registry / @fased/fased / 0.1.57

@fased/fased@0.1.57

Fased Agent self-hosted AI gateway with channels, tools, plugins, and operator modules

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The package is a self-hosted agent gateway with optional managed hosting and SAT mining/transaction capability. No unconsented install-time execution or foreign AI-agent configuration mutation was confirmed.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User invokes the CLI or explicitly issues an @mining command / managed gateway workflow.

Impact

Can start mining-related workflows and submit configured-wallet Solana transactions; managed mode can create long-running local services/tunnels.

Mechanism

User-directed gateway, tunnel, wallet, and Solana transaction operations.

Rationale

No concrete malicious install-time chain was found, but the shipped crypto-mining and transaction-submission features create a real dangerous dual-use surface requiring a warning.

Evidence

package.jsonfased.mjsdist/index.jsdist/mining/chat-command.jsdist/extensions/sat-mining/src/solana-submit.jsscripts/start-managed.shdist/managed/federation.jsdist/infra/net/ssrf.js

Network endpoints3

ff1.fased.appzrok.fased.app{slug}.agents.fased.app

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/mining/chat-command.js` maps explicit @mining start/stop requests to gateway methods.
`dist/extensions/sat-mining/src/solana-submit.js` constructs and submits Solana capital/deposit/withdraw transactions.
`scripts/start-managed.sh` starts a managed gateway, zrok tunnel, wallet setup, and can invoke privileged time-sync commands.
The shipped runtime includes systemd-management modules and persistent managed-service support.

Evidence against

`package.json` has no preinstall, install, or postinstall hook.
`prepare` only sets a repository-local Git hooks path when inside a Git work tree.
`fased.mjs` runs only when the CLI binary is invoked; package import `dist/index.js` parses commands only when main.
`dist/infra/net/ssrf.js` blocks localhost, metadata hosts, private, internal, and special-use addresses.
`dist/infra/git-commit.js` dynamic require is limited to local package/build metadata.
No Unicode bidi/invisible control was found in `dist/tui/tui-formatters.js` by direct scan.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3,099 file(s), 23.9 MB of source, external domains: 127.0.0.1, 192.168.1.100, accounts.google.com, agent.example.com, ai-gateway.vercel.sh, aistudio.google.com, albumart.url, api.anthropic.com, api.botframework.com, api.chutes.ai, api.deepgram.com, api.devnet.solana.com, api.elevenlabs.io, api.exa.ai, api.example.com, api.firecrawl.dev, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.jup.ag, api.kimi.com, api.mainnet-beta.solana.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.plivo.com, api.pluralkit.me, api.push.apple.com, api.sandbox.push.apple.com, api.search.brave.com, api.synthetic.new, api.tavily.com, api.telegram.org, api.telnyx.com, api.together.xyz, api.twilio.com, api.venice.ai, api.voyageai.com, api.x.ai, api.xiaomimimo.com, api.z.ai, ark.ap-southeast.bytepluses.com, ark.cn-beijing.volces.com, arweave.net, auth.x.ai, autopush-cloudcode-pa.sandbox.googleapis.com

Oversized source lightweight scan

dist/plugin-sdk/config-schema-aKPMn6ML.js4.02 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsapi.github.comapi.push.apple.comapi.sandbox.push.apple.combrew.sh

Source & flagged code

8 flagged

dist/browser/config.jsView file

Lines 49-89javascript

49 if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {

50 throw new Error(`${label} must be http(s), got: ${parsed.protocol.replace(":", "")}`);

51 }

52 const port = parsed.port && Number.parseInt(parsed.port, 10) > 0 ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;

53 if (Number.isNaN(port) || port <= 0 || port > 65535) {

54 throw new Error(`${label} has invalid port: ${parsed.port}`);

55 }

56 return {

57 parsed,

58 port,

59 normalized: parsed.toString().replace(/\/$/, "")

60 };

61}

62function redactBrowserCdpUrl(raw) {

63 try {

64 const parsed = new URL(raw);

65 if (parsed.username) {

66 parsed.username = "redacted";

67 }

68 if (parsed.password) {

69 parsed.password = "redacted";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/browser/config.jsView on unpkg · L69

70 }

71 for (const key of new Set(parsed.searchParams.keys())) {

72 const values = parsed.searchParams.getAll(key);

73 parsed.searchParams.delete(key);

74 for (const value of values) {

75 parsed.searchParams.append(key, value ? "redacted" : "");

76 }

77 }

78 return parsed.toString().replace(/\/$/, "");

79 } catch {

80 return raw;

81 }

82}

83/**

84* Ensure the default "fased" profile exists in the profiles map.

