registry / @iicp/client / 0.7.88

@iicp/client@0.7.88

Use the open IICP AI mesh from TypeScript or JavaScript without running a node

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Long-running `iicp-node serve` and `mcp-gateway` processes enable a default-on background self-updater. It can replace the globally installed package with the npm `latest` release and restart the process.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run a long-lived provider command and leave `IICP_AUTO_UPDATE` enabled (default).

Impact

A future registry/latest compromise or unsafe release can execute as the operator through automatic global upgrade.

Mechanism

Fetches package metadata, globally installs latest, then detached-reexecs the CLI.

Rationale

Source inspection does not substantiate malicious intent or covert exfiltration. The default-on self-updater is nevertheless a meaningful supply-chain execution risk and warrants a warning.

Evidence

package.jsondist/cli.jsdist/updater.jsdist/service.jsdist/identity.jsdist/tunnel.js

Network endpoints1

registry.npmjs.org/@iicp/client/latest

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/cli.js` starts a default-on auto-updater for long-running provider commands.
`dist/updater.js` fetches npm latest metadata and runs `npm install -g @iicp/client@latest`.
`dist/updater.js` detaches and re-executes the CLI after a successful upgrade.
`dist/cli.js` also offers explicit service-unit installation and optional dependency installation.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
The update target is the package's own npm name and registry endpoint, not an unrelated payload host.
Filesystem writes inspected are operator/node configuration, locks, logs, or explicit service units.
No source evidence of credential harvesting, secret exfiltration, destructive actions, or AI-agent configuration mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 563 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.ipify.org, api6.ipify.org, cloudflare-dns.com, iicp.network, pkg.cloudflare.com, registry.npmjs.org, schemas.xmlsoap.org

Source & flagged code

5 flagged

dist/tunnel.jsView file

Lines 2-42javascript

2// SPDX-License-Identifier: Apache-2.0

3/**

4 * Quick-Tunnel escalation — #520 rung 5 of the NAT ladder.

5 * TypeScript port of iicp-client-python/tunnel.py (0f97ca1).

6 *

7 * When every NAT variant fails (no direct endpoint, no UPnP pinhole, no IPv6

8 * GUA, no relay-capable peer in the directory), the node can still become

9 * publicly reachable with ZERO account, domain, or router changes: spawn

10 * `cloudflared tunnel --url http://127.0.0.1:<port>` and register the issued

11 * `https://*.trycloudflare.com` URL as the endpoint.

12 *

13 * Lifecycle is fully automatic: setup (binary detection — never auto-installed),

14 * initiation (spawn + URL parse ≤20 s), supervision (bounded respawn; URL

15 * rotates → caller re-registers), teardown (close() idempotent + process-exit

16 * hook so a normal exit never orphans the child).

17 */

18Object.defineProperty(exports, "__esModule", { value: true });

19exports.QuickTunnel = exports.INSTALL_HINT = exports.TUNNEL_DEAD_RETRY_MAX_MS = exports.TUNNEL_DEAD_RETRY_INITIAL_MS = exports.TUNNEL_CREATE_LEASE_MS = exports.TUNNEL_CREATE_MIN_INTERVAL_MS = exports.TUNNEL_RATE_LIMIT_COOLDOWN_MS = exports.TUNNEL_DOH_TIMEOUT_MS = exports.TUNNEL_VERIFY_TIMEOUT_MS

20exports.__resetQuickTunnelRateLimitForTests = __resetQuickTunnelRateLimitForTests;

21exports.cloudflaredPath = cloudflaredPath;

22exports.openQuickTunnel = openQuickTunnel;

23const node_child_process_1 = require("node:child_process");

24const fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L22

25const os = require("node:os");

26const path = require("node:path");

27const URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;

28/** cloudflared usually prints the URL within ~5 s; 20 s covers slow first runs. */

29exports.TUNNEL_START_TIMEOUT_MS = 20_000;

30/**

31 * Bounded self-healing: this many CONSECUTIVE failed respawns (without the tunnel

32 * recovering to a healthy state in between) → give up. Resets to 0 once a respawned

33 * tunnel passes a health check, so a long-running relay heals indefinitely. (#538)

34 */

35exports.MAX_RESPAWNS = 3;

36/**

37 * Active liveness check of the tunnel's OWN public URL — catches the failure mode the

38 * process-exit watcher misses: cloudflared still running but the edge connection

39 * dropped, so the URL is unreachable while the node looks healthy (the recurring

40 * dead-endpoint bug, #538). Probe every interval; after this many consecutive failures,

41 * force a tunnel restart (kill → exit hook respawns → new URL → re-register).

