registry / @iicp/client / 0.7.81

@iicp/client@0.7.81

Use the open IICP AI mesh from TypeScript or JavaScript without running a node

AI Security Review

scanned 13d ago · by lpm-firewall-ai

No confirmed malicious behavior, but the provider CLI has a default-on self-update path that can mutate the global npm installation during runtime. Other child-process and network primitives are visible CLI features for node hosting and tunnel reachability.

Static reason

One or more suspicious static signals were detected.

Trigger

Running `iicp-node serve` with auto-update enabled, or user-invoked init/tunnel workflows.

Impact

Unconsented package upgrade risk if a newer registry version is available; no evidence of credential theft, destructive action, or hidden exfiltration in this version.

Mechanism

runtime npm self-update and optional cloudflared subprocess

Attack narrative

A provider operator who runs `iicp-node serve` starts a background updater that checks the npm registry and, if a newer version exists, runs `npm install -g @iicp/client@latest` then re-execs the CLI. This is package-aligned maintenance behavior and opt-out via environment variable, but it is a real runtime package mutation surface.

Rationale

Static inspection does not show malicious install/import-time execution, credential harvesting, hidden exfiltration, persistence, or destructive behavior. The default-on runtime self-updater is a meaningful supply-chain risk, so warn rather than block.

Evidence

package.jsondist/index.jsdist/cli.jsdist/updater.jsdist/tunnel.jsdist/client.jsdist/identity.js~/.iicp/operator.json~/.iicp/nodes/<name>.json~/.iicp/state/quick_tunnel_rate_limit.json~/.iicp/state/quick_tunnel_create_gate.json

Network endpoints5

registry.npmjs.org/@iicp/client/latestiicp.network/apicloudflare-dns.com/dns-queryapi.ipify.orgapi.anthropic.com

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/updater.js default-on serve updater fetches npm latest and runs `npm install -g @iicp/client@latest`.
dist/cli.js startProviderAutoUpdate schedules updater for long-running provider processes unless IICP_AUTO_UPDATE disables it.
dist/cli.js init can run `npm install --no-save` for optional peer deps after interactive confirmation.
dist/tunnel.js spawns `cloudflared tunnel --url http://127.0.0.1:<port>` when NAT/tunnel path is requested or auto-selected.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
dist/index.js only re-exports SDK modules; no install-time or simple import-time updater execution observed.
Network use is aligned with IICP SDK/node operation: directory registration, backend probing, NAT checks, proxy/query, and update checks.
dist/client.js includes SSRF guards for discovered node endpoints.
Identity/config writes are user-invoked CLI/provider state under ~/.iicp, not hidden credential harvesting.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 511 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.ipify.org, api6.ipify.org, cloudflare-dns.com, iicp.network, pkg.cloudflare.com, registry.npmjs.org, schemas.xmlsoap.org

Source & flagged code

5 flagged

dist/tunnel.jsView file

Lines 2-42javascript

2// SPDX-License-Identifier: Apache-2.0

3/**

4 * Quick-Tunnel escalation — #520 rung 5 of the NAT ladder.

5 * TypeScript port of iicp-client-python/tunnel.py (0f97ca1).

6 *

7 * When every NAT variant fails (no direct endpoint, no UPnP pinhole, no IPv6

8 * GUA, no relay-capable peer in the directory), the node can still become

9 * publicly reachable with ZERO account, domain, or router changes: spawn

10 * `cloudflared tunnel --url http://127.0.0.1:<port>` and register the issued

11 * `https://*.trycloudflare.com` URL as the endpoint.

12 *

13 * Lifecycle is fully automatic: setup (binary detection — never auto-installed),

14 * initiation (spawn + URL parse ≤20 s), supervision (bounded respawn; URL

15 * rotates → caller re-registers), teardown (close() idempotent + process-exit

16 * hook so a normal exit never orphans the child).

17 */

18Object.defineProperty(exports, "__esModule", { value: true });

19exports.QuickTunnel = exports.INSTALL_HINT = exports.TUNNEL_DEAD_RETRY_MAX_MS = exports.TUNNEL_DEAD_RETRY_INITIAL_MS = exports.TUNNEL_CREATE_LEASE_MS = exports.TUNNEL_CREATE_MIN_INTERVAL_MS = exports.TUNNEL_RATE_LIMIT_COOLDOWN_MS = exports.TUNNEL_DOH_TIMEOUT_MS = exports.TUNNEL_VERIFY_TIMEOUT_MS

20exports.__resetQuickTunnelRateLimitForTests = __resetQuickTunnelRateLimitForTests;

