Loading npm security reports…
@jait/gateway@0.1.861: Agent extension lifecycle risk – flagged | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
scanned 14d ago · by lpm-firewall-ai The source shows a guarded, per-session pi MCP integration that cleans up its temporary files. This first-party agent setup warrants a warning, but the inspected behavior does not establish a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A pi or pi-gemini provider session starts with MCP servers.
Impact
The agent receives the session’s configured MCP tools; the inspected code does not establish an attack or broad persistent configuration change.
Mechanism
The provider creates a temporary MCP config and wrapper, then supplies the wrapper through the pi command environment.
AI rationale
The source shows a guarded, per-session pi MCP integration that cleans up its temporary files. This first-party agent setup warrants a warning, but the inspected behavior does not establish a concrete attack.
Evidence
dist/providers/pi-mcp-provision.js dist/providers/acp-provider.js
public snapshot AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
When a pi-based provider starts a session, the caller provisions MCP servers supplied for that session and adds the wrapper to the child environment. The provisioning writes a temporary MCP config and wrapper only for pi providers with MCP servers, then provides cleanup to remove the temporary directory. The source says this keeps session URLs out of global and project pi configuration; the behavior is a guarded, first-party agent integration. Evidence against
The inspected code did not establish credential theft, unrelated credential forwarding, or an unconsented broad agent configuration write. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified PossibleObfuscation UrlStrings
27 flagged · loading source • scripts.postinstall = node ./bin/install-runtime.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg 141 ?|[
L142: \v\f
\u2028\u2029])`),r));else if(p==="posix")if(!o&&(c==="graph"||c==="print")){if(i==="strict")throw new Error(`POSIX class "${c}" requires min target ES2024 or non-strict accura...
L143: //# sourceMappingURL=index-DhGtPmd9.js.map
High Child Process
Package source references child process execution.
web-dist/assets/index-DhGtPmd9.js View on unpkg · L141 742 L743: const execArgs = [nodePath, jaitBin];
L744: if (existsSync(envFlag)) execArgs.push("--env", envFlag);
2 Critical 23 High 5 Medium 4 Low
Critical Credential Exfiltration dist/tools/browser-tools.js
Critical Trigger Reachable Dangerous Capability dist/tools/browser-tools.js
High Install Time Lifecycle Scripts package.json
High Child Process web-dist/assets/index-DhGtPmd9.js
High Shell bin/jait.mjs
High Eval dist/tools/screenshot-tools.js
High Entrypoint Build Divergence bin/jait.mjs
High Same File Env Network Execution dist/tools/redeploy-tools.js
High Copied Package Dependency Bridge dist/surfaces/browser.js
High Trigger Reachable Credential Exfiltration dist/services/git-forge.js
High Runtime Package Install dist/tools/redeploy-tools.js
Affected versions and remediation This report applies to @jait/gateway@0.1.861 .
See all versions of @jait/gateway for other recorded verdicts.
Review the evidence and your use of @jait/gateway@0.1.861 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-09 05:32:03.611Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
78% Suspicious
AI assessment confidence
Package metadata npm Author JakobWl
Maintainers jakobwl
Version 0.1.861
Latest on npm 0.1.959
Published Sep 16, 2026
License MIT
Dependencies 23
Integrity verified
Package size 14.3 MB
Files 2,030
Keywords ai agent coding gateway terminal local-first
Manifest No manifest risk signals triggered.
scanned 718 file(s), 16.7 MB of source, external domains: 127.0.0.1, accounts.google.com, api.bitbucket.org, api.botframework.com, api.elevenlabs.io, api.github.com, api.moonshot.ai, api.openai.com, api.perplexity.ai, api.search.brave.com, api.telegram.org, api.x.ai, cdn.agentclientprotocol.com, chevrotain.io, clawhub.ai, dev.azure.com, en.wikipedia.org, fcm.googleapis.com, generativelanguage.googleapis.com, github.com, gmail.googleapis.com, graph.microsoft.com, ipapi.co, langium.org, login.botframework.com, login.microsoftonline.com, oauth2.googleapis.com, ollama.com, openrouter.ai, packages.mozilla.org, react.dev, sts.windows.net, t.me, wttr.in, www.googleapis.com, www.w3.org
Oversized source lightweight scan
web-dist/assets/index-D0OwBmRO.js 3.69 MB file, sampled 256 KB
Network WebSocket HighEntropyStrings Minified UrlStrings react.dev www.w3.org
30 Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L30: import { fileURLToPath } from "node:url";
L31: import { execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L32: import { createConnection } from "node:net";
L33: import { createInterface } from "node:readline";
L34:
L35: const __dirname = dirname(fileURLToPath(import.meta.url));
L36: const pkg = JSON.parse(
L37: readFileSync(resolve(__dirname, "..", "package.json"), "utf8"),
L38: );
...
