registry / Install hook abuse / @jait/gateway / 0.1.806

@jait/gateway@0.1.806

Jait AI gateway — local-first AI coding agent with terminal, filesystem, and browser control

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a real install-hook supply-chain risk because installation fetches and executes a non-npm third-party runtime. The inspected source does not establish malicious intent or the broader mutation and concealment required for a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall hook.

Impact

A registry-controlled Python dependency can execute during package installation and persist under the user’s Jait runtime directory.

Mechanism

Postinstall invokes pip to install graphifyy into a user runtime directory.

AI rationale

Evidence

package.jsonbin/install-runtime.mjsdist/services/code-graph/graphify-runtime.js~/.jait/runtime/graphify

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Installation automatically runs a runtime provisioner.
The provisioner creates a virtual environment and installs a pinned third-party Python package.

Evidence against

The installer names the dependency and pinned version in readable source.
No source evidence showed secret harvesting or an undisclosed exfiltration endpoint.
Provider API keys are used by user-invoked web-search functions, not by the install hook.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 707 file(s), 16.5 MB of source, external domains: 127.0.0.1, accounts.google.com, api.bitbucket.org, api.botframework.com, api.elevenlabs.io, api.github.com, api.moonshot.ai, api.openai.com, api.perplexity.ai, api.search.brave.com, api.telegram.org, api.x.ai, cdn.agentclientprotocol.com, chevrotain.io, clawhub.ai, dev.azure.com, en.wikipedia.org, fcm.googleapis.com, generativelanguage.googleapis.com, github.com, gmail.googleapis.com, graph.microsoft.com, ipapi.co, jquery.org, langium.org, lodash.com, login.botframework.com, login.microsoftonline.com, oauth2.googleapis.com, openjsf.org, openrouter.ai, packages.mozilla.org, react.dev, sts.windows.net, t.me, tldrlegal.com, underscorejs.org, wttr.in, www.googleapis.com, www.w3.org

Source & flagged code

27 flagged

package.jsonView file

Lines 4-44json

4 "description": "Jait AI gateway — local-first AI coding agent with terminal, filesystem, and browser control",

5 "author": "JakobWl",

6 "type": "module",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "bin": {

10 "jait": "./bin/jait.mjs"

11 },

12 "files": [

13 "dist",

14 "bin",

15 "web-dist",

16 "skills"

17 ],

18 "scripts": {

19 "prebuild": "bun run --filter @jait/web build && bun run bundle-web",

20 "bundle-web": "node scripts/bundle-web.mjs",

21 "build": "tsc",

22 "dev": "bun run --filter @jait/web build && bun --watch src/index.ts",

23 "start": "node dist/index.js",

24 "postinstall": "node ./bin/install-runtime.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "typecheck": "tsc --noEmit"

26 },

27 "keywords": [

28 "ai",

29 "agent",

30 "coding",

31 "gateway",

32 "terminal",

33 "local-first"

34 ],

35 "license": "MIT",

36 "repository": {

37 "type": "git",

38 "url": "https://github.com/Widev-e-U/Jait.git",

39 "directory": "packages/gateway"

40 },

41 "homepage": "https://jait.dev",

42 "engines": {

43 "node": ">=22.5.0"

44 },

web-dist/assets/php-Csjmro_R.jsView file

Lines 1-3javascript

1import e from"./html-pp8916En.js";import t from"./xml-sdJ4AIDG.js";import n from"./sql-CRqJ_cUM.js";import a from"./javascript-wDzz0qaB.js";import r from"./json-Cp-IABpG.js";import i from

bin/jait.mjsView file

Lines 10-50javascript

10 * jait status Check if the gateway is running

11 * jait doctor Run local diagnostics

12 * jait update Update the gateway and restart it when managed

13 * jait reset Wipe all data

14 * jait --port 9000 Use a custom port

dist/tools/screenshot-tools.jsView file

Lines 39-79javascript

39 description: "Click these elements before capturing (in order).",

40 },

41 fill: {

42 type: "array",

43 items: { type: "string",

web-dist/assets/codeql-DsOJ9woJ.jsView file

Lines 1-3javascript

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\babstract(?![0-9A-Z_a-z])","name":"storage.modifier.abstract.ql"},"additional":{"match":"\\\\badditional(?![0-9A-Z_a-z])","name":"storage.modifier.additional.ql"},"and":{"match":"\\\\band(?![0-9A-Z_a-z])","name":"keyword.other.and.ql"},"annotation":{"patterns":[{"include":"#bindingset-annotation"},{"include":"#language-annotation"},{"include":"#pragma-annotation"},{"include":"#annotation-keyword"}]},"annotation-keywo ...

2//# sourceMappingURL=codeql-DsOJ9woJ.js.map

dist/tools/redeploy-tools.jsView file

Lines 81-121javascript

81 windowsHide: true,

82 });

83 }

84 catch (err) {

85 const msg = err instanceof Error ? err.message

dist/tools/browser-tools.jsView file

Lines 1-25javascript

1import { parseJaitBackendInstances } from "@jait/shared";

2import { BrowserSurface } from "../surfaces/browser.js";

3import { SSRFGuard } from "../security/ssrf-guard.js";

4import { SandboxManager } from "../security/sandbox-manager.js"

dist/surfaces/browser.jsView file

398package = @jait/gateway; repositoryIdentity = jait; dependency = playwright L398: // boot in environments that do not need browser automation. L399: const loadPlaywright = new Function("return import('playwright')"); L400: let mod;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/surfaces/browser.jsView on unpkg · L398

dist/services/git-forge.jsView file

6Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/services/thread-review-sync.js -> dist/services/git-forge.js L6: */ L7: import { exec as execCb } from "node:child_process"; L8: import { writeFile, unlink } from "node:fs/promises"; ... L13: return new Promise((resolve, reject) => { L14: execCb(cmd, { encoding: "utf-8", windowsHide: true, ...opts }, (error, stdout, stderr) => { L15: if (error) { ... L27: function cleanGhEnv() { L28: const { GH_REPO, GH_HOST, GH_TOKEN, GITHUB_TOKEN, ...rest } = process.env; L29: return rest; ... L101: proc.on("error", () => resolve(null)); L102: proc.stdin.write("protocol=https\nhost=github.com\n\n"); L103: proc.stdin.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/services/git-forge.jsView on unpkg · L6

web-dist/noVNC/app/images/icons/MakefileView file

•path = web-[redacted] kind = build_helper sizeBytes = 1331 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web-dist/noVNC/app/images/icons/MakefileView on unpkg

web-dist/noVNC/app/sounds/bell.ogaView file

•path = web-dist/noVNC/app/sounds/bell.oga kind = high_entropy_blob sizeBytes = 8495 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-dist/noVNC/app/sounds/bell.ogaView on unpkg

dist/channels/manager.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 17

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels/manager.js#virtual:normalized:round1View on unpkg

dist/routes/network.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.804 matchedPath = dist/routes/network.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High