@0xmaxma/claude-gateway@1.7.7: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@0xmaxma/claude-gateway@1.7.7: Suspicious npm security report | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/apps/agent-manager.jsView file

157// current host auth; `exec` keeps the container's PID 1 as sleep. L158: command: `sh -c 'cp ${claudeJsonSeed} ${homeDir}/.claude.json && exec sleep infinity'`, L159: container_name: `${entry.name}-agent`,

High

Shell

Package source references shell execution.

dist/apps/agent-manager.jsView on unpkg · L157

dist/api/router.jsView file

44Source sends the broad process environment to a literal external destination. L44: const path = __importStar(require("path")); L45: const child_process_1 = require("child_process"); L46: const runner_1 = require("../agent/runner"); ... L65: try { L66: const res = await fetch('https://slack.com/api/auth.test', { L67: method: 'POST', ... L72: }); L73: const json = (await res.json()); L74: return { ok: json.ok, error: json.error }; ... L123: }; L124: const TELEGRAM_API_BASE = process.env.TELEGRAM_API_BASE ?? 'https://api.telegram.org'; L125: /** Max simultaneous wizard/start Claude subprocesses to prevent resource exhaustion. */

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/api/router.jsView on unpkg · L44

123}; L124: const TELEGRAM_API_BASE = process.env.TELEGRAM_API_BASE ?? 'https://api.telegram.org'; L125: /** Max simultaneous wizard/start Claude subprocesses to prevent resource exhaustion. */ ... L130: return new Promise((resolve, reject) => { L131: const child = (0, child_process_1.spawn)('claude', ['--print', '--dangerously-sk[redacted]'], { L132: env: { ...process.env },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/api/router.jsView on unpkg · L123

mcp/tools/image/module.ts#virtual:normalized:round1View file

3import * as path from "node:path"; L4: import * as dns from "node:dns"; L5: import * as net from "node:net"; ... L65: // longer has the original generate call"s \"model\" argument in scope) can\n // still recover them instead of falling back to \"unknown\".\n provider?: string;\n model?: string... L66: // caught that these are two separate id spaces: the image provider"s own\n // Store is keyed by ITS OWN ids, so a later resume request naming the wrong\n // (outer) id silently ... L67: // poll loop worth reacting to a Stop mid-flight (#2216 follow-up on the ... L110: try { L111: const dir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"); L112: this.settingsEnvCache = L113: JSON.parse(fs.readFileSync(path.join(dir, "settings.json"), "utf8"))?.env ?? null; L114:

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

mcp/tools/image/module.ts#virtual:normalized:round1View on unpkg · L3

dist/api/packages.jsView file

225// Native-installer packages (e.g. claude-code) update the binary on PATH L226: // via their own updater. npm install -g would write a separate npm copy L227: // that isn't the running binary, so it must not be used here. ... L230: try { L231: (0, child_process_1.execSync)(`${config.bin} update`, { L232: stdio: ['pipe', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/api/packages.jsView on unpkg · L225

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/apps/socket-server.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/agent/skill-learning/reviewer.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/agent/sk[redacted]/reviewer.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agent/skill-learning/reviewer.jsView on unpkg

dist/api/skills-router.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/api/sk[redacted] matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/shell/pty-host.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/shell/pty-host.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/shell/pty-host.jsView on unpkg

dist/agent/skill-learning/notifier.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/agent/sk[redacted]/notifier.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agent/skill-learning/notifier.jsView on unpkg

Lines 103-143javascript

103function detectMimeFromMagic(header) {

104 if (header[0] === 0xFF && header[1] === 0xD8 && header[2] === 0xFF)

105 return 'image/jpeg';

106 if (header[0] === 0x89 && header[1] === 0x50 && header[2] === 0x4E && header[3] === 0x47)

107 return 'image/png';

108 if (header[0] === 0x47 && header[1] === 0x49 && header[2] === 0x46)

109 return 'image/gif';

110 if (header[0] === 0x52 && header[1] === 0x49 && header[2] === 0x46 && header[3] === 0x46 &&

111 header[8] === 0x57 && header[9] === 0x45 && header[10] === 0x42 && header[11] === 0x50)

112 return 'image/webp';

113 if (header[0] === 0x25 && header[1] === 0x50 && header[2] === 0x44 && header[3] === 0x46)

114 return 'application/pdf';

115 return null;

116}

117const AVATAR_MAX_BYTES = 5 * 1024 * 1024;

118const AVATAR_MIME_EXT = {

119 'image/jpeg': 'jpg',

120 'image/png': 'png',

121 'image/gif': 'gif',

122 'image/webp': 'webp',

123};

124const TELEGRAM_API_BASE = process.env.TELEGRAM_API_BASE ?? 'https://api.telegram.org';

125/** Max simultaneous wizard/start Claude subprocesses to prevent resource exhaustion. */

126let wizardStartsInFlight = 0;

127const WIZARD_MAX_CONCURRENT = 2;

128/** Call Claude --print with stdin prompt; resolves with stdout on exit 0. */

129function runClaude(prompt, timeoutMs = 120000) {

130 return new Promise((resolve, reject) => {

131 const child = (0, child_process_1.spawn)('claude', ['--print', '--dangerously-skip-permissions'], {

132 env: { ...process.env },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/api/router.jsView on unpkg · L123

133 stdio: ['pipe', 'pipe', 'pipe'],

134 });

135 const out = [];

136 const err = [];

137 child.stdout.on('data', (c) => out.push(c));

138 child.stderr.on('data', (c) => err.push(c));

139 const timer = setTimeout(() => { child.kill(); reject(new Error('Claude generation timed out')); }, timeoutMs);

140 child.on('close', (code) => {

141 clearTimeout(timer);

142 if (code === 0)

143 resolve(Buffer.concat(out).toString('utf-8'));