L118: } catch (err) {
L119: if (silent) return err.stdout || "";
L120: throw err;
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/jait.mjs View on unpkg · L30 • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = bin/jait.mjs
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/jait.mjs View on unpkg 59 try {
L60: const loadPlaywright = new Function("return import('playwright')");
L61: const mod = (await loadPlaywright());
High Eval
Package source references dynamic code evaluation.
dist/tools/screenshot-tools.js View on unpkg · L59 20 try {
L21: const { ensureGraphifyRuntime } = await import(runtimeModule);
L22: await ensureGraphifyRuntime({
Medium Dynamic Require
Package source references dynamic require/import behavior.
bin/install-runtime.mjs View on unpkg · L20 110 log(`🐤 Starting canary on port ${canaryPort}...\n`);
L111: const canary = spawn("jait", ["--port", String(canaryPort)], {
L112: stdio: "ignore",
L113: detached: true,
L114: env: { ...process.env, PORT: String(canaryPort), __JAIT_CLI: "1" },
L115: windowsHide: true,
...
L117: canary.unref();
L118: const healthy = await waitForHealth(`http://127.0.0.1:${canaryPort}`, 30_000);
L119: if (!healthy) {
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools/redeploy-tools.js View on unpkg · L110 6 * **systemd** (detected when INVOCATION_ID is set):
L7: * 1. npm install -g @jait/gateway@latest
L8: * 2. Spawn canary on PORT+1, health-check it
...
L19: */
L20: import { execSync, spawn } from "node:child_process";
L21: import { describeUpdateFailure } from "../routes/update-failure.js";
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/tools/redeploy-tools.js View on unpkg · L6 5 const DEFAULT_BROWSER_ID = "browser-default";
L6: const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
L7: const DEFAULT_OPENAI_WEB_SEARCH_MODEL = "gpt-5";
...
L132: message: `Navigated to ${snapshot.url}`,
L133: data: buildSnapshotPayload(surface.id, snapshot, session),
L134: };
...
L363: const timeout = setTimeout(() => controller.abort(), timeoutMs);
L364: const ignoreTlsErrors = input.ignoreTlsErrors === true || process.env["WEB_FETCH_IGNORE_TLS_ERRORS"] === "true";
L365: try {
...
L371: }, ignoreTlsErrors);
L372: const text = await response.text();
L373: return {
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/tools/browser-tools.js View on unpkg · L5 5 Trigger-reachable chain: scripts.start -> dist/index.js -> dist/tools/index.js -> dist/tools/browser-tools.js
L5: const DEFAULT_BROWSER_ID = "browser-default";
L6: const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
L7: const DEFAULT_OPENAI_WEB_SEARCH_MODEL = "gpt-5";
...
L132: message: `Navigated to ${snapshot.url}`,
L133: data: buildSnapshotPayload(surface.id, snapshot, session),
L134: };
...
L363: const timeout = setTimeout(() => controller.abort(), timeoutMs);
L364: const ignoreTlsErrors = input.ignoreTlsErrors === true || process.env["WEB_FETCH_IGNORE_TLS_ERRORS"] === "true";
L365: try {
...
L371: }, ignoreTlsErrors);
L372: const text = await response.text();
L373: return {
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/tools/browser-tools.js View on unpkg · L5 398 package = @jait/gateway; repositoryIdentity = jait; dependency = playwright
L398: // boot in environments that do not need browser automation.
L399: const loadPlaywright = new Function("return import('playwright')");
L400: let mod;
High Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/surfaces/browser.js View on unpkg · L398 6 Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/services/thread-review-sync.js -> dist/services/git-forge.js
L6: */
L7: import { exec as execCb } from "node:child_process";
L8: import { writeFile, unlink } from "node:fs/promises";
...
