registry / Install hook abuse / @jait/gateway / 0.1.808

@jait/gateway@0.1.808

Jait AI gateway — local-first AI coding agent with terminal, filesystem, and browser control

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a real automatic install-time dependency-provisioning path, but the inspected code does not establish credential theft, stealth persistence, or foreign AI-agent configuration mutation. This is an unresolved supply-chain and install-hook risk that warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation, through the postinstall lifecycle hook

Impact

A registry install can run dependency-supplied Python code outside the npm package's own contents.

Mechanism

automatic Python virtual-environment creation and pip installation

AI rationale

Evidence

package.jsonbin/install-runtime.mjsdist/services/code-graph/graphify-runtime.js~/.jait/runtime/graphify~/.jait/runtime/graphify/venv~/.jait/runtime/graphify/runtime.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall hook automatically launches a runtime installer.
The installer creates a home-directory virtual environment and runs pip install for a third-party package.
This gives installation-time code network-backed dependency execution without an explicit user command.

Evidence against

The package pins the downloaded Python package to a specific version.
The inspected installer only provisions its stated Graphify runtime; no credential collection or AI-agent control-surface mutation was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

Source & flagged code

27 flagged

package.jsonView file

Lines 4-44json

4 "description": "Jait AI gateway — local-first AI coding agent with terminal, filesystem, and browser control",

5 "author": "JakobWl",

6 "type": "module",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "bin": {

10 "jait": "./bin/jait.mjs"

11 },

12 "files": [

13 "dist",

14 "bin",

15 "web-dist",

16 "skills"

17 ],

18 "scripts": {

19 "prebuild": "bun run --filter @jait/web build && bun run bundle-web",

20 "bundle-web": "node scripts/bundle-web.mjs",

21 "build": "tsc",

22 "dev": "bun run --filter @jait/web build && bun --watch src/index.ts",

23 "start": "node dist/index.js",

24 "postinstall": "node ./bin/install-runtime.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "typecheck": "tsc --noEmit"

26 },

27 "keywords": [

28 "ai",

29 "agent",

30 "coding",

31 "gateway",

32 "terminal",

33 "local-first"

34 ],

35 "license": "MIT",

36 "repository": {

37 "type": "git",

38 "url": "https://github.com/Widev-e-U/Jait.git",

39 "directory": "packages/gateway"

40 },

41 "homepage": "https://jait.dev",

42 "engines": {

43 "node": ">=22.5.0"

44 },

web-dist/assets/index-Bdydn-FB.jsView file

Lines 121-144javascript

121Join_Control Join_C

122Logical_Order_Exception LOE

123Lowercase Lower

124Math

125Noncharacter_Code_Point NChar

126Pattern_Syntax Pat_Syn

127Pattern_White_Space Pat_WS

128Quotation_Mark QMark

129Radical

130Regional_Indicator RI

bin/jait.mjsView file

Lines 10-50javascript

10 * jait status Check if the gateway is running

11 * jait doctor Run local diagnostics

12 * jait update Update the gateway and restart it when managed

13 * jait reset Wipe all data

14 * jait --port 9000 Use a custom port

dist/tools/screenshot-tools.jsView file

Lines 39-79javascript

39 description: "Click these elements before capturing (in order).",

40 },

41 fill: {

42 type: "array",

43 items: { type: "string",

web-dist/assets/codeql-DsOJ9woJ.jsView file

Lines 1-3javascript

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\babstract(?![0-9A-Z_a-z])","name":"storage.modifier.abstract.ql"},"additional":{"match":"\\\\badditional(?![0-9A-Z_a-z])","name":"storage.modifier.additional.ql"},"and":{"match":"\\\\band(?![0-9A-Z_a-z])","name":"keyword.other.and.ql"},"annotation":{"patterns":[{"include":"#bindingset-annotation"},{"include":"#language-annotation"},{"include":"#pragma-annotation"},{"include":"#annotation-keyword"}]},"annotation-keywo ...

2//# sourceMappingURL=codeql-DsOJ9woJ.js.map

dist/tools/redeploy-tools.jsView file

Lines 81-121javascript

81 windowsHide: true,

82 });

83 }

84 catch (err) {

85 const msg = err instanceof Error ? err.message

dist/tools/browser-tools.jsView file

Lines 1-25javascript

1import { parseJaitBackendInstances } from "@jait/shared";

2import { BrowserSurface } from "../surfaces/browser.js";

3import { SSRFGuard } from "../security/ssrf-guard.js";

4import { SandboxManager } from "../security/sandbox-manager.js"

dist/surfaces/browser.jsView file

398package = @jait/gateway; repositoryIdentity = jait; dependency = playwright L398: // boot in environments that do not need browser automation. L399: const loadPlaywright = new Function("return import('playwright')"); L400: let mod;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/surfaces/browser.jsView on unpkg · L398

dist/services/git-forge.jsView file

6Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/services/thread-review-sync.js -> dist/services/git-forge.js L6: */ L7: import { exec as execCb } from "node:child_process"; L8: import { writeFile, unlink } from "node:fs/promises"; ... L13: return new Promise((resolve, reject) => { L14: execCb(cmd, { encoding: "utf-8", windowsHide: true, ...opts }, (error, stdout, stderr) => { L15: if (error) { ... L27: function cleanGhEnv() { L28: const { GH_REPO, GH_HOST, GH_TOKEN, GITHUB_TOKEN, ...rest } = process.env; L29: return rest; ... L101: proc.on("error", () => resolve(null)); L102: proc.stdin.write("protocol=https\nhost=github.com\n\n"); L103: proc.stdin.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/services/git-forge.jsView on unpkg · L6

web-dist/noVNC/app/images/icons/MakefileView file

•path = web-[redacted] kind = build_helper sizeBytes = 1331 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web-dist/noVNC/app/images/icons/MakefileView on unpkg

web-dist/noVNC/app/sounds/bell.ogaView file

•path = web-dist/noVNC/app/sounds/bell.oga kind = high_entropy_blob sizeBytes = 8495 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-dist/noVNC/app/sounds/bell.ogaView on unpkg

dist/channels/manager.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 17

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels/manager.js#virtual:normalized:round1View on unpkg

dist/routes/network.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.807 matchedPath = dist/routes/network.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High