@h3nr1-d14z/nat-gate@2.1.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@h3nr1-d14z/nat-gate@2.1.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

33"scripts": { "postinstall": "node scripts/install.js" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs the installer.

package.jsonView on unpkg · L33

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

34function getLatestRelease() { return new Promise((resolve, reject) => { const options = { hostname: 'api.github.com', path: `/repos/${REPO}/releases/latest`, headers: { 'User-Agent': 'nat-gate-npm-installer' } };

High

Ai Review Evidence

The installer fetches the latest GitHub release and downloads its binary without a pinned version or integrity check.

scripts/install.jsView on unpkg · L34

121// Download the binary console.log(`Downloading ${binaryName}...`); await downloadFile(asset.browser_download_url, BIN_PATH); // Make executable fs.chmodSync(BIN_PATH, 0o755);

High

Ai Review Evidence

The installer fetches the latest GitHub release and downloads its binary without a pinned version or integrity check.

scripts/install.jsView on unpkg · L121

131// Verify installation try { const version = execSync(`"${BIN_PATH}" --version`, { encoding: 'utf8' }); console.log(`Version: ${version.trim()}`); } catch (e) { // Binary might not run on this platform during npm install console.log('Note: Binary downloaded but could not verify (this is normal during cross-platform installs)');

High

Suspicious Lifecycle Evidence

The postinstall hook executes the downloaded binary automatically with --version.

scripts/install.jsView on unpkg · L131

Lines 101-150javascript

101 console.log(`Platform: linux, Architecture: ${process.arch}`);

102 console.log(`Binary: ${binaryName}`);

103

104 // Ensure bin directory exists

105 if (!fs.existsSync(BIN_DIR)) {

106 fs.mkdirSync(BIN_DIR, { recursive: true });

107 }

108

109 try {

110 // Get latest release info

111 console.log('Fetching latest release...');

112 const release = await getLatestRelease();

113 console.log(`Found release: ${release.tag_name}`);

114

115 // Find the correct asset

116 const asset = release.assets.find(a => a.name === binaryName);

117 if (!asset) {

118 throw new Error(`Binary ${binaryName} not found in release ${release.tag_name}`);

119 }

120

121 // Download the binary

122 console.log(`Downloading ${binaryName}...`);

123 await downloadFile(asset.browser_download_url, BIN_PATH);

124

125 // Make executable

126 fs.chmodSync(BIN_PATH, 0o755);

High

Ai Review Evidence

The installer fetches the latest GitHub release and downloads its binary without a pinned version or integrity check.

scripts/install.jsView on unpkg · L121

127

128 console.log('nat-gate installed successfully!');

129 console.log(`Binary location: ${BIN_PATH}`);

130

131 // Verify installation

132 try {

133 const version = execSync(`"${BIN_PATH}" --version`, { encoding: 'utf8' });

134 console.log(`Version: ${version.trim()}`);

135 } catch (e) {

136 // Binary might not run on this platform during npm install

137 console.log('Note: Binary downloaded but could not verify (this is normal during cross-platform installs)');

High

Suspicious Lifecycle Evidence

The postinstall hook executes the downloaded binary automatically with --version.

scripts/install.jsView on unpkg · L131

138 }

139

140 } catch (error) {

141 console.error('Installation failed:', error.message);

142 console.error('');

143 console.error('You can manually download from:');

144 console.error(` https://github.com/${REPO}/releases/latest`);

145 process.exit(1);

146 }

147}

148

149main();

150