registry / @0xmaxma/claude-gateway / 1.8.7

@0xmaxma/claude-gateway@1.8.7

Multi-agent gateway for Claude

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Package installation for the dependency install; a user-started gateway session for the Claude configuration write.

Impact

The package expands install-time dependency execution and bypasses Claude Code's workspace trust confirmation for sessions it starts.

Mechanism

Automatic MCP dependency installation and Claude trust-dialog suppression.

AI rationale

The source does not establish secret theft, remote payload execution, or an install-time foreign control-surface write. It does establish a user-invoked Claude trust-dialog bypass and install-time nested dependency execution, so warning is appropriate.

Evidence

package.jsondist/shell/trust.jsdist/shell/claude-pty-shell.jsdist/session/process.jsmcp/~/.claude.json<workspace>/.sessions/<sessionId>/mcp-config.json

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The automatic postinstall runs Bun dependency installation in the bundled MCP directory.
When a gateway session starts, the package writes trust and onboarding approvals into Claude Code's global configuration.
The generated MCP configuration passes channel tokens and gateway API credentials to a Bun subprocess.

Evidence against

The postinstall does not modify Claude configuration or run this package's CLI.
No runtime dependency on this package itself is declared.
The inspected network endpoints are registry, local gateway, and configured messaging-provider endpoints; no separate collector was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 219 file(s), 2.84 MB of source, external domains: 127.0.0.1, api.line.me, api.telegram.org, cdn.jsdelivr.net, discord.com, github.com, raw.githubusercontent.com, registry.npmjs.org, slack.com, telegram.org, www.npmjs.com

Source & flagged code

8 flagged

package.jsonView file

Lines 12-52json

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "files": [

17 "dist/",

18 "lib/",

19 "resource/",

20 "mcp/",

21 "!mcp/node_modules",

22 "!mcp/node_modules/**",

23 "README.md",

24 "config.template.json"

25 ],

26 "publishConfig": {

27 "access": "public"

28 },

29 "scripts": {

30 "build": "tsc",

31 "start": "node --no-warnings=ExperimentalWarning --env-file-if-exists=.env dist/entry.js gateway start",

32 "postinstall": "if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L32

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "pretest": "npm run build",

34 "test": "NODE_OPTIONS=--max-old-space-size=2560 jest",

35 "pretest:unit": "npm run build",

36 "test:unit": "jest --testPathPattern=unit",

37 "test:e2e": "jest --testPathPattern=tests/e2e --forceExit",

38 "integration": "jest --testPathPattern=integration --testTimeout=15000",

39 "integration:ma": "jest --testPathPattern=multi-agent --testTimeout=15000",

40 "test:manual": "jest --testPathPattern=phase-manual --testTimeout=15000",

41 "integration:hb": "jest --testPathPattern=heartbeat-e2e --testTimeout=15000",

42 "integration:cs": "jest --testPathPattern=character-system --testTimeout=15000",

43 "typecheck": "tsc --noEmit",

44 "gen-cli": "ts-node scripts/gen-cli.ts",

45 "gen-cli:check": "ts-node scripts/gen-cli.ts --check"

46 },

47 "dependencies": {

48 "@line/bot-sdk": "^11.0.2",

49 "@xterm/headless": "^6.0.0",

50 "chokidar": "^3.5.0",

51 "cron-parser": "^5.5.0",

52 "express": "^4.18.0",

dist/discord/receiver.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys

dist/webhook/manager.jsView file

Lines 28-68javascript

28var __importStar = (this && this.__importStar) || (function () {

29 var ownKeys = function(o) {

30 ownKeys

dist/api/router.jsView file

Lines 251-291javascript

251function detectMimeFromMagic(header) {

252 if (header[0] === 0xFF && header[1] === 0xD8 && header[2]

dist/packages/registry.jsView file

Lines 168-208javascript

168}

169/**

170 * Install the latest version of an npm-global package.

171 *

172 * A previously interrupted install can leave `.<pkg>-<hash>` staging dirs in the

173 * npm global root that make the next install fail with ENOTEMPTY/ENOTDIR, so

174 * those are pre-cleaned and the install is retried once after removing the

175 * half-written package directory. Returns null on success, or the error text.

176 */

177function

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/agent/runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @0xmaxma/claude-gateway@1.8.6 matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.6 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/runner.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

dist/api/router.jsView file

271}; L272: const TELEGRAM_API_BASE = process.env.TELEGRAM_API_BASE ?? 'https://api.telegram.org'; L273: /** Max simultaneous wizard/start Claude subprocesses to prevent resource exhaustion. */ ... L278: return new Promise((resolve, reject) => { L279: const child = (0, child_process_1.spawn)('claude', ['--print', '--dangerously-sk[redacted]'], { L280: env: { ...process.env },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/api/router.jsView on unpkg · L271

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/agent/runner.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/runner.jsView on unpkg

Findings

2 Critical6 High4 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltadist/agent/runner.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/discord/receiver.js

HighShell

HighSame File Env Network Executiondist/api/router.js

HighRuntime Package Installdist/packages/registry.js

HighSemantic Analysis Limiteddist/agent/dreaming/migrate.js#virtual:normalized:round1

MediumDynamic Requiredist/webhook/manager.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @0xmaxma/claude-gateway@1.8.7.

See version security history for other recorded verdicts.

Review the evidence and your use of @0xmaxma/claude-gateway@1.8.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-05 03:37:46.341Z (UTC).