@0xmaxma/claude-gateway@2.0.7: Suspicious npm security report

Loading npm security reports…

@0xmaxma/claude-gateway@2.0.7: Suspicious npm security report | LPM Firewall

Source & flagged code

19 flagged

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.DiscordReceiver = void 0;

37const child_process_1 = require("child_process");

38const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

39const logger_1 = require("../logger");

40const stop_child_1 = require("../utils/stop-child");

41const AUTO_RESTART_DELAY_MS = 5000;

42const MAX_RESTARTS = 3;

43// After MAX_RESTARTS fast attempts, fall back to a slow indefinite retry

44// instead of giving up permanently — self-heals if the admin fixes the

45// underlying cause later (e.g. a Discord Developer Portal intent toggle)

46// without needing to notice and manually reconnect.

47const SLOW_RESTART_DELAY_MS = 5 * 60000;

48class DiscordReceiver {

49 constructor(agentConfig, callbackPort, logDir, headless = true) {

50 this.agentConfig = agentConfig;

51 this.callbackPort = callbackPort;

52 this.logDir = logDir;

53 this.headless = headless;

54 this.process = null;

55 this.stopping = false;

56 this.restartCount = 0;

dist/apps/agent-manager.jsView file

229// L230: // Paths are double-quoted inside the single-quoted `sh -c` argument: homeDir L231: // is host-derived and may contain spaces, which would otherwise split into

High

Shell

Package source references shell execution.

dist/apps/agent-manager.jsView on unpkg · L229

dist/webhook/manager.jsView file

Lines 28-68javascript

28var __importStar = (this && this.__importStar) || (function () {

29 var ownKeys = function(o) {

30 ownKeys

scripts/orchestration/audit-codex-context.cjsView file

7const {resolveWorkerHarness}=require('../../src/orchestration/worker-harness'); L8: const fs=require('fs/promises'),path=require('path'),os=require('os'),http=require('http'); L9: const {execFileSync}=require('child_process'),{once}=require('events'); L10: const args=process.argv.slice(2); ... L17: const directory=await fs.mkdtemp(path.join(os.tmpdir(),'gateway-context-audit-')); L18: const previous=process.env.GATEWAY_CONTEXT_AUDIT_KEY; L19: process.env.GATEWAY_CONTEXT_AUDIT_KEY='local-fixture-only';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

Lines 84-124javascript

84 }

85 continue;

86 }

87 // Telegram has no viewport/page signal. Count only observed, visible

88 // messages in this account/chat/topic, excluding synthetic task reports

89 // as inputs and excluding this best-effort status message itself.

90 const canMove

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

4* "custom" MCP connectors whose only auth option is a real OAuth sign-in (no L5: * static API key) — e.g. Firecrawl"s `https://mcp.firecrawl.dev/v2/mcp-oauth`.\n *\n * This module never touches Express or the pending-flow store — pure discovery\n * + token func... L6: * ... L36: * L37: * Node"s fetch defaults to `redirect: "follow"`, and a followed redirect goes\n * wherever the answering server names — without passing through\n * `assertFetchableUrl`, which only... L38: if (!location) ... L50: ? init L51: : { ...init, method: "GET", body: undefined }; L52: } ... L144: if (!resourceMetadataUrl) { L145: throw new Error(`${mcpUrl} returned 401 but no "resource_metadata" in its WWW-Authenticate header — can"t discover its OAuth server.`);\n }\n const prm = await fetchFollowing... L1

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

13Cross-file remote execution chain: dist/orchestration/container.js spawns dist/session/process.js; helper contains network access plus dynamic code execution. L13: const checkpoint_hook_1 = require("./tasks/checkpoint-hook"); L14: const child_process_1 = require("child_process"); L15: const util_1 = require("util"); ... L30: throw new types_1.OrchestrationError('CONTAINER_REQUIRED'); L31: const { stdout } = await exec('docker', ['inspect', agent.container], { timeout: 10000 }); L32: await validateContainerInspection(agent, JSON.parse(stdout)[0]); L33: } ... L56: const h = c.HostConfig; L57: if ((options.requireRunning !== false && !c.State?.Running) || !h || h.Privileged || (h.NetworkMode === 'host' || String(h.NetworkMode).startsWith('container:')) || h.PidMode || ![... L58: throw new typ

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/packages/registry.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/apps/socket-server.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/cli/commands/gateway.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/session/compactor.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/session/compactor.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/session/compactor.jsView on unpkg

dist/api/skills-router.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/api/sk[redacted] matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/apps/compose-generator.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/orchestration/capabilities.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @0xmaxma/claude-gateway@2.0.5 matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:2.0.5 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/orchestration/capabilities.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/apps/agent-manager.jsView file

