Loading npm security reports…

@0xmaxma/claude-gateway@1.8.14: AI-agent control-surface risk | LPM Firewall

registry / @0xmaxma/claude-gateway / 1.8.14

@0xmaxma/claude-gateway@1.8.14

Multi-agent gateway for Claude

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The package forces Claude Code into permission-bypass mode for gateway sessions. In its PTY mode, it also modifies Claude Code's global trust configuration and accepts the resulting confirmation dialog.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Starting a gateway session; the global configuration write occurs when the PTY backend is used.

Impact

Claude Code can run tools in the selected workspace without its normal permission or trust confirmations.

Mechanism

Forced permission bypass and automated Claude Code trust approval.

Policy narrative

Installation automatically installs the nested MCP project when Bun is available. At runtime, all gateway sessions receive Claude Code's dangerously-skip-permissions flag. When the PTY backend is selected, the package writes approval flags to ~/.claude.json and drives the bypass confirmation dialog to acceptance. This removes a separate AI agent's user-facing workspace trust and permission controls without an opt-in setting.

AI rationale

This package deliberately disables and programmatically approves Claude Code safety controls, including a write to its global configuration. The behavior is concrete, automatic for sessions, and extends beyond ordinary gateway operation.

Evidence

package.jsondist/session/process.jsdist/shell/trust.jsdist/shell/claude-pty-shell.js~/.claude.json

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

dist/cron/manager.jsView file

41const crypto_1 = require("crypto"); L42: const child_process_1 = require("child_process"); L43: const cron_parser_1 = require("cron-parser"); L44: const DEFAULT_STORE_PATH = path.join(process.env.HOME ?? '/tmp', '.claude-gateway', 'crons.json'); L45: const DEFAULT_RUNS_DIR = path.join(process.env.HOME ?? '/tmp', '.claude-gateway', 'cron-runs'); ... L47: const DEFAULT_TIMEOUT_MS = 120000; L48: const TELEGRAM_API_BASE = 'https://api.telegram.org'; L49: const DISCORD_API_BASE = 'https://discord.com/api/v10';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cron/manager.jsView on unpkg · L41

dist/api/router.jsView file

45const path = __importStar(require("path")); L46: const child_process_1 = require("child_process"); L47: const runner_1 = require("../agent/runner"); ... L74: try { L75: const res = await fetch('https://slack.com/api/auth.test', { L76: method: 'POST', ... L81: }); L82: const json = (await res.json()); L83: return { ok: json.ok, error: json.error }; ... L151: try { L152: res.write(`data: ${JSON.stringify({ ...event, seq })}\n\n`); L153: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/api/router.jsView on unpkg · L45

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/agent/runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @0xmaxma/claude-gateway@1.8.13 matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.13 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/runner.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

dist/cron/manager.jsView file

41const crypto_1 = require("crypto"); L42: const child_process_1 = require("child_process"); L43: const cron_parser_1 = require("cron-parser"); L44: const DEFAULT_STORE_PATH = path.join(process.env.HOME ?? '/tmp', '.claude-gateway', 'crons.json'); L45: const DEFAULT_RUNS_DIR = path.join(process.env.HOME ?? '/tmp', '.claude-gateway', 'cron-runs'); ... L47: const DEFAULT_TIMEOUT_MS = 120000; L48: const TELEGRAM_API_BASE = 'https://api.telegram.org'; L49: const DISCORD_API_BASE = 'https://discord.com/api/v10';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cron/manager.jsView on unpkg · L41

dist/api/router.jsView file

45const path = __importStar(require("path")); L46: const child_process_1 = require("child_process"); L47: const runner_1 = require("../agent/runner"); ... L74: try { L75: const res = await fetch('https://slack.com/api/auth.test', { L76: method: 'POST', ... L81: }); L82: const json = (await res.json()); L83: return { ok: json.ok, error: json.error }; ... L151: try { L152: res.write(`data: ${JSON.stringify({ ...event, seq })}\n\n`); L153: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/api/router.jsView on unpkg · L45

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/agent/runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @0xmaxma/claude-gateway@1.8.13 matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.13 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/runner.jsView on unpkg