registry / @h3nr1-d14z/nat-gate / 2.2.0

@h3nr1-d14z/nat-gate@2.2.0

CLI tool for managing iptables port forwarding through Tailscale tunnels

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Npm installation fetches an unpinned latest-release binary and executes it. The remotely supplied executable is outside the reviewed package snapshot.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package runs postinstall on Linux x64 or arm64.

Impact

A changed or compromised release asset can run arbitrary code with the installing user's privileges.

Mechanism

Unpinned remote binary download followed by install-time execution.

AI rationale

This package creates a real install-time remote-code-execution risk by executing an unverified, mutable release asset. The source does not establish a malicious payload or broader persistence, so it should be warned on rather than blocked as malware.

Evidence

package.jsonscripts/install.jsbin/nat-gate

Network endpoints2

api.github.comgithub.com

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with medium false-positive risk.

@h3nr1-d14z/nat-gate@2.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code