L13: return new Promise((resolve, reject) => {
L14: execCb(cmd, { encoding: "utf-8", windowsHide: true, ...opts }, (error, stdout, stderr) => {
L15: if (error) {
...
L27: function cleanGhEnv() {
L28: const { GH_REPO, GH_HOST, GH_TOKEN, GITHUB_TOKEN, ...rest } = process.env;
L29: return rest;
...
L101: proc.on("error", () => resolve(null));
L102: proc.stdin.write("protocol=https\nhost=github.com\n\n");
L103: proc.stdin.end();
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/services/git-forge.js View on unpkg · L6 • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/services/git-forge.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/git-forge.js View on unpkg web-dist/noVNC/app/images/icons/Makefile View file • path = web-[redacted]
kind = build_helper
sizeBytes = 1331
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
web-dist/noVNC/app/images/icons/Makefile View on unpkg • path = web-dist/noVNC/app/sounds/bell.oga
kind = high_entropy_blob
sizeBytes = 8495
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
web-dist/noVNC/app/sounds/bell.oga View on unpkg dist/channels/manager.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 17
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/channels/manager.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/routes/network.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/routes/network.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/cli/doctor.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/doctor.js View on unpkg dist/providers/acp-binary-launcher.js View file • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/providers/acp-binary-launcher.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/providers/acp-binary-launcher.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/services/primary-link.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/primary-link.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/clawhub/client.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/clawhub/client.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/os-control/windows-driver.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/os-control/windows-driver.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/security/sandbox-manager.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/security/sandbox-manager.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/services/git.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/git.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/services/preview-runner.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/preview-runner.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/skills/install.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/skills/install.js View on unpkg High Ships High Entropy Blob web-dist/noVNC/app/sounds/bell.oga
High Semantic Analysis Limited dist/channels/manager.js#virtual:normalized:round1
High Known Malware Source Similarity dist/routes/network.js
High Known Malware Source Similarity dist/cli/doctor.js
High Known Malware Source Similarity dist/providers/acp-binary-launcher.js
High Known Malware Source Similarity dist/services/primary-link.js
High Known Malware Source Similarity bin/jait.mjs
High Known Malware Source Similarity dist/clawhub/client.js
High Known Malware Source Similarity dist/os-control/windows-driver.js
High Known Malware Source Similarity dist/security/sandbox-manager.js
High Known Malware Source Similarity dist/services/git-forge.js
High Known Malware Source Similarity dist/services/git.js
High Known Malware Source Similarity dist/services/preview-runner.js
High Known Malware Source Similarity dist/skills/install.js
Medium Dynamic Require bin/install-runtime.mjs
Medium Ships Build Helper web-dist/noVNC/app/images/icons/Makefile
Medium Structural Risk Force Deep Review
Runtime surface package.json
Entrypoints main → dist/index.js types → dist/index.d.ts bin → jait
Runtime node >=22.5.0
Artifact 65.2 MB · 2,030 files 2 signature(s)
Install lifecycle postinstall
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings Minified PossibleObfuscation UrlStrings Manifest: clean
27 flagged • scripts.postinstall = node ./bin/install-runtime.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg Lines 121-144 javascript
122 Logical_Order_Exception LOE
125 Noncharacter_Code_Point NChar
126 Pattern_Syntax Pat_Syn
127 Pattern_White_Space Pat_WS
131 Sentence_Terminal STerm
133 Terminal_Punctuation Term
134 Unified_Ideograph UIdeo
139 XID_Start XIDS `.split(/ \s /).map(e=>[he(e),e])),Yt=new Map([["s",w(383)],[w(383),"s"]]),ei=new Map([[w(223),w(7838)],[w(107),w(8490)],[w(229),w(8491)],[w(969),w(8486)]]),ri=new Map([N(453),N(456),N(459),N(498),...be(8072,8079),...be(8088,8095),...be(8104,8111),N(8124),N(8140),N(8188)]),ti=new Map([["alnum",g` [\p{Alpha}\p{Nd}] `],["alpha",g` \p{Alpha} `],["ascii",g` \p{ ASCII } `],["blank",g` [\p{Zs}\t] `],["cntrl",g` \p{Cc} `],["digit",g` \p{Nd} `],["graph",g` [\ P {space} && \ P {Cc} && \ P {Cn} &&
142 \v\f
\u2028\u2029 ])` ),r)); else if (p === "posix" ) if ( ! o && (c === "graph" || c === "print" )){ if (i === "strict" ) throw new Error
143 //# sourceMappingURL=index-DhGtPmd9.js.map
High Child Process
Package source references child process execution.
web-dist/assets/index-DhGtPmd9.js View on unpkg · L141 Long lines were clipped for display.
