@0xmaxma/claude-gateway@2.0.9: Manual Review npm security report

Loading npm security reports…

@0xmaxma/claude-gateway@2.0.9: Manual Review npm security report | LPM Firewall

Source & flagged code

19 flagged

package.jsonView file

Lines 13-53json

13 "engines": {

14 "node": ">=22"

15 },

16 "files": [

17 "dist/",

18 "lib/",

19 "resource/",

20 "mcp/",

21 "!mcp/node_modules",

22 "!mcp/node_modules/**",

23 "README.md",

24 "scripts/orchestration/",

25 "config.template.json"

26 ],

27 "publishConfig": {

28 "access": "public"

29 },

30 "scripts": {

31 "build": "tsc && node scripts/write-build-provenance.cjs",

32 "start": "node --no-warnings=ExperimentalWarning --env-file-if-exists=.env dist/entry.js gateway start",

33 "postinstall": "if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L33

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 "pretest": "npm run build",

35 "pretest:unit": "npm run build",

36 "test": "NODE_OPTIONS=--max-old-space-size=2560 jest",

37 "test:unit": "jest --testPathPattern=unit",

38 "test:e2e": "jest --testPathPattern=tests/e2e --forceExit",

39 "integration": "jest --testPathPattern=integration --testTimeout=15000",

40 "integration:ma": "jest --testPathPattern=multi-agent --testTimeout=15000",

41 "test:manual": "jest --testPathPattern=phase-manual --testTimeout=15000",

42 "integration:hb": "jest --testPathPattern=heartbeat-e2e --testTimeout=15000",

43 "integration:cs": "jest --testPathPattern=character-system --testTimeout=15000",

44 "typecheck": "tsc --noEmit --incremental --tsBuildInfoFile ./.tsbuildinfo-check",

45 "gen-cli": "ts-node scripts/gen-cli.ts",

46 "gen-cli:check": "ts-node scripts/gen-cli.ts --check"

47 },

48 "dependencies": {

49 "@line/bot-sdk": "^11.0.2",

50 "@whiskeysockets/baileys": "^6.7.24",

51 "@xterm/headless": "^6.0.0",

52 "chokidar": "^3.5.0",

53 "cron-parser": "^5.5.0",

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/apps/agent-manager.jsView file

Lines 209-249javascript

209 const agentMediaDir = path.join(this.agentsDir, agentName, 'media');

210 fs.mkdirSync(agentMediaDir, { recursive: true });

211 const agentMediaSource = fs.

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

scripts/orchestration/audit-codex-context.cjsView file

7const {resolveWorkerHarness}=require('../../src/orchestration/worker-harness'); L8: const fs=require('fs/promises'),path=require('path'),os=require('os'),http=require('http'); L9: const {execFileSync}=require('child_process'),{once}=require('events'); L10: const args=process.argv.slice(2); ... L17: const directory=await fs.mkdtemp(path.join(os.tmpdir(),'gateway-context-audit-')); L18: const previous=process.env.GATEWAY_CONTEXT_AUDIT_KEY; L19: process.env.GATEWAY_CONTEXT_AUDIT_KEY='local-fixture-only';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

Lines 84-124javascript

84 }

85 continue;

86 }

87 // Telegram has no viewport/page signal. Count only observed, visible

88 // messages in this account/chat/topic, excluding synthetic task reports

89 // as inputs and excluding this best-effort status message itself.

90 const canMove

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

4* "custom" MCP connectors whose only auth option is a real OAuth sign-in (no L5: * static API key) — e.g. Firecrawl"s `https://mcp.firecrawl.dev/v2/mcp-oauth`.\n *\n * This module never touches Express or the pending-flow store — pure discovery\n * + token func... L6: * ... L36: * L37: * Node"s fetch defaults to `redirect: "follow"`, and a followed redirect goes\n * wherever the answering server names — without passing through\n * `assertFetchableUrl`, which only... L38: if (!location) ... L50: ? init L51: : { ...init, method: "GET", body: undefined }; L52: } ... L144: if (!resourceMetadataUrl) { L145: throw new Error(`${mcpUrl} returned 401 but no "resource_metadata" in its WWW-Authenticate header — can"t discover its OAuth server.`);\n }\n const prm = await fetchFollowing... L1

