9router-ray@0.6.9: Suspicious npm security report (Warn)

Loading npm security reports…

9router-ray@0.6.9: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

18 flagged

package.jsonView file

Lines 1-41json

2 "name": "9router-ray",

3 "version": "0.6.9",

4 "description": "9Router CLI - Start and manage 9Router server",

5 "bin": {

6 "9router-ray": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "pretest": "echo 'pre-publish guard — running audit regression suite'",

23 "test": "cd ../tests && ./node_modules/.bin/vitest run unit/audit-2026-07-17.test.js unit/hooks-2026-07-18.test.js unit/metrics-2026-07-18.test.js",

24 "prepublishOnly": "npm run test && npm run build"

25 },

26 "dependencies": {

27 "enquirer": "^2.4.1",

28 "node-forge": "^1.3.3",

29 "node-machine-id": "^1.1.12",

30 "react": "19.2.1",

31 "react-dom": "19.2.1"

32 },

33 "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.9router/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",

34 "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.9router/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",

35 "engines": {

36 "node": ">=18.0.0"

37 },

38 "keywords": [

39 "9router",

40 "cli",

41 "proxy",

app/gateway.bundle.mjsView file

35672patternName = private_key_rsa severity = critical line = 35672 matchedText = if (type...0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

app/gateway.bundle.mjsView on unpkg · L35672

35672patternName = private_key_rsa severity = critical line = 35672 matchedText = if (type...0) {

Critical

Secret Pattern

RSA private key in app/gateway.bundle.mjs

app/gateway.bundle.mjsView on unpkg · L35672

393}, L394: exec(sql) { L395: return db.exec(sql);

High

Child Process

Package source references child process execution.

app/gateway.bundle.mjsView on unpkg · L393

4const require = __cjsReq(import.meta.url); L5: process.env.GATEWAY_FORCE_START = process.env.GATEWAY_FORCE_START || "1"; L6: ... L50: function defaultDir() { L51: if (process.platform === "win32") { L52: return path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), APP_NAME); L53: } ... L126: } L127: process.stdout.write(JSON.stringify(rec) + "\n"); L128: return; ... L393: }, L394: exec(sql) {

High

Cloud Metadata Access

cli.jsView file

Lines 212-252javascript

212 process.kill(pid, "SIGKILL");

213 }

214 } catch { }

215 try { fs.unlinkSync(pidFile); } catch { }

216 } catch { }

217}

218

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require

app/src/mitm/server.jsView file

Lines 4-44javascript

4${c}`;Ht.writeFileSync(n,v)}catch{}},file:n}}ei.exports={log:ku,err:Du,dumpRequest:Vu,createResponseDumper:Fu,clearDumpDir:Uu}});var Y=F((ch,ti)=>{ti.exports={options:{usePureJavaScript:!1}}});var ni=F((dh,ai)=>{var ka={};ai.exports=ka;var ri={};ka.encode=function(e,t,a){if(typeof t!="string")throw new TypeError('"alphabet" must be a string.');if(a!==void 0&&typeof a!="number")throw new TypeError('"maxline" must be a number.');var r="";if(!(e instanceof Uint8Array))r=Ku(e,t);else{var n=0,s=t.length,i=t.charAt(0),o=[0];for(n=0;n<e.length;++n){for(var u=0,l=e[n];u<o.length;++u)l+=o[u]<<8,o[u]=l% ...

5`)}return r};ka.decode=function(e,t){if(typeof e!="string")throw

app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4001 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

app/.next-cli-build/server/chunks/4306.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/4306.js

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node hooks/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node hooks/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/gateway.bundle.mjsView file

35672patternName = private_key_rsa severity = critical line = 35672 matchedText = if (type...0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

app/gateway.bundle.mjsView on unpkg · L35672

35672patternName = private_key_rsa severity = critical line = 35672 matchedText = if (type...0) {

Critical

Secret Pattern

RSA private key in app/gateway.bundle.mjs

app/gateway.bundle.mjsView on unpkg · L35672

393}, L394: exec(sql) { L395: return db.exec(sql);

