Loading npm security reports…

@dev-anywhere/proxy@0.5.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @dev-anywhere/proxy / 0.5.0

@dev-anywhere/proxy@0.5.0

Transparent local proxy for AI coding CLIs that bridges local sessions to a web/PWA client via a relay server.

Static Scan Results

scanned 18h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 400 KB of source, external domains: 127.0.0.1, claude.ai

Source & flagged code

4 flagged

package.jsonView file

Lines 45-67json

45 "nanoid": "^5.1.7",

46 "node-pty": "^1.1.0",

47 "pino": "^10.3.1",

48 "ws": "^8.20.0",

49 "zod": "^4.3.6",

50 "@dev-anywhere/relay": "0.5.0"

51 },

52 "devDependencies": {

53 "@types/node": "^25.5.2",

54 "@types/ws": "^8.18.1",

55 "vitest": "^4.1.2",

56 "@dev-anywhere/shared": "0.5.0"

57 },

58 "scripts": {

59 "build": "tsup",

60 "dev": "tsx src/index.ts",

61 "serve": "tsx src/serve.ts",

62 "sample:stream-json": "tsx scripts/sample-stream-json.ts",

63 "test": "bash ../../scripts/test/vitest.sh",

64 "typecheck": "tsc --noEmit",

65 "postinstall": "chmod +x node_modules/node-pty/prebuilds/darwin-*/spawn-helper 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L65

66 }

67}

assets/fonts/sarasa-fixed-sc/56175fa000590397d0ec4074c1f1e9f2.woff2View file

•path = assets/fonts/sarasa-fixed-[redacted].woff2 kind = high_entropy_blob sizeBytes = 76508 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/fonts/sarasa-fixed-sc/56175fa000590397d0ec4074c1f1e9f2.woff2View on unpkg

dist/quick-tunnel-MO3U67K3.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dev-anywhere/proxy@0.4.84 matchedIdentity = npm:QGRldi1hbnl3aGVyZS9wcm94eQ:0.4.84 similarity = 0.368 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/quick-tunnel-MO3U67K3.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code