registry  /  @alfe.ai/gateway  /  0.2.5

@alfe.ai/gateway@0.2.5

Alfe local gateway daemon — persistent control plane for agent integrations

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package is an agent gateway daemon with broad cloud-driven runtime and MCP management capabilities. Risk is real but package-aligned and user-invoked, not confirmed malicious install-time behavior.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs alfe-gateway daemon/start/install or imports exported daemon functions.
Impact
Alfe cloud can update the CLI/runtime, install or activate integrations, alter runtime config, and route MCP/tool calls on the managed agent.
Mechanism
cloud-controlled daemon, runtime updater, integration/MCP reconciliation, optional service installation
Policy narrative
When the user starts the gateway daemon, it reads Alfe credentials, opens a local IPC socket and AI proxy, connects to Alfe cloud over WebSocket, and reconciles cloud desired state into local OpenClaw/Hermes/MCP integrations. Cloud commands can request CLI/runtime updates and config changes. These are powerful agent lifecycle capabilities, but they are documented, package-aligned, and not delivered through npm lifecycle execution.
Rationale
Static inspection shows a high-capability AI-agent gateway with persistence and remote management only after user-invoked daemon/service commands, with no npm install hook or covert payload. This warrants warning for agent extension lifecycle risk rather than a malicious block.
Evidence
package.jsondist/bin/gateway.jsdist/health.jsdist/upgrade.jsdist/runtime-upgrade.jsREADME.md~/.alfe/config.toml~/.alfe/gateway.sock~/.alfe/gateway.pid~/.alfe/logs/gateway.log~/Library/LaunchAgents/ai.alfe.gateway.plist~/.config/systemd/user/alfe-gateway.service/etc/systemd/system/alfe-gateway.service~/.alfe/.openclaw-mirror-migrated~/.openclaw/workspace/AGENTS.md~/.openclaw/workspace/SOUL.md~/.openclaw/workspace/IDENTITY.md~/.openclaw/workspace/BOOTSTRAP.md
Network endpoints3
wss://gateway.alfe.ai/wsAlfe API endpoint derived from configured token127.0.0.1:18193

Decision evidence

public snapshot
AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • dist/health.js starts a persistent Alfe cloud WebSocket and accepts COMMAND/DESIRED_STATE messages.
  • dist/health.js cloud commands can run daemon.update/runtime.update via npm install -g and mutate runtime config.
  • dist/health.js reconciles cloud desired integrations into OpenClaw/Hermes/MCP managers and dynamically imports installed command handlers.
  • dist/health.js can write launchd/systemd service files, but only via explicit CLI install command.
  • dist/health.js auto-approves local OpenClaw repair scope upgrades and cleans Alfe-owned mcp.servers entries.
Evidence against
  • package.json has no npm lifecycle hooks, so no install-time execution.
  • dist/bin/gateway.js exposes user-invoked daemon/start/install/status/logs commands.
  • Network and token use are package-aligned with Alfe gateway functionality.
  • Scanner eval hits are bundled dependency feature detection, not package payload execution.
  • No evidence of credential harvesting beyond using configured Alfe API key for authenticated service operation.
  • No foreign agent control-surface writes occur during npm install/import.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 6 file(s), 718 KB of source, external domains: 127.0.0.1, adaptivecards.io, aws.amazon.com, dotenvx.com, github.com, json-schema.org, www.apple.com, www.google.com, your-log-dashboard-url.com

Source & flagged code

6 flagged · loading source
dist/health.jsView file
3import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises"; L4: import { execFile, execSync, spawn } from "node:child_process"; L5: import { promisify } from "node:util"; ... L12: import { parse } from "smol-toml"; L13: import WebSocket from "ws"; L14: import { createConnection, createServer } from "node:net"; ... L327: } L328: const body = await res.json(); L329: if (!res.ok) return { ... L360: ok: true, L361: data: result.body.data L362: };
Critical
Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/health.jsView on unpkg · L3
•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/health.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/health.jsView on unpkg
3import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises"; L4: import { execFile, execSync, spawn } from "node:child_process"; L5: import { promisify } from "node:util";
High
Child Process

Package source references child process execution.

dist/health.jsView on unpkg · L3
870try { L871: new Function(""); L872: return true;
High
Eval

Package source references dynamic code evaluation.

dist/health.jsView on unpkg · L870
58}) : target, mod)); L59: var __require = /* @__PURE__ */ createRequire(import.meta.url); L60: //#endregion
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/health.jsView on unpkg · L58
3import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises"; L4: import { execFile, execSync, spawn } from "node:child_process"; L5: import { promisify } from "node:util"; ... L12: import { parse } from "smol-toml"; L13: import WebSocket from "ws"; L14: import { createConnection, createServer } from "node:net"; ... L327: } L328: const body = await res.json(); L329: if (!res.ok) return { ... L360: ok: true, L361: data: result.body.data L362: };
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/health.jsView on unpkg · L3

Findings

2 Critical3 High5 Medium5 Low
CriticalRemote Asset Decode Executedist/health.js
CriticalTrigger Reachable Dangerous Capabilitydist/health.js
HighChild Processdist/health.js
HighShell
HighEvaldist/health.js
MediumDynamic Requiredist/health.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/health.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License