Lines 10-50 javascript
10 * jait status Check if the gateway is running
11 * jait doctor Run local diagnostics
12 * jait update Update the gateway and restart it when managed
13 * jait reset Wipe all data
14 * jait -- port 9000 Use a custom port
Lines 39-79 javascript
39 description : "Click these elements before capturing (in order)." ,
43 items : { type : "string" ,
Lines 1-29 javascript
3 import { existsSync } from "node:fs" ;
4 import { dirname, resolve } from "node:path" ;
5 import { fileURLToPath } from "node:url" ;
110 log(`🐤 Starting canary on port ${canaryPort}...\n`);
L111: const canary = spawn("jait", ["--port", String(canaryPort)], {
L112: stdio: "ignore",
L113: detached: true,
L114: env: { ...process.env, PORT: String(canaryPort), __JAIT_CLI: "1" },
L115: windowsHide: true,
...
L117: canary.unref();
L118: const healthy = await waitForHealth(`http://127.0.0.1:${canaryPort}`, 30_000);
L119: if (!healthy) {
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools/redeploy-tools.js View on unpkg · L110 6 * **systemd** (detected when INVOCATION_ID is set):
L7: * 1. npm install -g @jait/gateway@latest
L8: * 2. Spawn canary on PORT+1, health-check it
...
L19: */
L20: import { execSync, spawn } from "node:child_process";
L21: import { describeUpdateFailure } from "../routes/update-failure.js";
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/tools/redeploy-tools.js View on unpkg · L6 Lines 1-25 javascript
1 import { parseJaitBackendInstances } from "@jait/shared" ;
2 import { BrowserSurface } from "../surfaces/browser.js" ;
3 import { SSRFGuard } from "../security/ssrf-guard.js" ;
4 import { SandboxManager } from "../security/sandbox-manager.js"
398 package = @jait/gateway; repositoryIdentity = jait; dependency = playwright
L398: // boot in environments that do not need browser automation.
L399: const loadPlaywright = new Function("return import('playwright')");
L400: let mod;
High Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/surfaces/browser.js View on unpkg · L398 6 Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/services/thread-review-sync.js -> dist/services/git-forge.js
L6: */
L7: import { exec as execCb } from "node:child_process";
L8: import { writeFile, unlink } from "node:fs/promises";
...
L13: return new Promise((resolve, reject) => {
L14: execCb(cmd, { encoding: "utf-8", windowsHide: true, ...opts }, (error, stdout, stderr) => {
L15: if (error) {
...
L27: function cleanGhEnv() {
L28: const { GH_REPO, GH_HOST, GH_TOKEN, GITHUB_TOKEN, ...rest } = process.env;
L29: return rest;
...
L101: proc.on("error", () => resolve(null));
L102: proc.stdin.write("protocol=https\nhost=github.com\n\n");
L103: proc.stdin.end();
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/services/git-forge.js View on unpkg · L6 • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/services/git-forge.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/git-forge.js View on unpkg web-dist/noVNC/app/images/icons/Makefile View file • path = web-[redacted]
kind = build_helper
sizeBytes = 1331
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
web-dist/noVNC/app/images/icons/Makefile View on unpkg • path = web-dist/noVNC/app/sounds/bell.oga
kind = high_entropy_blob
sizeBytes = 8495
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
web-dist/noVNC/app/sounds/bell.oga View on unpkg dist/channels/manager.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 17
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/channels/manager.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/routes/network.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/routes/network.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/cli/doctor.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli/doctor.js View on unpkg dist/providers/acp-binary-launcher.js View file • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/providers/acp-binary-launcher.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/providers/acp-binary-launcher.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/services/primary-link.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/primary-link.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/clawhub/client.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/clawhub/client.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/os-control/windows-driver.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/os-control/windows-driver.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/security/sandbox-manager.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/security/sandbox-manager.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/services/git.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/git.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/services/preview-runner.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/preview-runner.js View on unpkg • matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = dist/skills/install.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/skills/install.js View on unpkg \
P
{Cs}]
`],["lower",g`
\p{Lower}
`],["print",g`
[[\
P
{space}
&&
\
P
{Cc}
&&
\
P
{Cn}
&&
\
P
{Cs}]\p{Zs}]
`],["punct",g`
[\p{P}\p{S}]
`],["spac ...