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

13Cross-file remote execution chain: dist/orchestration/container.js spawns dist/session/process.js; helper contains network access plus dynamic code execution. L13: const checkpoint_hook_1 = require("./tasks/checkpoint-hook"); L14: const child_process_1 = require("child_process"); L15: const util_1 = require("util"); ... L30: throw new types_1.OrchestrationError('CONTAINER_REQUIRED'); L31: const { stdout } = await exec('docker', ['inspect', agent.container], { timeout: 10000 }); L32: await validateContainerInspection(agent, JSON.parse(stdout)[0]); L33: } ... L56: const h = c.HostConfig; L57: if ((options.requireRunning !== false && !c.State?.Running) || !h || h.Privileged || (h.NetworkMode === 'host' || String(h.NetworkMode).startsWith('container:')) || h.PidMode || ![... L58: throw new typ

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/packages/registry.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/apps/socket-server.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/cli/commands/gateway.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/session/compactor.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/session/compactor.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/session/compactor.jsView on unpkg

dist/api/skills-router.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/api/sk[redacted] matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

•matchType = normalized_sha256 matchedPackage = @0xmaxma/claude-gateway@1.8.14 matchedPath = dist/apps/compose-generator.js matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:1.8.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/api/router.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @0xmaxma/claude-gateway@2.0.7 matchedIdentity = npm:QDB4bWF4bWEvY2xhdWRlLWdhdGV3YXk:2.0.7 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/api/router.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/apps/agent-manager.jsView file

229// L230: // Paths are double-quoted inside the single-quoted `sh -c` argument: homeDir L231: // is host-derived and may contain spaces, which would otherwise split into

High

Shell

Package source references shell execution.

dist/apps/agent-manager.jsView on unpkg · L229

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

scripts/orchestration/audit-codex-context.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

104Source sends the broad process environment to a literal external destination. L104: for (const event of events.slice().reverse()) { L105: const e = JSON.parse(String(event.payload_json)).payload; L106: if (e.type !== 'tool_use' || e.name === 'StructuredOutput' || seen.has(e.id)) ... L122: const elapsed = hours > 0 ? `${hours}h ${mins}m` : mins > 0 ? (secs > 0 ? `${mins}m ${secs}s` : `${mins}m`) : `${secs}s`; L123: const secrets = Object.entries(process.env).filter(([k, v]) => /TOKEN|SECRET|PASSWORD|API_KEY/i.test(k) && v && v.length >= 8).map(([, v]) => v); L124: const text = (0, incident_1.scrubText)([...last.map(d => `☑️ : ${d}`), last.length ? `🕐 : ${current}` : current, `(elapsed: ${elapsed})`].join('\n'), [token, ...secrets]).slice(0, ... ... L136: status.moveAttemptAt = Date.now();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/orchestration/telegram-tool-status.jsView on unpkg · L104

104Trigger-reachable chain: manifest.main -> dist/index.js -> dist/agent/runner.js -> dist/orchestration/runtime.js -> dist/orchestration/telegram-tool-status.js L104: for (const event of events.slice().reverse()) { L105: const e = JSON.parse(String(event.payload_json)).payload; L106: if (e.type !== 'tool_use' || e.name === 'StructuredOutput' || seen.has(e.id)) ... L122: const elapsed = hours > 0 ? `${hours}h ${mins}m` : mins > 0 ? (secs > 0 ? `${mins}m ${secs}s` : `${mins}m`) : `${secs}s`; L123: const secrets = Object.entries(process.env).filter(([k, v]) => /TOKEN|SECRET|PASSWORD|API_KEY/i.test(k) && v && v.length >= 8).map(([, v]) => v); L124: const text = (0, incident_1.scrubText)([...last.map(d => `☑️ : ${d}`), last.length ? `🕐 : ${current}` : current, `(elapsed: ${elapsed})`].join('\n')

Critical

Trigger Reachable Dangerous Capability

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/session/compactor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/session/compactor.jsView on unpkg

dist/api/skills-router.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/api/router.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/api/router.jsView on unpkg

Source & flagged code

19 flagged

package.jsonView file

Lines 13-53json

13 "engines": {

14 "node": ">=22"

