registry  /  @alfe.ai/gateway  /  0.2.1

@alfe.ai/gateway@0.2.1

Alfe local gateway daemon — persistent control plane for agent integrations

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface; the dangerous primitives are part of a user-started local gateway daemon for Alfe agent integrations. Remote command handling is authenticated to configured Alfe endpoints and package-aligned.

Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs alfe-gateway daemon/start/install or imports exported daemon helpers.
Impact
Can manage local Alfe/OpenClaw/Hermes runtime state after user configuration; no unconsented install-time execution or credential exfiltration found.
Mechanism
authenticated gateway daemon with runtime/process/config management
Rationale
Direct inspection shows a legitimate gateway daemon with high-privilege runtime management, but activation is user-invoked and aligned with the package purpose. Scanner claims about remote asset decode/execute are not supported by the inspected source.
Evidence
package.jsondist/bin/gateway.jsdist/src/index.jsdist/health.jsdist/upgrade.jsdist/runtime-upgrade.js
Network endpoints2
wss://gateway.alfe.ai/ws127.0.0.1:<DEFAULT_AI_PROXY_PORT>

Decision evidence

public snapshot
AI called this Clean at 87.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • dist/health.js accepts authenticated cloud COMMAND messages that can restart/update daemon/runtime and execute registered integration handlers.
  • dist/upgrade.js and dist/runtime-upgrade.js run npm/hermes/openclaw update commands, but only from daemon command handling.
  • dist/health.js can alter OpenClaw/Hermes MCP/runtime config and auto-approve local OpenClaw repair pairings during daemon runtime.
Evidence against
  • package.json has no install/preinstall/postinstall lifecycle hooks; bin is user-invoked alfe-gateway.
  • dist/bin/gateway.js only dispatches CLI commands to daemon/service/status/log functions.
  • dist/health.js network use is aligned with an authenticated Alfe gateway daemon: API fetches, WebSocket registration, and local AI proxy.
  • No confirmed remote asset decode-and-execute path found; eval/new Function hits are bundled dependency/runtime feature-detection code.
  • Persistence writes are explicit service install commands for launchd/systemd, not install-time execution.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 6 file(s), 713 KB of source, external domains: 127.0.0.1, adaptivecards.io, aws.amazon.com, dotenvx.com, github.com, json-schema.org, www.apple.com, www.google.com, your-log-dashboard-url.com

Source & flagged code

7 flagged · loading source
dist/health.jsView file
3import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises"; L4: import { execFile, execSync, spawn } from "node:child_process"; L5: import { promisify } from "node:util"; ... L12: import { parse } from "smol-toml"; L13: import WebSocket from "ws"; L14: import { createConnection, createServer } from "node:net"; ... L327: } L328: const body = await res.json(); L329: if (!res.ok) return { ... L360: ok: true, L361: data: result.body.data L362: };
Critical
Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/health.jsView on unpkg · L3
•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/health.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/health.jsView on unpkg
•matchType = previous_version_dangerous_delta matchedPackage = @alfe.ai/gateway@0.2.0 matchedIdentity = npm:QGFsZmUuYWkvZ2F0ZXdheQ:0.2.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/health.jsView on unpkg
3import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises"; L4: import { execFile, execSync, spawn } from "node:child_process"; L5: import { promisify } from "node:util";
High
Child Process

Package source references child process execution.

dist/health.jsView on unpkg · L3
870try { L871: new Function(""); L872: return true;
High
Eval

Package source references dynamic code evaluation.

dist/health.jsView on unpkg · L870
58}) : target, mod)); L59: var __require = /* @__PURE__ */ createRequire(import.meta.url); L60: //#endregion
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/health.jsView on unpkg · L58
3import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises"; L4: import { execFile, execSync, spawn } from "node:child_process"; L5: import { promisify } from "node:util"; ... L12: import { parse } from "smol-toml"; L13: import WebSocket from "ws"; L14: import { createConnection, createServer } from "node:net"; ... L327: } L328: const body = await res.json(); L329: if (!res.ok) return { ... L360: ok: true, L361: data: result.body.data L362: };
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/health.jsView on unpkg · L3

Findings

3 Critical3 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/health.js
CriticalTrigger Reachable Dangerous Capabilitydist/health.js
CriticalPrevious Version Dangerous Deltadist/health.js
HighChild Processdist/health.js
HighShell
HighEvaldist/health.js
MediumDynamic Requiredist/health.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/health.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License