(
`POSIX class "${
c
}" requires min target ES2024 or non-strict accuracy`
);
let
m
=
{graph:
"!-~"
,print:
" -~"
}[c];l
&&
(m
=
`
\0
-${
w
(
m
.
codePointAt
(
0
)
-
1
)
}${
w
(
m
.
codePointAt
(
2
)
+
1
)
}-`
),
t
(
y
(
S
(
`[${
m
}]`
),r))}
else
t
(
y
(
Pe
(
S
(ti.
get
(c)),l),r));
else
if
(p
===
"property"
)Me.
has
(
he
(c))
||
(e.key
=
"sc"
);
else
if
(p
===
"space"
)
t
(
G
(
re
(
"space"
,{negate:l}),r));
else
if
(p
===
"word"
)
t
(
y
(
Pe
(
S
(
V
),l),r));
else
throw
new
Error
(
`Unexpected character set kind "${
p
}"`
)},
Directive
({node:e,parent:r,root:t,remove:i,replaceWith:o,remov
...
15 * jait -- host 127.0 . 0.1 Bind to specific host
16 * jait -- help Show help
17 * jait -- version Show version
18 * jait daemon install Install systemd user service (Linux)
19 * jait daemon start Start the service
20 * jait daemon stop Stop the service
21 * jait daemon restart Restart the service
22 * jait daemon status Show service status
23 * jait daemon uninstall Remove the systemd service
24 * jait daemon logs Tail service logs
27 import { readFileSync, existsSync, writeFileSync, mkdirSync, unlinkSync, openSync, rmSync, readdirSync, statSync } from "node:fs" ;
28 import { resolve, dirname, join } from "node:path" ;
29 import { homedir, platform } from "node:os" ;
30 import { fileURLToPath } from "node:url" ;
31 import { execFileSync, execSync, spawn, spawnSync } from "node:child_process" ;
32 import { createConnection } from "node:net" ;
33 import { createInterface } from "node:readline" ;
35 const __dirname = dirname ( fileURLToPath ( import . meta .url));
36 const pkg = JSON . parse (
37 readFileSync ( resolve (__dirname, ".." , "package.json" ), "utf8" ),
38 );
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/jait.mjs View on unpkg · L30 40 // ── Constants ───────────────────────────────────────────────────────
42 const SERVICE_NAME = "jait-gateway" ;
43 const JAIT_DIR = join ( homedir (), ".jait" );
44 const ENV_PATH = join ( JAIT_DIR , ".env" );
45 const LOG_PATH = join ( JAIT_DIR , "gateway.log" );
46 const ERR_LOG_PATH = join ( JAIT_DIR , "gateway.err.log" );
47 const PID_PATH = join ( JAIT_DIR , "jait.pid" );
48 const LEGACY_PID_PATH = join ( JAIT_DIR , "gateway.pid" );
50 function systemdUnitDir () {
Lines 722-762 javascript
726 function resolveNodePath () {
728 return runSilent ( "which node" );
730 return "/usr/bin/node" ;
734 function resolveJaitBin () {
735 return resolve (__dirname, "jait.mjs" );
738 function buildUnit ({ port , host , envPath } = {}) {
739 const nodePath = resolveNodePath ();
740 const jaitBin = resolveJaitBin ();
741 const envFlag = envPath && existsSync (envPath) ? envPath : ENV_PATH ;
743 const execArgs = [nodePath, jaitBin];
744 if ( existsSync (envFlag)) execArgs. push ( "--env" , envFlag);
745 if (port) execArgs. push ( "--port" , String (port));
746 if (host) execArgs. push ( "--host" , host);
748 const execStart = execArgs. join ( " " );
750 // Build a PATH that includes common global-bin locations so that
751 // redeploy can find npm/node/jait, and codex can be discovered.
