalk.white(' curl --proto \'=https\' --tlsv1.2 -sSf https://sh.rustup.rs | sh'));Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandbin/cli.js:1918 · Privileged sudo command — agent may execute with elevated privileges
AST05console.log(chalk.white(' sudo yum groupinstall "Development Tools"'));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shellbin/cli.js:1846 · Remote installer piped to shell
AST07console.log(chalk.white(' curl -fsSL https://raw.githubusercontent.com/ruvnet/ruvector/main/install.sh | bash'));Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionbin/cli.js:1011 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.white(` Input Dim: ${chalk.yellow(inputDim)}`));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Destructive file system command detectedbin/cli.js:4714 · Destructive file system command detected
AST05'Bash(rm -rf /)',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
References a credential file in the home directorybin/mcp-server.js:76 · References a credential file in the home directory
AST03// cannot cover $HOME secrets such as ~/.ssh or ~/.npmrc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebin/cli.js:770 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(chalk.white(' npx ruvector install agentic-synth # Install data generator'));Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandbin/cli.js:4716 · File permission modification command — agent changes file ownership/permissions
AST05'Bash(chmod 777:*)',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandbin/cli.js:1919 · Privileged sudo command — agent may execute with elevated privileges
AST05console.log(chalk.white(' sudo yum install openssl-devel'));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CRITICAL
Pipe-to-shell patternbin/cli.js:1846 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06console.log(chalk.white(' curl -fsSL https://raw.githubusercontent.com/ruvnet/ruvector/main/install.sh | bash'));Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandbin/cli.js:1915 · Privileged sudo command — agent may execute with elevated privileges
AST05console.log(chalk.white(' sudo apt-get install build-essential pkg-config libssl-dev'));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandbin/cli.js:1914 · Privileged sudo command — agent may execute with elevated privileges
AST05console.log(chalk.white(' sudo apt-get update'));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionbin/cli.js:1035 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.white(` Output shape: ${chalk.yellow(`[${output.length}]`)}`));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Destructive file system command detectedbin/cli.js:8976 · Destructive file system command detected
AST05// Agent skills shipped in the package (skills/<name>/SKILL.md). Same formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebin/cli.js:768 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(chalk.white(' npx ruvector install gnn # Install GNN package'));Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbin/cli.js:1036 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.white(` Output sample: ${chalk.gray(`[${output.slice(0, 4).map(v => v.toFixed(4)).join(', ')}...]`)}`));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebin/mcp-server.js:11 · npx invocation of non-well-known package — may execute untrusted code
AST06* claude mcp add ruvector npx ruvector mcp startFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/extras.js:57 · npx invocation of non-well-known package — may execute untrusted code
AST06usage: 'npx ruvector tiny-dancer info',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/diskann-wrapper.js:26 · npx invocation of non-well-known package — may execute untrusted code
AST06`Install with: npx ruvector add diskann (or: npm install @ruvector/diskann)`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/mcp-server.js:10 · npx invocation of non-well-known package — may execute untrusted code
AST06* npx ruvector mcp startFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/mcp-server.js:235 · npx invocation of non-well-known package — may execute untrusted code
AST06hint: 'Install with: npx ruvector add rvlite (or: npm install rvlite)'Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/extras.js:51 · npx invocation of non-well-known package — may execute untrusted code
AST06usage: 'npx ruvector rvf --help',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/extras.js:69 · npx invocation of non-well-known package — may execute untrusted code
AST06usage: 'npx ruvector sona info',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/agentdb-fast.d.ts:4 · npx invocation of non-well-known package — may execute untrusted code
AST06* The AgentDB CLI has ~2.3s startup overhead due to npx initialization.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/mcp-server.js:301 · npx invocation of non-well-known package — may execute untrusted code
AST06* Execute an external npx package without a shell.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/agentdb-fast.js:5 · npx invocation of non-well-known package — may execute untrusted code
AST06* The AgentDB CLI has ~2.3s startup overhead due to npx initialization.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/extras.js:63 · npx invocation of non-well-known package — may execute untrusted code
AST06usage: 'npx ruvector quantum simulate bell',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/mcp-server.js:319 · npx invocation of non-well-known package — may execute untrusted code
AST06install: e.bundled ? null : `npx ruvector add ${e.key}`,Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Unpinned dependencybin/cli.js:10447 · Unpinned dependency
AST06console.log(chalk.dim(' npm install @ruvector/ruvllm@latest\n'));Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.MEDIUM
npx invocation of non-well-known packagesrc/optimizer/index.js:7 · npx invocation of non-well-known package — may execute untrusted code
AST06* consumed by `npx ruvector optimize` and the settings generator.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/rvf-wrapper.js:40 · npx invocation of non-well-known package — may execute untrusted code
AST06loadError = new Error('@ruvector/rvf is not installed. Run: npx ruvector add rvf (or: npm install @ruvector/rvf)');Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/graph-wrapper.js:25 · npx invocation of non-well-known package — may execute untrusted code
AST06`Install with: npx ruvector add graph (or: npm install @ruvector/graph-node)`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/rabitq-wrapper.js:5 · npx invocation of non-well-known package — may execute untrusted code
AST06* Optional extra: install with `npx ruvector add rabitq`. Codes are 1 bit perFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/rabitq-wrapper.js:28 · npx invocation of non-well-known package — may execute untrusted code
AST06'Install with: npx ruvector add rabitq (or: npm install @ruvector/rabitq-wasm)');Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/router-wrapper.js:25 · npx invocation of non-well-known package — may execute untrusted code
AST06`Install with: npx ruvector add router (or: npm install @ruvector/router)`);Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈71 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for ruvector@0.3.26 as of 2d ago. This is the package itself, not its dependencies.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim ruvnet: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ruvnetPropose a patch to the maintainer