registry / @0xmaxma/claude-gateway / 1.3.19

@0xmaxma/claude-gateway@1.3.19

Multi-agent gateway for Claude

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The package exposes powerful runtime automation: spawning Claude sessions, package updates, Docker/app installation, and workspace prompt file writes. These are dangerous capabilities for a gateway but appear user/admin-invoked and package-aligned rather than covert malware.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install postinstall; authenticated runtime API or configured agent startup

Impact

Authenticated users or configured agents can cause local command execution and workspace/config mutation within the product's intended control plane.

Mechanism

gateway-managed subprocess/package-manager/docker execution

Attack narrative

Install-time behavior conditionally runs `bun install --cwd mcp`, which may fetch dependencies but does not itself execute a hidden payload in package source. Runtime code starts a Claude gateway that can spawn subprocesses, call Telegram/Discord/npm/GitHub endpoints, update global packages, run Docker app installs, and rewrite workspace CLAUDE.md as part of agent orchestration. These are broad dual-use capabilities, but inspected source ties them to configured gateway features and authenticated/admin actions.

Rationale

Static source inspection confirms high-risk runtime control-plane features and an install lifecycle dependency install, but not covert credential harvesting, exfiltration, persistence, or unconsented install-time AI-agent hijacking. Downgrade to warn because the dangerous capability is real but package-aligned.

Evidence

package.jsonmcp/package.jsonmcp/server.tsdist/index.jsdist/session/process.jsdist/api/router.jsdist/api/auth.jsdist/api/packages.jsdist/apps/installer.jsmcp/~/.claude-gateway/.env~/.claude-gateway/agents/<id>/.envCLAUDE.mdconfig.json

Network endpoints5

api.telegram.orgdiscord.com/api/v10registry.npmjs.orgraw.githubusercontent.com/0xMaxMa/claude-gateway-appstore/main/apps.json127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json postinstall runs `bun install --cwd mcp` when bun exists
dist/session/process.js spawns Claude subprocesses with workspace cwd and env tokens
dist/api/packages.js admin route can run `npm install -g ...@latest` at runtime
dist/apps/installer.js can run git/docker/sudo commands for app installation workflows
dist/index.js writes generated CLAUDE.md into configured agent workspaces

Evidence against

No install-time code beyond package-manager install in mcp directory was found
No hardcoded command-output exfiltration endpoint or hidden C2 host found
Network hosts are package-aligned: Telegram, Discord, npm registry, GitHub/appstore, local gateway callbacks
API routes use configured API-key auth for agent messages and package update admin checks
Env file reads load declared ~/.claude-gateway and per-agent configuration for runtime operation

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 101 file(s), 1.18 MB of source, external domains: 127.0.0.1, api.telegram.org, cdn.jsdelivr.net, discord.com, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

Lines 10-50json

10 "bin": {

11 "claude-gateway": "./dist/index.js"

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "files": [

17 "dist/",

18 "lib/",

19 "resource/",

20 "mcp/",

21 "README.md",

22 "config.template.json"

23 ],

24 "publishConfig": {

25 "access": "public"

26 },

27 "scripts": {

28 "build": "tsc",

29 "start": "node --no-warnings=ExperimentalWarning --env-file-if-exists=.env dist/index.js",

30 "postinstall": "if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L30

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "test": "jest",

32 "test:unit": "jest --testPathPattern=unit",

33 "test:e2e": "jest --testPathPattern=tests/e2e --forceExit",

34 "integration": "jest --testPathPattern=integration --testTimeout=15000",

35 "integration:ma": "jest --testPathPattern=multi-agent --testTimeout=15000",

36 "test:manual": "jest --testPathPattern=phase-manual --testTimeout=15000",

37 "integration:hb": "jest --testPathPattern=heartbeat-e2e --testTimeout=15000",

38 "integration:cs": "jest --testPathPattern=character-system --testTimeout=15000",

39 "typecheck": "tsc --noEmit"

40 },

41 "dependencies": {

42 "@line/bot-sdk": "^11.0.2",

43 "@xterm/headless": "^6.0.0",

44 "chokidar": "^3.5.0",

45 "cron-parser": "^5.5.0",

46 "express": "^4.18.0",

47 "js-yaml": "^4.1.0",

48 "lru-cache": "^10.0.0",

49 "node-cron": "^3.0.0",

50 "node-pty": "^1.1.0",

dist/discord/receiver.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys

dist/api/router.jsView file

Lines 22-101javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

dist/api/packages.jsView file

Lines 172-212javascript

172 // Reject if another update is already in progress

173 if (isUpdating) {

174 res.status(409).json({ error: 'update already in progress' });

175 return;

176 }

177 isUpdating = true;