229// L230: // Paths are double-quoted inside the single-quoted `sh -c` argument: homeDir L231: // is host-derived and may contain spaces, which would otherwise split into

High

Shell

Package source references shell execution.

dist/apps/agent-manager.jsView on unpkg · L229

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

scripts/orchestration/audit-codex-context.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

104Source sends the broad process environment to a literal external destination. L104: for (const event of events.slice().reverse()) { L105: const e = JSON.parse(String(event.payload_json)).payload; L106: if (e.type !== 'tool_use' || e.name === 'StructuredOutput' || seen.has(e.id)) ... L122: const elapsed = hours > 0 ? `${hours}h ${mins}m` : mins > 0 ? (secs > 0 ? `${mins}m ${secs}s` : `${mins}m`) : `${secs}s`; L123: const secrets = Object.entries(process.env).filter(([k, v]) => /TOKEN|SECRET|PASSWORD|API_KEY/i.test(k) && v && v.length >= 8).map(([, v]) => v); L124: const text = (0, incident_1.scrubText)([...last.map(d => `☑️ : ${d}`), last.length ? `🕐 : ${current}` : current, `(elapsed: ${elapsed})`].join('\n'), [token, ...secrets]).slice(0, ... ... L136: status.moveAttemptAt = Date.now();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/orchestration/telegram-tool-status.jsView on unpkg · L104

104Trigger-reachable chain: manifest.main -> dist/index.js -> dist/agent/runner.js -> dist/orchestration/runtime.js -> dist/orchestration/telegram-tool-status.js L104: for (const event of events.slice().reverse()) { L105: const e = JSON.parse(String(event.payload_json)).payload; L106: if (e.type !== 'tool_use' || e.name === 'StructuredOutput' || seen.has(e.id)) ... L122: const elapsed = hours > 0 ? `${hours}h ${mins}m` : mins > 0 ? (secs > 0 ? `${mins}m ${secs}s` : `${mins}m`) : `${secs}s`; L123: const secrets = Object.entries(process.env).filter(([k, v]) => /TOKEN|SECRET|PASSWORD|API_KEY/i.test(k) && v && v.length >= 8).map(([, v]) => v); L124: const text = (0, incident_1.scrubText)([...last.map(d => `☑️ : ${d}`), last.length ? `🕐 : ${current}` : current, `(elapsed: ${elapsed})`].join('\n')

Critical

Trigger Reachable Dangerous Capability

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/session/compactor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/session/compactor.jsView on unpkg

dist/api/skills-router.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/orchestration/capabilities.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/orchestration/capabilities.jsView on unpkg

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.DiscordReceiver = void 0;

37const child_process_1 = require("child_process");

38const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

39const logger_1 = require("../logger");

40const stop_child_1 = require("../utils/stop-child");

41const AUTO_RESTART_DELAY_MS = 5000;

42const MAX_RESTARTS = 3;

43// After MAX_RESTARTS fast attempts, fall back to a slow indefinite retry

44// instead of giving up permanently — self-heals if the admin fixes the

45// underlying cause later (e.g. a Discord Developer Portal intent toggle)

46// without needing to notice and manually reconnect.

47const SLOW_RESTART_DELAY_MS = 5 * 60000;

48class DiscordReceiver {

49 constructor(agentConfig, callbackPort, logDir, headless = true) {

50 this.agentConfig = agentConfig;

51 this.callbackPort = callbackPort;

52 this.logDir = logDir;

53 this.headless = headless;

54 this.process = null;

55 this.stopping = false;

56 this.restartCount = 0;

dist/apps/agent-manager.jsView file

229// L230: // Paths are double-quoted inside the single-quoted `sh -c` argument: homeDir L231: // is host-derived and may contain spaces, which would otherwise split into

High

Shell

Package source references shell execution.

dist/apps/agent-manager.jsView on unpkg · L229

dist/webhook/manager.jsView file

Lines 28-68javascript

28var __importStar = (this && this.__importStar) || (function () {

29 var ownKeys = function(o) {

30 ownKeys

scripts/orchestration/audit-codex-context.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

Lines 84-124javascript

84 }

85 continue;

86 }

87 // Telegram has no viewport/page signal. Count only observed, visible

88 // messages in this account/chat/topic, excluding synthetic task reports

89 // as inputs and excluding this best-effort status message itself.

90 const canMove

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/session/compactor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/session/compactor.jsView on unpkg

dist/api/skills-router.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/orchestration/capabilities.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/orchestration/capabilities.jsView on unpkg

@0xmaxma/claude-gateway@2.0.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code