15 },

16 "files": [

17 "dist/",

18 "lib/",

19 "resource/",

20 "mcp/",

21 "!mcp/node_modules",

22 "!mcp/node_modules/**",

23 "README.md",

24 "scripts/orchestration/",

25 "config.template.json"

26 ],

27 "publishConfig": {

28 "access": "public"

29 },

30 "scripts": {

31 "build": "tsc && node scripts/write-build-provenance.cjs",

32 "start": "node --no-warnings=ExperimentalWarning --env-file-if-exists=.env dist/entry.js gateway start",

33 "postinstall": "if command -v bun >/dev/null 2>&1; then bun install --cwd mcp; else echo 'Warning: bun not found. Run `cd mcp && bun install` manually to enable MCP tools.'; fi",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L33

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 "pretest": "npm run build",

35 "pretest:unit": "npm run build",

36 "test": "NODE_OPTIONS=--max-old-space-size=2560 jest",

37 "test:unit": "jest --testPathPattern=unit",

38 "test:e2e": "jest --testPathPattern=tests/e2e --forceExit",

39 "integration": "jest --testPathPattern=integration --testTimeout=15000",

40 "integration:ma": "jest --testPathPattern=multi-agent --testTimeout=15000",

41 "test:manual": "jest --testPathPattern=phase-manual --testTimeout=15000",

42 "integration:hb": "jest --testPathPattern=heartbeat-e2e --testTimeout=15000",

43 "integration:cs": "jest --testPathPattern=character-system --testTimeout=15000",

44 "typecheck": "tsc --noEmit --incremental --tsBuildInfoFile ./.tsbuildinfo-check",

45 "gen-cli": "ts-node scripts/gen-cli.ts",

46 "gen-cli:check": "ts-node scripts/gen-cli.ts --check"

47 },

48 "dependencies": {

49 "@line/bot-sdk": "^11.0.2",

50 "@whiskeysockets/baileys": "^6.7.24",

51 "@xterm/headless": "^6.0.0",

52 "chokidar": "^3.5.0",

53 "cron-parser": "^5.5.0",

dist/discord/receiver.jsView file

36exports.DiscordReceiver = void 0; L37: const child_process_1 = require("child_process"); L38: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/discord/receiver.jsView on unpkg · L36

dist/apps/agent-manager.jsView file

Lines 209-249javascript

209 const agentMediaDir = path.join(this.agentsDir, agentName, 'media');

210 fs.mkdirSync(agentMediaDir, { recursive: true });

211 const agentMediaSource = fs.

dist/webhook/manager.jsView file

48exports.getWebhookInfo = getWebhookInfo; L49: const https = __importStar(require("https")); L50: const http = __importStar(require("http"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/webhook/manager.jsView on unpkg · L48

scripts/orchestration/audit-codex-context.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/orchestration/audit-codex-context.cjsView on unpkg · L7

dist/orchestration/telegram-tool-status.jsView file

Lines 84-124javascript

84 }

85 continue;

86 }

87 // Telegram has no viewport/page signal. Count only observed, visible

88 // messages in this account/chat/topic, excluding synthetic task reports

89 // as inputs and excluding this best-effort status message itself.

90 const canMove

dist/connectors/mcp-oauth.js#virtual:normalized:round1View file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/connectors/mcp-oauth.js#virtual:normalized:round1View on unpkg · L4

dist/orchestration/container.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/orchestration/container.jsView on unpkg · L13

dist/packages/registry.jsView file

188try { L189: (0, child_process_1.execSync)(`npm install -g ${packageName}@latest`, { stdio: ['pipe', 'pipe', 'pipe'], timeout: 300000 }); L190: return null;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/packages/registry.jsView on unpkg · L188

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/packages/registry.jsView on unpkg

dist/agent/dreaming/migrate.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent/dreaming/migrate.js#virtual:normalized:round1View on unpkg

dist/apps/socket-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/socket-server.jsView on unpkg

dist/cli/commands/gateway.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/gateway.jsView on unpkg

dist/session/compactor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/session/compactor.jsView on unpkg

dist/api/skills-router.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/skills-router.jsView on unpkg

dist/apps/compose-generator.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/compose-generator.jsView on unpkg

dist/api/router.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/api/router.jsView on unpkg

@0xmaxma/claude-gateway@2.0.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code