registry / 9router-gacor / 0.5.39

9router-gacor@0.5.39

9router-gacor — FREE AI Router & Token Saver. Route Claude Code / Cursor / Codex / Cline / Copilot to 3 aggregator providers (CodeBuddy, CodeBuddy CN, Qwen Cloud) with auto-fallback, quota tracker, and 20-40% token savings.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 566 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.example.com, registry.npmjs.org, www.apple.com

Source & flagged code

15 flagged

package.jsonView file

Lines 10-50json

10 "type": "git",

11 "url": "https://github.com/rrivann/9router.git"

12 },

13 "homepage": "https://github.com/rrivann/9router#readme",

14 "bugs": {

15 "url": "https://github.com/rrivann/9router/issues"

16 },

17 "files": [

18 "cli.js",

19 "src",

20 "hooks",

21 "app",

22 "README.md",

23 "LICENSE"

24 ],

25 "scripts": {

26 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

27 "build": "node scripts/build-cli.js",

28 "pack:cli": "npm run build && npm pack --pack-destination ../..",

29 "publish:cli": "npm run build && npm publish",

30 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "prepublishOnly": "npm run build"

32 },

33 "dependencies": {

34 "enquirer": "^2.4.1",

35 "node-forge": "^1.3.3",

36 "node-machine-id": "^1.1.12",

37 "react": "19.2.1",

38 "react-dom": "19.2.1"

39 },

40 "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.9router/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",

41 "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.9router/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",

42 "engines": {

43 "node": ">=18.0.0"

44 },

45 "keywords": [

46 "9router",

47 "cli",

48 "proxy",

49 "ai",

50 "api"

app/.next-cli-build/server/chunks/4306.jsView file

Lines 1-1javascript

1"use strict";exports.id=4306,exports.ids=[4306],exports.modules={37221:(a,b,c)=>{let d;c.

app/src/mitm/server.jsView file

Lines 4-52javascript

4${c}`;qt.writeFileSync(n,v)}catch{}},file:n}}Xn.exports={log:wu,err:Ru,dumpRequest:Uu,createResponseDumper:Pu,clearDumpDir:Lu}});var Y=F((oh,Jn)=>{Jn.exports={options:{usePureJavaScript:!1}}});var ti=F((uh,ei)=>{var wa={};ei.exports=wa;var Zn={};wa.encode=function(e,t,a){if(typeof t!="string")throw new TypeError('"alphabet" must be a string.');if(a!==void 0&&typeof a!="number")throw new TypeError('"maxline" must be a number.');var r="";if(!(e instanceof Uint8Array))r=Ou(e,t);else{var n=0,s=t.length,i=t.charAt(0),o=[0];for(n=0;n<e.length;++n){for(var u=0,l=e[n];u<o.length;++u)l+=o[u]<<8,o[u]=l% ...

5`)}return r};wa.decode=function(e,t){if(typeof e!="string")throw

cli.jsView file

Lines 205-245javascript

205 process.kill(pid, "SIGKILL");

206 }

207 } catch { }

208 try { fs.unlinkSync(pidFile); } catch { }

209 } catch { }

210}

211

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require

app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4001 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

15 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code