@0xmaxma/claude-gateway@2.0.16: Manual Review npm security report

Loading npm security reports…

@0xmaxma/claude-gateway@2.0.16: Manual Review npm security report | LPM Firewall

Source & flagged code

19 flagged

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/apps/agent-manager.jsView file

229// L230: // Paths are double-quoted inside the single-quoted `sh -c` argument: homeDir L231: // is host-derived and may contain spaces, which would otherwise split into

High

Shell

Package source references shell execution.

dist/apps/agent-manager.jsView on unpkg · L229

dist/jev/browser-module-import.jsView file

4// Preserve native import for optional ESM packages when gateway is compiled as CJS. L5: exports.importBrowserModule = new Function('url', 'return import(url)'); L6: //# sourceMappingURL=browser-module-import.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/jev/browser-module-import.jsView on unpkg · L4

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

scripts/orchestration/audit-codex-context.cjsView file

7const {resolveWorkerHarness}=require('../../src/orchestration/worker-harness'); L8: const fs=require('fs/promises'),path=require('path'),os=require('os'),http=require('http'); L9: const {execFileSync}=require('child_process'),{once}=require('events'); L10: const args=process.argv.slice(2); ... L17: const directory=await fs.mkdtemp(path.join(os.tmpdir(),'gateway-context-audit-')); L18: const previous=process.env.GATEWAY_CONTEXT_AUDIT_KEY; L19: process.env.GATEWAY_CONTEXT_AUDIT_KEY='local-fixture-only';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

104Source sends the broad process environment to a literal external destination. L104: for (const event of events.slice().reverse()) { L105: const e = JSON.parse(String(event.payload_json)).payload; L106: if (e.type !== 'tool_use' || e.name === 'StructuredOutput' || seen.has(e.id)) ... L122: const elapsed = hours > 0 ? `${hours}h ${mins}m` : mins > 0 ? (secs > 0 ? `${mins}m ${secs}s` : `${mins}m`) : `${secs}s`; L123: const secrets = Object.entries(process.env).filter(([k, v]) => /TOKEN|SECRET|PASSWORD|API_KEY/i.test(k) && v && v.length >= 8).map(([, v]) => v); L124: const text = (0, incident_1.scrubText)([...last.map(d => `☑️ : ${d}`), last.length ? `🕐 : ${current}` : current, `(elapsed: ${elapsed})`].join('\n'), [token, ...secrets]).slice(0, ... ... L136: status.moveAttemptAt = Date.now();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/orchestration/telegram-tool-status.jsView on unpkg · L104

104Trigger-reachable chain: manifest.main -> dist/index.js -> dist/agent/runner.js -> dist/orchestration/runtime.js -> dist/orchestration/telegram-tool-status.js L104: for (const event of events.slice().reverse()) { L105: const e = JSON.parse(String(event.payload_json)).payload; L106: if (e.type !== 'tool_use' || e.name === 'StructuredOutput' || seen.has(e.id)) ... L122: const elapsed = hours > 0 ? `${hours}h ${mins}m` : mins > 0 ? (secs > 0 ? `${mins}m ${secs}s` : `${mins}m`) : `${secs}s`; L123: const secrets = Object.entries(process.env).filter(([k, v]) => /TOKEN|SECRET|PASSWORD|API_KEY/i.test(k) && v && v.length >= 8).map(([, v]) => v); L124: const text = (0, incident_1.scrubText)([...last.map(d => `☑️ : ${d}`), last.length ? `🕐 : ${current}` : current, `(elapsed: ${elapsed})`].join('\n')

Critical

Trigger Reachable Dangerous Capability

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

4* "custom" MCP connectors whose only auth option is a real OAuth sign-in (no L5: * static API key) — e.g. Firecrawl"s `https://mcp.firecrawl.dev/v2/mcp-oauth`.\n *\n * This module never touches Express or the pending-flow store — pure discovery\n * + token func... L6: * ... L36: * L37: * Node"s fetch defaults to `redirect: "follow"`, and a followed redirect goes\n * wherever the answering server names — without passing through\n * `assertFetchableUrl`, which only... L38: if (!location) ... L50: ? init L51: : { ...init, method: "GET", body: undefined }; L52: } ... L144: if (!resourceMetadataUrl) { L145: throw new Error(`${mcpUrl} returned 401 but no "resource_metadata" in its WWW-Authenticate header — can"t discover its OAuth server.`);\n }\n const prm = await fetchFollowing... L1

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

13Cross-file remote execution chain: dist/orchestration/container.js spawns dist/session/process.js; helper contains network access plus dynamic code execution. L13: const checkpoint_hook_1 = require("./tasks/checkpoint-hook"); L14: const child_process_1 = require("child_process"); L15: const util_1 = require("util"); ... L30: throw new types_1.OrchestrationError('CONTAINER_REQUIRED'); L31: const { stdout } = await exec('docker', ['inspect', agent.container], { timeout: 10000 }); L32: await validateContainerInspection(agent, JSON.parse(stdout)[0]); L33: } ... L56: const h = c.HostConfig; L57: if ((options.requireRunning !== false && !c.State?.Running) || !h || h.Privileged || (h.NetworkMode === 'host' || String(h.NetworkMode).startsWith('container:')) || h.PidMode || ![... L58: throw new typ

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/packages/registry.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/apps/socket-server.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/cli/commands/gateway.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/api/skills-router.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/api/sk[redacted] matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/apps/compose-generator.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/api/router.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @0xmaxma/claude-gateway@2.0.10 matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:2.0.10 similarity = 0.658 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/api/router.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/apps/agent-manager.jsView file

229// L230: // Paths are double-quoted inside the single-quoted `sh -c` argument: homeDir L231: // is host-derived and may contain spaces, which would otherwise split into

High

Shell

Package source references shell execution.

dist/apps/agent-manager.jsView on unpkg · L229

dist/jev/browser-module-import.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/jev/browser-module-import.jsView on unpkg · L4

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

scripts/orchestration/audit-codex-context.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/orchestration/telegram-tool-status.jsView on unpkg · L104

Critical

Trigger Reachable Dangerous Capability

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/api/skills-router.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/api/router.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/api/router.jsView on unpkg

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/apps/agent-manager.jsView file

229// L230: // Paths are double-quoted inside the single-quoted `sh -c` argument: homeDir L231: // is host-derived and may contain spaces, which would otherwise split into

High

Shell

Package source references shell execution.

dist/apps/agent-manager.jsView on unpkg · L229

dist/jev/browser-module-import.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/jev/browser-module-import.jsView on unpkg · L4

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

scripts/orchestration/audit-codex-context.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/orchestration/telegram-tool-status.jsView on unpkg · L104

Critical

Trigger Reachable Dangerous Capability

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/api/skills-router.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/api/router.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/api/router.jsView on unpkg

@0xmaxma/claude-gateway@2.0.16

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code