@jait/gateway@0.1.715: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@jait/gateway@0.1.715: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install-runtime.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

web-dist/assets/php-Csjmro_R.jsView file

1import e from"./html-pp8916En.js";import t from"./xml-sdJ4AIDG.js";import n from"./sql-CRqJ_cUM.js";import a from"./javascript-wDzz0qaB.js";import r from"./json-Cp-IABpG.js";import... L2: //# sourceMappingURL=php-Csjmro_R.js.map

High

Child Process

Package source references child process execution.

web-dist/assets/php-Csjmro_R.jsView on unpkg · L1

bin/jait.mjsView file

742L743: const execArgs = [nodePath, jaitBin]; L744: if (existsSync(envFlag)) execArgs.push("--env", envFlag);

High

Shell

Package source references shell execution.

bin/jait.mjsView on unpkg · L742

dist/tools/screenshot-tools.jsView file

59try { L60: const loadPlaywright = new Function("return import('playwright')"); L61: const mod = (await loadPlaywright());

High

Eval

Package source references dynamic code evaluation.

dist/tools/screenshot-tools.jsView on unpkg · L59

web-dist/assets/codeql-DsOJ9woJ.jsView file

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\... L2: //# sourceMappingURL=codeql-DsOJ9woJ.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web-dist/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

dist/tools/redeploy-tools.jsView file

101log(`🐤 Starting canary on port ${canaryPort}...\n`); L102: const canary = spawn("jait", ["--port", String(canaryPort)], { L103: stdio: "ignore", L104: detached: true, L105: env: { ...process.env, PORT: String(canaryPort), __JAIT_CLI: "1" }, L106: windowsHide: true, ... L108: canary.unref(); L109: const healthy = await waitForHealth(`http://127.0.0.1:${canaryPort}`, 30_000); L110: if (!healthy) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/tools/redeploy-tools.jsView on unpkg · L101

6* **systemd** (detected when INVOCATION_ID is set): L7: * 1. npm install -g @jait/gateway@latest L8: * 2. Spawn canary on PORT+1, health-check it ... L19: */ L20: import { execSync, spawn } from "node:child_process"; L21: export function createRedeployTool(deps) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/tools/redeploy-tools.jsView on unpkg · L6

dist/tools/browser-tools.jsView file

4const DEFAULT_BROWSER_ID = "browser-default"; L5: const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1"; L6: const DEFAULT_OPENAI_WEB_SEARCH_MODEL = "gpt-5"; ... L131: message: `Navigated to ${snapshot.url}`, L132: data: buildSnapshotPayload(surface.id, snapshot, session), L133: }; ... L362: const timeout = setTimeout(() => controller.abort(), timeoutMs); L363: const ignoreTlsErrors = input.ignoreTlsErrors === true || process.env["WEB_FETCH_IGNORE_TLS_ERRORS"] === "true"; L364: try { ... L370: }, ignoreTlsErrors); L371: const text = await response.text(); L372: return {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/tools/browser-tools.jsView on unpkg · L4

web-dist/noVNC/app/images/icons/MakefileView file

•path = web-[redacted] kind = build_helper sizeBytes = 1331 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web-dist/noVNC/app/images/icons/MakefileView on unpkg

web-dist/noVNC/app/sounds/bell.ogaView file

•path = web-dist/noVNC/app/sounds/bell.oga kind = high_entropy_blob sizeBytes = 8495 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-dist/noVNC/app/sounds/bell.ogaView on unpkg

web-dist/assets/index-2K7jP91E.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

web-dist/assets/index-2K7jP91E.jsView on unpkg

web-dist/assets/flowDiagram-UKHOOZJN-BzI6GKJQ.jsView file

•matchType = normalized_sha256 matchedPackage = @seele00/seele@0.1.81 matchedPath = web/dist/assets/flowDiagram-23GEKE2U-Di3U_AN7.js matchedIdentity = npm:QHNlZWxlMDAvc2VlbGU:0.1.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

web-dist/assets/flowDiagram-UKHOOZJN-BzI6GKJQ.jsView on unpkg

web-dist/assets/ganttDiagram-PKOTCBZU-BZLe_WOw.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.693 matchedPath = web-dist/assets/ganttDiagram-A5KZAMGK-D2X9MWVw.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.693 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

web-dist/assets/ganttDiagram-PKOTCBZU-BZLe_WOw.jsView on unpkg

web-dist/assets/wardleyDiagram-T6FBY63Y-iVGntqw1.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @jait/gateway@0.1.714 matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.714 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

web-dist/assets/wardleyDiagram-T6FBY63Y-iVGntqw1.jsView on unpkg

Lines 81-121javascript

81 windowsHide: true,

82 });

83 }

84 catch (err) {

85 const msg = err instanceof Error ? err.message : String(err);

86 return { ok: false, message: `npm install failed: ${msg}` };

87 }

88 // ── 3. Read new version ───────────────────────────────────────────

89 let newVersion = "unknown";

90 try {

91 const raw = execSync("npm list -g @jait/gateway --depth=0 --json", { encoding: "utf8", timeout: 10_000, windowsHide: true, stdio: "pipe" });

92 newVersion = JSON.parse(raw).dependencies?.["@jait/gateway"]?.version ?? "unknown";

93 }

94 catch {

95 // non-critical

96 }

97 log(`✓ Installed @jait/gateway ${newVersion} (was ${oldVersion})\n`);

98 // ── 4. Canary health check ────────────────────────────────────────

99 if (!skipCanary) {

100 const canaryPort = deps.port + 1;

101 log(`🐤 Starting canary on port ${canaryPort}...\n`);

102 const canary = spawn("jait", ["--port", String(canaryPort)], {

103 stdio: "ignore",

104 detached: true,

105 env: { ...process.env, PORT: String(canaryPort), __JAIT_CLI: "1" },

106 windowsHide: true,

107 });

108 canary.unref();

109 const healthy = await waitForHealth(`http://127.0.0.1:${canaryPort}`, 30_000);

110 if (!healthy) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/tools/redeploy-tools.jsView on unpkg · L101

111 try {

112 process.kill(-canary.pid, "SIGTERM");

113 }

114 catch { /* ignore */ }

115 return {

116 ok: false,

117 message: `Canary failed health check on port ${canaryPort}. ` +

118 `Update installed but NOT activated. Current gateway is still running.`,

119 data: { oldVersion, newVersion, canaryPort },

120 };

121 }