21exports.cloudflaredPath = cloudflaredPath;

22exports.openQuickTunnel = openQuickTunnel;

23const node_child_process_1 = require("node:child_process");

24const fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L22

25const os = require("node:os");

26const path = require("node:path");

27const URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;

28/** cloudflared usually prints the URL within ~5 s; 20 s covers slow first runs. */

29exports.TUNNEL_START_TIMEOUT_MS = 20_000;

30/**

31 * Bounded self-healing: this many CONSECUTIVE failed respawns (without the tunnel

32 * recovering to a healthy state in between) → give up. Resets to 0 once a respawned

33 * tunnel passes a health check, so a long-running relay heals indefinitely. (#538)

34 */

35exports.MAX_RESPAWNS = 3;

36/**

37 * Active liveness check of the tunnel's OWN public URL — catches the failure mode the

38 * process-exit watcher misses: cloudflared still running but the edge connection

39 * dropped, so the URL is unreachable while the node looks healthy (the recurring

40 * dead-endpoint bug, #538). Probe every interval; after this many consecutive failures,

41 * force a tunnel restart (kill → exit hook respawns → new URL → re-register).

42 */

dist/node.jsView file

Lines 742-782javascript

742 _checkNonce(nonce) {

743 if (!nonce)

744 return true;

745 const now = Date.now();

746 // Evict expired nonces

747 for (const [k

dist/client.jsView file

Lines 1-27javascript

1"use strict";

2/**

3 * IicpClient — primary entrypoint for the IICP TypeScript SDK (ADR-016 §1).

4 * Implements SDK-01..SDK-06 conformance rules.

5 */

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.IicpClient = void 0;

8const

dist/cli.jsView file

Lines 387-427javascript

387 return "ollama";

388 return "custom";

389 }

390 if (await ok("/api/version"))

391 return "ollama";

392 return "custom";

Source & flagged code

5 flagged · loading source

dist/tunnel.jsView file

22exports.openQuickTunnel = openQuickTunnel; L23: const node_child_process_1 = require("node:child_process"); L24: const fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L22

dist/node.jsView file

762// eslint-disable-next-line @typescript-eslint/no-explicit-any L763: this._prom = await eval('import("prom-client")'); L764: this._tasksCounter = new this._prom.Counter({

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/node.jsView on unpkg · L762

dist/client.jsView file

7exports.IicpClient = void 0; L8: const node_crypto_1 = require("node:crypto"); L9: const confidentiality_js_1 = require("./confidentiality.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client.jsView on unpkg · L7

dist/cli.jsView file

2133const _MCP_DANGEROUS = new Set([ L2134: "bash", "sh", "zsh", "fish", "shell", "powershell", "pwsh", "cmd", L2135: "exec", "execute", "run_command", "run", "system", "eval", ... L2144: if (helpFlag) { L2145: process.stdout.write(`usage: iicp-node mcp-gateway [options]\n\n` + L2146: `Bridge a local MCP server into the IICP mesh as a registered provider node.\n\n` + L2147: `Options:\n` + L2148: ` --mcp-url URL IICP_MCP_URL — MCP server base URL (default http://localhost:8001)\n` + L2149: ` --tools NAMES IICP_MCP_TOOLS — comma-separated tool names to advertise (required)\n` +

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L2133

407try { L408: (0, node_child_process_1.execSync)(`npm install --no-save ${extras.join(" ")}`, { stdio: "inherit" }); L409: process.stdout.write(" ✓ done\n");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L407

Findings

4 High4 Medium5 Low

HighChild Processdist/tunnel.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

HighRuntime Package Installdist/cli.js

MediumDynamic Requiredist/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/node.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/tunnel.jsView file

Lines 2-42javascript

2// SPDX-License-Identifier: Apache-2.0

3/**

4 * Quick-Tunnel escalation — #520 rung 5 of the NAT ladder.

5 * TypeScript port of iicp-client-python/tunnel.py (0f97ca1).

6 *

7 * When every NAT variant fails (no direct endpoint, no UPnP pinhole, no IPv6

8 * GUA, no relay-capable peer in the directory), the node can still become

9 * publicly reachable with ZERO account, domain, or router changes: spawn

10 * `cloudflared tunnel --url http://127.0.0.1:<port>` and register the issued

11 * `https://*.trycloudflare.com` URL as the endpoint.

12 *

13 * Lifecycle is fully automatic: setup (binary detection — never auto-installed),

14 * initiation (spawn + URL parse ≤20 s), supervision (bounded respawn; URL

15 * rotates → caller re-registers), teardown (close() idempotent + process-exit

16 * hook so a normal exit never orphans the child).

