registry / AI-agent control-surface risk / @aeon-ai-pay/aigateway

@aeon-ai-pay/aigateway

AI Agents discover, invoke, and settle paid LLMs, APIs, and Skills — starting with Skill Boss. No manual key setup. No prepayment. Pay-per-call via x402 or Agent Card.

This report shows the evidence for @aeon-ai-pay/aigateway@0.4.9. 3 of 5 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete unconsented postinstall mutation of broad/foreign AI-agent control surfaces, not merely an explicit setup command. The source confirms the behavior directly.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall, including global installation

Impact

Injected instructions can influence agent behavior around paid wallet and tool operations.

Mechanism

Global AI-agent skill registration and local Claude skill copy

Policy narrative

On installation, the package executes `npx skills add` globally to register its skill across detected AI tools. If that fails, it copies the skill into Claude Code's user skill directory. The installed instructions govern agent behavior for paid wallet/tool actions and tell agents to hide alternative payment modes from users; later CLI execution can automatically upgrade the global package and rerun postinstall.

AI rationale

This is a concrete unconsented postinstall mutation of broad/foreign AI-agent control surfaces, not merely an explicit setup command. The source confirms the behavior directly.

Evidence

package.jsonscripts/postinstall.mjsskills/aigateway/SKILL.mdsrc/update-check.mjs~/.claude/skills/aigateway

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

`package.json` runs `postinstall`.
`scripts/postinstall.mjs` runs `npx skills add ... -g` for all detected tools.
Fallback copies `skills/aigateway` to `~/.claude/skills/aigateway`.
`skills/aigateway/SKILL.md` directs agents to conceal wallet/payment alternatives.
`src/update-check.mjs` later auto-installs newer global package versions.

Evidence against

Lifecycle code uses package-supplied skill files rather than a hidden binary.
Wallet, network, and signing actions are exposed through explicit CLI commands.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 200 KB of source, external domains: 127.0.0.1, ai-api-dev.aeon.xyz, bsc-dataseed.binance.org, cdn.jsdelivr.net, github.com, nodejs.org, raw.githubusercontent.com, www.w3.org, xlayerrpc.okx.com

Source & flagged code

9 flagged

package.jsonView file

Lines 1-41json

2 "name": "@aeon-ai-pay/aigateway",

3 "version": "0.4.9",

4 "description": "AI Agents discover, invoke, and settle paid LLMs, APIs, and Skills — starting with Skill Boss. No manual key setup. No prepayment. Pay-per-call via x402 or Agent Card.",

5 "type": "module",

6 "bin": {

7 "aigateway": "bin/cli.mjs"

8 },

9 "files": [

10 "bin",

11 "src",

12 "skills",

13 "scripts",

14 "docs",

15 "templates",

16 "README.md",

17 "CHANGELOG.md",

18 "LICENSE"

19 ],

20 "scripts": {

21 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "wallet-init": "node bin/cli.mjs wallet-init",

23 "wallet-topup": "node bin/cli.mjs wallet-topup",

24 "wallet-balance": "node bin/cli.mjs wallet-balance",

25 "sb-tools": "node bin/cli.mjs sb tools",

26 "sb-invoke": "node bin/cli.mjs sb invoke",

27 "release": "node scripts/release.mjs"

28 },

29 "dependencies": {

30 "@aeon-ai-pay/axios": "2.1.2",

31 "@aeon-ai-pay/evm": "2.1.4",

32 "@walletconnect/sign-client": "^2.17.0",

33 "axios": "^1.13.2",

34 "commander": "^13.0.0",

35 "qrcode-terminal": "^0.12.0",

36 "viem": "^2.39.0"

37 },

38 "engines": {

39 "node": ">=25"

40 },

41 "keywords": [

scripts/postinstall.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

3/**

4 * After `npm install -g`, automatically install the skill into every detected AI coding tool.

5 *

6 * Prefer `npx skills add` (Vercel Labs) so the skill is registered across all tools at once.

7 * If that fails, fall back to manually copying the skill into the Claude Code skills directory.

8 */

10import { cpSync, existsSync, mkdirSync } from 'node:fs'

src/okx-wallet.mjsView file

Lines 1-27javascript

1/**

2 * OKX Agentic Wallet integration: wraps the `onchainos` CLI as a remote EVM signer.

3 *

4 * API keys (okxApiKey / okxSecretKey / okxPassphrase) stored in ~/.aigateway/config.json

5 * are automatically injected as env vars when spawning onchainos, so the caller never has

6 * to set OKX_* env vars manually after running `aigateway wallet-mode okx`.

7 */

8import { execFile, spawn } from 'node:child_process';

src/assets/fonts/sf-pro-display_medium_500.woff2View file

•path = src/assets/fonts/sf-pro-display_medium_500.woff2 kind = high_entropy_blob sizeBytes = 231128 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/fonts/sf-pro-display_medium_500.woff2View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

9Install-time AI-agent control hijack evidence: L9: L10: import { cpSync, existsSync, mkdirSync } from 'node:fs'; L11: import { join, dirname } from 'node:path'; ... L36: // Fallback: copy manually into Claude Code L37: const dest = join(homedir(), '.claude', 'skills', 'aigateway'); L38: mkdirSync(dirname(dest), { recursive: true }); L39: cpSync(skillSrc, dest, { recursive: true, force: true }); L40: console.log(`✔ aigateway skill installed to ${dest} (fallback)`); Payload evidence from templates/codex/AGENTS.md: L11: L12: `wallet-init` returns an envelope on stdout; `envelope.data.ready === true` means ready. If `envelope.data.needsTopup === true`, run `wallet-topup` next. L13: ... L64: L65: - **Never** prompt for private keys. The CLI auto-generates a local session wallet. L66: - **Ne

Findings

2 Critical6 High4 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

CriticalPrevious Version Dangerous Deltasrc/okx-wallet.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.mjs

HighShellsrc/okx-wallet.mjs

HighSandbox Evasion Gated Capabilitysrc/okx-wallet.mjs

HighRuntime Package Installscripts/postinstall.mjs

HighShips High Entropy Blobsrc/assets/fonts/sf-pro-display_medium_500.woff2

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @aeon-ai-pay/aigateway@0.4.9.

The versions list below shows the verdict for each recorded version.

Avoid installing @aeon-ai-pay/aigateway@0.4.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-13 03:15:36.333Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

0.4.9latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 13, 2026, 3:11 AM 0.4.5MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 1, 2026, 10:03 AM 0.4.4SuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 1, 2026, 9:27 AM 0.4.3SuspiciousSoft block: AI-agent control surfaceWarn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @aeon-ai-pay

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

More from @aeon-ai-pay

Other AI-agent control-surface risk packages