85* Auto-creates it with the legacy CDP port (from browser.cdpUrl) or first port if missing.

86*/

87function ensureDefaultProfile(profiles, defaultColor, legacyCdpPort, derivedDefaultCdpPort) {

88 const result = { ...profiles };

89 if (!result[DEFAULT_FASED_BROWSER_PROFILE_NAME]) {

dist/infra/git-commit.jsView file

Lines 1-39javascript

1import { resolveGitHeadPath } from "./git-root.js";

2import { createRequire } from "node:module";

3import fs from "node:fs";

4import path from "node:path";

6//#region src/infra/git-commit.ts

7const formatCommit

extensions/voice-call/src/webhook-security.tsView file

Lines 56-96typescript

56 pruneReplayCache(cache, now);

57 }

59 const existing = cache.seenUntil.get(replayKey);

60 if (existing && existing > now) {

61 return true;

62 }

dist/infra/net/ssrf.jsView file

Lines 1-22javascript

1import { extractEmbeddedIpv4FromIpv6, isBlockedSpecialUseIpv4Address, isBlockedSpecialUseIpv6Address, isCanonicalDottedDecimalIPv4, isIpv4Address, isLegacyIpv4Literal, parseCanonicalIpAddress, parseLooseIpAddress } from "../../shared/net/ip.js";

2import { normalizeHostname } from "./hostname.js";

3import { Agent } from "undici";

4import { lookup } from "node:dns";

5import { lookup as lookup$1 } from

dist/tui/tui-formatters.jsView file

Lines 1-38javascript

1import { stripAnsi } from "../terminal/ansi.js";

2import { stripLeadingInboundMetadata } from "../auto-reply/reply/strip-inbound-meta.js";

3import { formatTokenCount } from "../utils/usage-format.js";

4import { formatRawAssistantErrorForUi } from "../agents/pi-embedded-helpers/errors.js";

5import "../agents/pi-embedded-helpers.js";

scripts/start-managed.shView file

•path = scripts/start-managed.sh kind = build_helper sizeBytes = 58461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/start-managed.shView on unpkg

dist/plugin-sdk/config-schema-aKPMn6ML.jsView file

•path = dist/plugin-sdk/config-schema-aKPMn6ML.js kind = oversized_source_file sizeBytes = 4219003 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/plugin-sdk/config-schema-aKPMn6ML.jsView on unpkg

dist/memory/inventory.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @fased/fased@0.1.51 matchedIdentity = npm:QGZhc2VkL2Zhc2Vk:0.1.51 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/memory/inventory.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/browser/config.jsView file

69patternName = generic_password severity = medium line = 69 matchedText = parsed.p...ed";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/browser/config.jsView on unpkg · L69

dist/infra/git-commit.jsView file

19try { L20: const require = createRequire(import.meta.url); L21: const pkg = require("../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/git-commit.jsView on unpkg · L19

extensions/voice-call/src/webhook-security.tsView file

76* L77: * @see https://www.twilio.[redacted]-security L78: */ ... L82: url: string, L83: params: URLSearchParams, L84: ): boolean { ... L90: L91: // HMAC-SHA1 with auth token, then base64 encode L92: const expectedSignature = crypto

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/voice-call/src/webhook-security.tsView on unpkg · L76

dist/infra/net/ssrf.jsView file

2import { normalizeHostname } from "./hostname.js"; L3: import { Agent } from "undici"; L4: import { lookup } from "node:dns"; L5: import { lookup as lookup$1 } from "node:dns/promises"; ... L31: } L32: function resolveAllowPrivateNetwork(policy) { L33: return policy?.dangerouslyAllowPrivateNetwork === true || policy?.allowPrivateNetwork === true;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/ssrf.jsView on unpkg · L2

dist/tui/tui-formatters.jsView file

18contains invisible/control Unicode U+2067 (right-to-left isolate) const RTL_ISOLATE_START = "<U+2067>";