752 const home = homedir ();
754 join (home, ".local" , "bin" ),
755 join (home, ".npm-global" , "bin" ),
762 Description=Jait AI Gateway
• matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.848
matchedPath = bin/jait.mjs
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/jait.mjs View on unpkg description
:
"'selector:text' pair"
},
44 description : "Fill inputs before capturing. Each item is 'cssSelector:text'." ,
49 async execute (input, context) {
50 if (context.signal?.aborted)
51 return { ok: false , message: "Cancelled" };
52 const outPath = resolveOutPath (input.path);
53 const url = resolveTarget (input.target, context.projectRoot);
54 const width = input.mobile ? 393 : Number (input.width ?? 1280 );
55 const height = input.mobile ? 851 : Number (input.height ?? 800 );
56 const deviceScaleFactor = input.mobile ? 3 : 2 ;
57 const fullPage = input.fullPage !== false && ! input.selector;
60 const loadPlaywright = new Function ( "return import('playwright')" );
61 const mod = ( await loadPlaywright ());
High Eval
Package source references dynamic code evaluation.
dist/tools/screenshot-tools.js View on unpkg · L59 62 chromium = mod.chromium;
64 throw new Error ( "chromium not found in playwright module" );
69 message: `Playwright unavailable: ${ err instanceof Error ? err . message : String ( err ) }` ,
72 // Ensure output directory exists
73 const fs = await import ( "node:fs" );
74 const pathMod = await import ( "node:path" );
75 fs. mkdirSync (pathMod. dirname (outPath), { recursive: true });
78 browser = ( await chromium. launch ());
79 const ctx = await browser. newContext ({
binDir
=
dirname
(
fileURLToPath
(
import
.
meta
.url));
8 const runtimeModule = resolve (binDir, "../dist/services/code-graph/graphify-runtime.js" );
9 const sourceTree = resolve (binDir, "../src" );
11 if ( ! existsSync (runtimeModule)) {
12 if ( existsSync (sourceTree)) {
13 console. log ( "[jait] Graphify provisioning deferred until the gateway is built." );
16 console. error ( "[jait] Packaged Graphify runtime manager is missing." );
21 const { ensureGraphifyRuntime } = await import (runtimeModule);
22 await ensureGraphifyRuntime ({
Medium Dynamic Require
Package source references dynamic require/import behavior.
bin/install-runtime.mjs View on unpkg · L20 23 onProgress : ( message ) => console. log ( `[jait] ${ message }` ),
26 console. error ( `[jait] ${ error instanceof Error ? error . message : String ( error ) }` );
;
5 const DEFAULT_BROWSER_ID = "browser-default" ;
6 const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1" ;
7 const DEFAULT_OPENAI_WEB_SEARCH_MODEL = "gpt-5" ;
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/tools/browser-tools.js View on unpkg · L5 8 const DEFAULT_PERPLEXITY_MODEL = "sonar-pro" ;
9 const DEFAULT_PERPLEXITY_OPENROUTER_MODEL = "perplexity/sonar-pro" ;
10 const DEFAULT_GROK_MODEL = "grok-4-1212" ;
11 const DEFAULT_GEMINI_MODEL = "gemini-2.0-flash" ;
12 const DEFAULT_KIMI_BASE_URL = "https://api.moonshot.ai/v1" ;
13 const DEFAULT_KIMI_MODEL = "moonshot-v1-128k" ;
14 function resolveActivePreviewSession ( collaboration , context ) {
15 const sessionId = context.sessionId?. trim ();
16 if ( ! sessionId || ! collaboration)
18 const getter = collaboration.getSessionByPreviewSessionId;
19 if ( typeof getter !== "function" )
21 return getter. call (collaboration, sessionId);
23 function assertPreviewBrowserSelection ( previewSession , browserId ) {
5 Trigger-reachable chain: scripts.start -> dist/index.js -> dist/tools/index.js -> dist/tools/browser-tools.js
L5: const DEFAULT_BROWSER_ID = "browser-default";
L6: const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
L7: const DEFAULT_OPENAI_WEB_SEARCH_MODEL = "gpt-5";
...
L132: message: `Navigated to ${snapshot.url}`,
L133: data: buildSnapshotPayload(surface.id, snapshot, session),
L134: };
...
L363: const timeout = setTimeout(() => controller.abort(), timeoutMs);
L364: const ignoreTlsErrors = input.ignoreTlsErrors === true || process.env["WEB_FETCH_IGNORE_TLS_ERRORS"] === "true";
L365: try {
...
L371: }, ignoreTlsErrors);
L372: const text = await response.text();
L373: return {
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/tools/browser-tools.js View on unpkg · L5