17 */

18Object.defineProperty(exports, "__esModule", { value: true });

20exports.__resetQuickTunnelRateLimitForTests = __resetQuickTunnelRateLimitForTests;

21exports.cloudflaredPath = cloudflaredPath;

22exports.openQuickTunnel = openQuickTunnel;

23const node_child_process_1 = require("node:child_process");

24const fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L22

25const os = require("node:os");

26const path = require("node:path");

27const URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;

28/** cloudflared usually prints the URL within ~5 s; 20 s covers slow first runs. */

29exports.TUNNEL_START_TIMEOUT_MS = 20_000;

30/**

31 * Bounded self-healing: this many CONSECUTIVE failed respawns (without the tunnel

32 * recovering to a healthy state in between) → give up. Resets to 0 once a respawned

33 * tunnel passes a health check, so a long-running relay heals indefinitely. (#538)

34 */

35exports.MAX_RESPAWNS = 3;

36/**

37 * Active liveness check of the tunnel's OWN public URL — catches the failure mode the

38 * process-exit watcher misses: cloudflared still running but the edge connection

39 * dropped, so the URL is unreachable while the node looks healthy (the recurring

40 * dead-endpoint bug, #538). Probe every interval; after this many consecutive failures,

41 * force a tunnel restart (kill → exit hook respawns → new URL → re-register).

42 */

dist/node.jsView file

Lines 742-782javascript

742 _checkNonce(nonce) {

743 if (!nonce)

744 return true;

745 const now = Date.now();

746 // Evict expired nonces

747 for (const [k

dist/client.jsView file

Lines 1-27javascript

1"use strict";

2/**

3 * IicpClient — primary entrypoint for the IICP TypeScript SDK (ADR-016 §1).

4 * Implements SDK-01..SDK-06 conformance rules.

5 */

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.IicpClient = void 0;

8const

dist/cli.jsView file

Lines 387-427javascript

387 return "ollama";

388 return "custom";

389 }

390 if (await ok("/api/version"))

391 return "ollama";

392 return "custom";

Lines 2113-2153javascript

2113 if (argv[0] === "--version" || argv[0] === "-V") {

2114 process.stdout.write(`iicp-node ${SDK_VERSION}\n`);

2115 return 0;

2116 }

2117 try {

2118 return await dispatch(argv);

2119 }

2120 catch (exc) {

2121 if (exc instanceof CliError) {

2122 process.stderr.write(`ERROR: ${exc.message}\n`);

2123 return 2;

2124 }

2125 throw exc;

2126 }

2127}

2128// ── mcp-gateway (#512) ───────────────────────────────────────────────────────

2129// Backstop denylist on top of the operator's explicit --tools allowlist

2130// (red-team pass 3): shells/interpreters/exec primitives never to expose, even

2131// by accident. The required --tools allowlist + allow_tool_execution opt-in are

2132// the primary controls; this is a best-effort safety net.

2133const _MCP_DANGEROUS = new Set([

2134 "bash", "sh", "zsh", "fish", "shell", "powershell", "pwsh", "cmd",

2135 "exec", "execute", "run_command", "run", "system", "eval",

2136 "python", "python3", "node", "ruby", "perl", "subprocess", "popen", "spawn",

2137]);

2138function _toolToIntent(name) {

2139 const safe = name.toLowerCase().replace(/[^a-z0-9_]/g, "_");

2140 return `urn:iicp:intent:mcp:${safe}:v1`;

2141}

2142async function runMcpGateway(argv) {

2143 const helpFlag = argv.includes("--help") || argv.includes("-h");

2144 if (helpFlag) {

2145 process.stdout.write(`usage: iicp-node mcp-gateway [options]\n\n` +

2146 `Bridge a local MCP server into the IICP mesh as a registered provider node.\n\n` +

2147 `Options:\n` +

2148 ` --mcp-url URL IICP_MCP_URL — MCP server base URL (default http://localhost:8001)\n` +

2149 ` --tools NAMES IICP_MCP_TOOLS — comma-separated tool names to advertise (required)\n` +

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L2133

2150 ` --node-id ID IICP_NODE_ID — auto-generated if absent\n` +

2151 ` --public-endpoint U IICP_PUBLIC_ENDPOINT — externally reachable URL of this gateway\n` +

2152 ` --directory-url URL IICP_DIRECTORY_URL (default https://iicp.network/api/v1)\n` +