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/tui/tui-formatters.jsView on unpkg · L18

scripts/start-managed.shView file

•path = scripts/start-managed.sh kind = build_helper sizeBytes = 58461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/start-managed.shView on unpkg

dist/plugin-sdk/config-schema-aKPMn6ML.jsView file

•path = dist/plugin-sdk/config-schema-aKPMn6ML.js kind = oversized_source_file sizeBytes = 4219003 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/plugin-sdk/config-schema-aKPMn6ML.jsView on unpkg

dist/memory/inventory.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/memory/inventory.jsView on unpkg

Findings

1 Critical3 High6 Medium8 Low

CriticalTrojan Source Unicodedist/tui/tui-formatters.js

HighCloud Metadata Accessdist/infra/net/ssrf.js

HighOversized Source Filedist/plugin-sdk/config-schema-aKPMn6ML.js

HighPrevious Version Dangerous Deltadist/memory/inventory.js

MediumSecret Patterndist/browser/config.js

MediumDynamic Requiredist/infra/git-commit.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/start-managed.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowWeak Cryptoextensions/voice-call/src/webhook-security.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/browser/config.jsView file

Lines 49-89javascript

49 if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {

50 throw new Error(`${label} must be http(s), got: ${parsed.protocol.replace(":", "")}`);

51 }

52 const port = parsed.port && Number.parseInt(parsed.port, 10) > 0 ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;

53 if (Number.isNaN(port) || port <= 0 || port > 65535) {

54 throw new Error(`${label} has invalid port: ${parsed.port}`);

55 }

56 return {

57 parsed,

58 port,

59 normalized: parsed.toString().replace(/\/$/, "")

60 };

61}

62function redactBrowserCdpUrl(raw) {

63 try {

64 const parsed = new URL(raw);

65 if (parsed.username) {

66 parsed.username = "redacted";

67 }

68 if (parsed.password) {

69 parsed.password = "redacted";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/browser/config.jsView on unpkg · L69

70 }

71 for (const key of new Set(parsed.searchParams.keys())) {

72 const values = parsed.searchParams.getAll(key);

73 parsed.searchParams.delete(key);

74 for (const value of values) {

75 parsed.searchParams.append(key, value ? "redacted" : "");

76 }

77 }

78 return parsed.toString().replace(/\/$/, "");

79 } catch {

80 return raw;

81 }

82}

83/**

84* Ensure the default "fased" profile exists in the profiles map.

85* Auto-creates it with the legacy CDP port (from browser.cdpUrl) or first port if missing.

86*/

87function ensureDefaultProfile(profiles, defaultColor, legacyCdpPort, derivedDefaultCdpPort) {

88 const result = { ...profiles };

89 if (!result[DEFAULT_FASED_BROWSER_PROFILE_NAME]) {

dist/infra/git-commit.jsView file

Lines 1-39javascript

1import { resolveGitHeadPath } from "./git-root.js";

2import { createRequire } from "node:module";

3import fs from "node:fs";

4import path from "node:path";

6//#region src/infra/git-commit.ts

7const formatCommit

extensions/voice-call/src/webhook-security.tsView file

Lines 56-96typescript

56 pruneReplayCache(cache, now);

57 }

59 const existing = cache.seenUntil.get(replayKey);

60 if (existing && existing > now) {

61 return true;

62 }

dist/infra/net/ssrf.jsView file

Lines 1-22javascript

2import { normalizeHostname } from "./hostname.js";

3import { Agent } from "undici";

4import { lookup } from "node:dns";

5import { lookup as lookup$1 } from

dist/tui/tui-formatters.jsView file

Lines 1-38javascript

1import { stripAnsi } from "../terminal/ansi.js";

2import { stripLeadingInboundMetadata } from "../auto-reply/reply/strip-inbound-meta.js";

3import { formatTokenCount } from "../utils/usage-format.js";

4import { formatRawAssistantErrorForUi } from "../agents/pi-embedded-helpers/errors.js";

5import "../agents/pi-embedded-helpers.js";

scripts/start-managed.shView file

•path = scripts/start-managed.sh kind = build_helper sizeBytes = 58461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/start-managed.shView on unpkg

dist/plugin-sdk/config-schema-aKPMn6ML.jsView file

•path = dist/plugin-sdk/config-schema-aKPMn6ML.js kind = oversized_source_file sizeBytes = 4219003 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/plugin-sdk/config-schema-aKPMn6ML.jsView on unpkg

dist/memory/inventory.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/memory/inventory.jsView on unpkg