@decentnetwork/lan@0.1.291
Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source supports a real high-impact dual-use capability, but not malicious behavior or an automatic install chain. Because static coverage is incomplete and the package performs privileged persistence and trust-store changes, warning is safer than marking it clean.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs agentnet service install, agentnet proxy trust-ca, or starts the real TUN mode.
Impact
A user who invokes these commands grants long-lived root-level networking and certificate-trust capabilities; misuse or compromise could affect host traffic and persistence.
Mechanism
Privileged service installation, certificate trust-store modification, and network configuration.
AI rationale
The source supports a real high-impact dual-use capability, but not malicious behavior or an automatic install chain. Because static coverage is incomplete and the package performs privileged persistence and trust-store changes, warning is safer than marking it clean.
Evidence
dist/cli/commands.jsdist/tun/route-manager.js/etc/systemd/system/agentnet.service/Library/LaunchDaemons/com.decentlan.agentnet.plist/etc/ssh/sshd_config~/.agentnet/mitm-ca-cert.pem
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI exposes commands that can create a persistent privileged system service.
- An explicit CLI command generates and installs a locally trusted interception certificate.
- The route manager runs privileged network and firewall commands.
- The daemon writes a PID file and persistent local state when started.
- The local UI can launch an operating-system file manager for validated downloaded files.
- The bundled console imports child-process spawning.
Evidence against
- package.json has only a prepublishOnly lifecycle script, so installation does not automatically run package code.
- The service, certificate, routing, and UI actions are reached through explicit CLI commands rather than an npm lifecycle hook.
- The inspected UI restricts identity signing and file-manager reveal actions to loopback requests.
- No inspected source showed credential harvesting, covert exfiltration, remote payload loading, or reviewer-directed text.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
9 flaggeddist/ui/server.jsView file
55async function revealInFileManager(filePath) {
L56: const { spawn } = await import("node:child_process");
L57: const run = (cmd, args) => new Promise((resolve) => {
High
dist/tun/route-manager.jsView file
3* Linux uses `ip` (iproute2), macOS uses `ifconfig` + `route`, and
L4: * Windows uses the built-in NetTCPIP PowerShell cmdlets.
L5: */
High
dist/ui/desktop/vendor/react-dom.production.min.jsView file
Findings
1 Critical5 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/daemon/server.js
HighChild Processdist/ui/server.js
HighShelldist/tun/route-manager.js
HighCross File Remote Execution Contextdist/cli/commands.js
HighTrigger Reachable Persistencedist/cli/commands.js
HighSemantic Analysis Limiteddist/console/console.js#virtual:normalized:round1
MediumDynamic Requiredist/ui/desktop/vendor/react-dom.production.min.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/commands.js
MediumShips Native Binarybin/tun-helper-linux-arm64
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @decentnetwork/lan@0.1.291.
See all versions of @decentnetwork/lan for other recorded verdicts.
- Review the evidence and your use of @decentnetwork/lan@0.1.291 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.