42 */

dist/node.jsView file

Lines 783-823javascript

783 _checkNonce(nonce) {

784 if (!nonce)

785 return true;

786 const now = Date.now();

787 // Evict expired nonces

788 for (const [k

dist/client.jsView file

Lines 1-27javascript

1"use strict";

2/**

3 * IicpClient — primary entrypoint for the IICP TypeScript SDK (ADR-016 §1).

4 * Implements SDK-01..SDK-06 conformance rules.

5 */

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.IicpClient = void 0;

8const

dist/cli.jsView file

Lines 395-435javascript

395 return "ollama";

396 return "custom";

397 }

398 if (await ok("/api/version"))

399 return "ollama";

400 return "custom";

Source & flagged code

5 flagged · loading source

dist/tunnel.jsView file

22exports.openQuickTunnel = openQuickTunnel; L23: const node_child_process_1 = require("node:child_process"); L24: const fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L22

dist/node.jsView file

803// eslint-disable-next-line @typescript-eslint/no-explicit-any L804: this._prom = await eval('import("prom-client")'); L805: this._tasksCounter = new this._prom.Counter({

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/node.jsView on unpkg · L803

dist/client.jsView file

7exports.IicpClient = void 0; L8: const node_crypto_1 = require("node:crypto"); L9: const confidentiality_js_1 = require("./confidentiality.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client.jsView on unpkg · L7

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @iicp/client@0.7.82 matchedIdentity = npm:QGlpY3AvY2xpZW50:0.7.82 similarity = 0.705 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

415try { L416: (0, node_child_process_1.execSync)(`npm install --no-save ${extras.join(" ")}`, { stdio: "inherit" }); L417: process.stdout.write(" ✓ done\n");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L415

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/tunnel.js

HighShell

HighRuntime Package Installdist/cli.js

MediumDynamic Requiredist/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/node.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/tunnel.jsView file

Lines 2-42javascript

2// SPDX-License-Identifier: Apache-2.0

3/**

4 * Quick-Tunnel escalation — #520 rung 5 of the NAT ladder.

5 * TypeScript port of iicp-client-python/tunnel.py (0f97ca1).

6 *

7 * When every NAT variant fails (no direct endpoint, no UPnP pinhole, no IPv6

8 * GUA, no relay-capable peer in the directory), the node can still become

9 * publicly reachable with ZERO account, domain, or router changes: spawn

10 * `cloudflared tunnel --url http://127.0.0.1:<port>` and register the issued

11 * `https://*.trycloudflare.com` URL as the endpoint.

12 *

13 * Lifecycle is fully automatic: setup (binary detection — never auto-installed),

14 * initiation (spawn + URL parse ≤20 s), supervision (bounded respawn; URL

15 * rotates → caller re-registers), teardown (close() idempotent + process-exit

16 * hook so a normal exit never orphans the child).

17 */

18Object.defineProperty(exports, "__esModule", { value: true });

20exports.__resetQuickTunnelRateLimitForTests = __resetQuickTunnelRateLimitForTests;

21exports.cloudflaredPath = cloudflaredPath;

22exports.openQuickTunnel = openQuickTunnel;

23const node_child_process_1 = require("node:child_process");

24const fs = require("node:fs");

High

Child Process

Package source references child process execution.

dist/tunnel.jsView on unpkg · L22

25const os = require("node:os");

26const path = require("node:path");

27const URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;

28/** cloudflared usually prints the URL within ~5 s; 20 s covers slow first runs. */

29exports.TUNNEL_START_TIMEOUT_MS = 20_000;

30/**

31 * Bounded self-healing: this many CONSECUTIVE failed respawns (without the tunnel

32 * recovering to a healthy state in between) → give up. Resets to 0 once a respawned

33 * tunnel passes a health check, so a long-running relay heals indefinitely. (#538)

34 */

35exports.MAX_RESPAWNS = 3;

36/**

37 * Active liveness check of the tunnel's OWN public URL — catches the failure mode the

38 * process-exit watcher misses: cloudflared still running but the edge connection

39 * dropped, so the URL is unreachable while the node looks healthy (the recurring

40 * dead-endpoint bug, #538). Probe every interval; after this many consecutive failures,

41 * force a tunnel restart (kill → exit hook respawns → new URL → re-register).

42 */

dist/node.jsView file

Lines 783-823javascript

783 _checkNonce(nonce) {

784 if (!nonce)

785 return true;

786 const now = Date.now();

787 // Evict expired nonces

788 for (const [k

dist/client.jsView file

Lines 1-27javascript

1"use strict";

2/**

3 * IicpClient — primary entrypoint for the IICP TypeScript SDK (ADR-016 §1).

4 * Implements SDK-01..SDK-06 conformance rules.

5 */

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.IicpClient = void 0;

8const

dist/cli.jsView file

Lines 395-435javascript

395 return "ollama";

396 return "custom";

397 }

398 if (await ok("/api/version"))

399 return "ollama";

400 return "custom";