High

Child Process

Package source references child process execution.

app/gateway.bundle.mjsView on unpkg · L393

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

app/gateway.bundle.mjsView on unpkg · L4

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = 9router-ray@0.6.7 matchedIdentity = npm:OXJvdXRlci1yYXk:0.6.7 similarity = 0.970 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

232if (process.platform === "win32") { L233: const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"cloudflared.exe\\"' | Select-Object ProcessId,CommandLine | Con... L234: const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: 5000 });

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L232

2Cross-file remote execution chain: cli.js spawns app/gateway.bundle.mjs; helper contains network access plus dynamic code execution. L2: L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const os = require("os"); ... L16: start() { L17: if (process.stdout.isTTY) { L18: process.stdout.write(`\r${frames[0]} ${currentText}`); L19: interval = setInterval(() => { ... L44: L45: const pkg = require("./package.json");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L2

app/server.jsView file

1const path = require('path') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

src/cli/tray/autostart.jsView file

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

app/src/mitm/server.jsView file

24Private-MAC: `+B.digest().toHex()+`\r L25: `,s};Ea.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return mr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};Ea.private... L26: `);u=v.pop()||"";for(let y of v){let x=y.trim();if(!x||!x.startsWith("data:"))continue;let S=x.slice(5).trim();if(S!=="[DONE]"){process.env.DEBUG_MITM&&Ta(`[SSE in] ${S.slice(0,200... ... L33: `):null,text:v.text||null}}function Pn(e,t){let a=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8"),n=Buffer.alloc(1+a.length+1+2+r.length),s=0;return n[s++]=a.length,a.copy(n,s),s+=a.... L34: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function hd(e){let t=e.toolU.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/src/mitm/server.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

app/src/mitm/server.js

app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4001 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

app/.next-cli-build/server/chunks/4306.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/4306.js

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

18 flagged

package.jsonView file

Lines 1-41json

2 "name": "9router-ray",

3 "version": "0.6.9",

4 "description": "9Router CLI - Start and manage 9Router server",

5 "bin": {

6 "9router-ray": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "pretest": "echo 'pre-publish guard — running audit regression suite'",

23 "test": "cd ../tests && ./node_modules/.bin/vitest run unit/audit-2026-07-17.test.js unit/hooks-2026-07-18.test.js unit/metrics-2026-07-18.test.js",

24 "prepublishOnly": "npm run test && npm run build"

25 },

26 "dependencies": {

27 "enquirer": "^2.4.1",

28 "node-forge": "^1.3.3",

29 "node-machine-id": "^1.1.12",

30 "react": "19.2.1",

31 "react-dom": "19.2.1"

32 },

35 "engines": {

36 "node": ">=18.0.0"

37 },

38 "keywords": [

39 "9router",

40 "cli",

41 "proxy",

app/gateway.bundle.mjsView file

35672patternName = private_key_rsa severity = critical line = 35672 matchedText = if (type...0) {

Critical

Critical Secret

Package contains a critical-looking secret pattern.

app/gateway.bundle.mjsView on unpkg · L35672

35672patternName = private_key_rsa severity = critical line = 35672 matchedText = if (type...0) {

Critical

Secret Pattern

RSA private key in app/gateway.bundle.mjs

app/gateway.bundle.mjsView on unpkg · L35672

393}, L394: exec(sql) { L395: return db.exec(sql);

High

Child Process

Package source references child process execution.

app/gateway.bundle.mjsView on unpkg · L393

High

Cloud Metadata Access

cli.jsView file

Lines 212-252javascript

212 process.kill(pid, "SIGKILL");

213 }

214 } catch { }

215 try { fs.unlinkSync(pidFile); } catch { }

216 } catch { }

217}

218

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require

app/src/mitm/server.jsView file

Lines 4-44javascript

5`)}return r};ka.decode=function(e,t){if(typeof e!="string")throw

app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4001 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

app/.next-cli-build/server/chunks/4306.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/4306.js

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

9router-ray@0.6.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code