178 try {

dist/agent/runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @0xmaxma/claude-gateway@1.3.18 matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.3.18 similarity = 0.960 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent/runner.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/api/router.jsView file

42const path = __importStar(require("path")); L43: const child_process_1 = require("child_process"); L44: const runner_1 = require("../agent/runner"); ... L81: }; L82: const TELEGRAM_API_BASE = process.env.TELEGRAM_API_BASE ?? 'https://api.telegram.org'; L83: /** Max simultaneous wizard/start Claude subprocesses to prevent resource exhaustion. */ ... L85: const WIZARD_MAX_CONCURRENT = 2; L86: /** Call Claude --print with stdin prompt; resolves with stdout on exit 0. */ L87: function runClaude(prompt, timeoutMs = 120000) { ... L100: if (code === 0) L101: resolve(Buffer.concat(out).toString('utf-8')); L102: else

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/api/router.jsView on unpkg · L42

42Trigger-reachable chain: manifest.main -> dist/index.js -> dist/api/gateway-router.js -> dist/api/router.js L42: const path = __importStar(require("path")); L43: const child_process_1 = require("child_process"); L44: const runner_1 = require("../agent/runner"); ... L81: }; L82: const TELEGRAM_API_BASE = process.env.TELEGRAM_API_BASE ?? 'https://api.telegram.org'; L83: /** Max simultaneous wizard/start Claude subprocesses to prevent resource exhaustion. */ ... L85: const WIZARD_MAX_CONCURRENT = 2; L86: /** Call Claude --print with stdin prompt; resolves with stdout on exit 0. */ L87: function runClaude(prompt, timeoutMs = 120000) { ... L100: if (code === 0) L101: resolve(Buffer.concat(out).toString('utf-8')); L102: else

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api/router.jsView on unpkg · L42

81}; L82: const TELEGRAM_API_BASE = process.env.TELEGRAM_API_BASE ?? 'https://api.telegram.org'; L83: /** Max simultaneous wizard/start Claude subprocesses to prevent resource exhaustion. */ ... L88: return new Promise((resolve, reject) => { L89: const child = (0, child_process_1.spawn)('claude', ['--print', '--dangerously-sk[redacted]'], { L90: env: { ...process.env },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/api/router.jsView on unpkg · L81

dist/api/packages.jsView file

192try { L193: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { L194: stdio: ['pipe', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/api/packages.jsView on unpkg · L192

dist/agent/runner.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent/runner.jsView on unpkg

Findings

4 Critical5 High3 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalCommand Output Exfiltrationdist/api/router.js

CriticalTrigger Reachable Dangerous Capabilitydist/api/router.js

CriticalPrevious Version Dangerous Deltadist/agent/runner.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/discord/receiver.js

HighShell

HighSame File Env Network Executiondist/api/router.js

HighRuntime Package Installdist/api/packages.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

package.jsonView file

Lines 10-50json

10 "bin": {

11 "claude-gateway": "./dist/index.js"

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "files": [

17 "dist/",

18 "lib/",

19 "resource/",

20 "mcp/",

21 "README.md",

22 "config.template.json"

23 ],

24 "publishConfig": {

25 "access": "public"

26 },

27 "scripts": {

28 "build": "tsc",

29 "start": "node --no-warnings=ExperimentalWarning --env-file-if-exists=.env dist/index.js",

30 "postinstall": "if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L30

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "test": "jest",

32 "test:unit": "jest --testPathPattern=unit",

33 "test:e2e": "jest --testPathPattern=tests/e2e --forceExit",

34 "integration": "jest --testPathPattern=integration --testTimeout=15000",

35 "integration:ma": "jest --testPathPattern=multi-agent --testTimeout=15000",

36 "test:manual": "jest --testPathPattern=phase-manual --testTimeout=15000",

37 "integration:hb": "jest --testPathPattern=heartbeat-e2e --testTimeout=15000",

38 "integration:cs": "jest --testPathPattern=character-system --testTimeout=15000",

39 "typecheck": "tsc --noEmit"

40 },

41 "dependencies": {

42 "@line/bot-sdk": "^11.0.2",

43 "@xterm/headless": "^6.0.0",

44 "chokidar": "^3.5.0",

45 "cron-parser": "^5.5.0",

46 "express": "^4.18.0",

47 "js-yaml": "^4.1.0",

48 "lru-cache": "^10.0.0",

49 "node-cron": "^3.0.0",

50 "node-pty": "^1.1.0",

dist/discord/receiver.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys

dist/api/router.jsView file

Lines 22-101javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

dist/api/packages.jsView file

Lines 172-212javascript

172 // Reject if another update is already in progress

173 if (isUpdating) {

174 res.status(409).json({ error: 'update already in progress' });

175 return;

176 }

177 isUpdating = true;

178 try {

dist/agent/runner.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent/runner.jsView on unpkg