@jait/gateway@0.1.939

⚠ Under review

Jait AI gateway — local-first AI coding agent with terminal, filesystem, and browser control

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The inspected lifecycle and agent setup paths show runtime provisioning and temporary per-session configuration, without a confirmed attack. The packaged bell asset could not be identified by offline analysis, so its behavior remains unresolved and requires manual review.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A noVNC bell event plays an audio element when the bell setting is enabled.

Impact

Unknown; the inspected source does not establish harmful behavior or link the asset to executable code.

Mechanism

The UI invokes audio playback, while the packaged bell.oga bytes could not be structurally identified.

AI rationale

Evidence

web-dist/noVNC/app/sounds/bell.oga.lpm-inspection-J8Jn9a/0-7bb1ae73f3db.txtpackage.jsonbin/install-runtime.mjsdist/services/code-graph/graphify-runtime.jsdist/providers/pi-mcp-provision.jsweb-dist/noVNC/app/ui.js

Decision evidence

public snapshot

AI called this Manual Review at 79.0% confidence as Unknown with medium false-positive risk.

AI review observations

The postinstall hook runs a runtime provisioner that calls ensureGraphifyRuntime.
The provisioner creates a Python virtual environment and installs a pinned Graphify package.
The noVNC UI plays an audio element on bell events, but offline analysis could not identify the packaged bell.oga format or behavior.
Pi MCP provisioning is limited to pi-based providers with configured MCP servers and writes a temporary per-session config.

Evidence against

The inspected install behavior provisions a version-pinned product runtime; no credential transfer or unrelated account action was established.
The pi helper uses a temporary session directory rather than changing global or project agent configuration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

28 flagged

package.jsonView file

Lines 7-47json

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "bin": {

10 "jait": "./bin/jait.mjs",

11 "jait-matrix": "./bin/matrix-stack.mjs"

12 },

13 "files": [

14 "dist",

15 "bin",

16 "web-dist",

17 "skills"

18 ],

19 "scripts": {

20 "prebuild": "bun run --filter @jait/web build && bun run bundle-web",

21 "bundle-web": "node scripts/bundle-web.mjs",

22 "build": "node scripts/embed-shell-integration.mjs && tsc && node scripts/copy-shell-integration.mjs",

23 "copy-assets": "node scripts/copy-shell-integration.mjs",

24 "embed-shell-integration": "node scripts/embed-shell-integration.mjs",

25 "dev": "bun run --filter @jait/web build && bun --watch src/index.ts",

26 "start": "node ./bin/jait.mjs",

27 "postinstall": "node ./bin/install-runtime.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

28 "typecheck": "tsc --noEmit"

29 },

30 "keywords": [

31 "ai",

32 "agent",

33 "coding",

34 "gateway",

35 "terminal",

36 "local-first"

37 ],

38 "license": "MIT",

39 "repository": {

40 "type": "git",

41 "url": "https://github.com/Widev-e-U/Jait.git",

42 "directory": "packages/gateway"

43 },

44 "homepage": "https://jait.dev",

45 "engines": {

46 "node": ">=22.5.0"

47 },

bin/safe-update.mjsView file

Lines 1-21javascript

1/** Staged updates shared by the CLI and HTTP gateway. Never install over live files. */

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

bin/safe-update.mjsView on unpkg · L1

4import { mkdir, mkdtemp, readFile, writeFile, rename, rm, cp, access } from

bin/jait.mjsView file

Lines 10-50javascript

10 * jait status Check if the gateway is running

11 * jait doctor Run local diagnostics

12 * jait update Update the gateway and restart it when managed

13 * jait reset Wipe all data

14 * jait --port 9000 Use a custom port

bin/install-runtime.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

3import { existsSync } from "node:fs";

4import { dirname, resolve } from "node:path";

5import { fileURLToPath } from "node:url";

7const

dist/tools/redeploy-tools.jsView file

Lines 90-130javascript

90 const explanation = failure.hint ?? failure.detail;

91 log(`✗ npm install failed [${failure.code}]: ${failure.detail}\n`);

dist/tools/browser-tools.jsView file

Lines 1-29javascript

1import { randomUUID } from "node:crypto";

2import { mkdir, readFile, writeFile } from "node:fs/promises";

3import { join, resolve, win32 } from "node:path";

4import { parseJaitBackendInstances } from "@jait/shared"

dist/surfaces/browser.jsView file

Lines 410-450javascript

410 }

411}

412function rewriteContainerBrowserUrlToPublic(url, liveViewSession) {

413 if (!url || liveViewSession?.kind !== "container")

414

dist/services/git-forge.jsView file

6Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/services/thread-review-sync.js -> dist/services/git-forge.js L6: */ L7: import { exec as execCb } from "node:child_process"; L8: import { writeFile, unlink } from "node:fs/promises"; ... L13: return new Promise((resolve, reject) => { L14: execCb(cmd, { encoding: "utf-8", windowsHide: true, ...opts }, (error, stdout, stderr) => { L15: if (error) { ... L27: function cleanGhEnv() { L28: const { GH_REPO, GH_HOST, GH_TOKEN, GITHUB_TOKEN, ...rest } = process.env; L29: return rest; ... L101: proc.on("error", () => resolve(null)); L102: proc.stdin.write("protocol=https\nhost=github.com\n\n"); L103: proc.stdin.end();

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/services/git-forge.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/services/git-forge.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/git-forge.jsView on unpkg

web-dist/assets/matrix_sdk_crypto_wasm_bg-DQQaknxI.wasmView file

•path = web-dist/assets/matrix_sdk_crypto_wasm_bg-DQQaknxI.wasm kind = wasm_module sizeBytes = 7805486 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

web-dist/assets/matrix_sdk_crypto_wasm_bg-DQQaknxI.wasmView on unpkg

web-dist/noVNC/app/images/icons/MakefileView file

•path = web-[redacted] kind = build_helper sizeBytes = 1331 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web-dist/noVNC/app/images/icons/MakefileView on unpkg

web-dist/noVNC/app/sounds/bell.ogaView file

•path = web-dist/noVNC/app/sounds/bell.oga kind = high_entropy_blob sizeBytes = 8495 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-dist/noVNC/app/sounds/bell.ogaView on unpkg

web-dist/assets/index-7EjsdQpP.jsView file

•path = web-dist/assets/index-7EjsdQpP.js kind = oversized_source_file sizeBytes = 4358840 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/index-7EjsdQpP.jsView on unpkg

dist/os-control/windows-driver.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/os-control/windows-driver.js#virtual:normalized:round1View on unpkg

dist/cli/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/cli/doctor.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/doctor.jsView on unpkg

dist/providers/acp-binary-launcher.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/providers/acp-binary-launcher.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/providers/acp-binary-launcher.jsView on unpkg

dist/clawhub/client.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/clawhub/client.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clawhub/client.jsView on unpkg

dist/os-control/windows-driver.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/os-control/windows-driver.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/os-control/windows-driver.jsView on unpkg

dist/skills/install.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/skills/install.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skills/install.jsView on unpkg

dist/services/code-graph/graphify-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/services/code-graph/graphify-runtime.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/code-graph/graphify-runtime.jsView on unpkg

dist/services/github-pull-requests.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/services/github-pull-requests.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github-pull-requests.jsView on unpkg

dist/services/maintenance.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/services/maintenance.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/maintenance.jsView on unpkg

dist/channels/msteams/connector.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/channels/msteams/connector.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/channels/msteams/connector.jsView on unpkg

dist/channels/telegram/connector.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = [redacted].js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/channels/telegram/connector.jsView on unpkg

dist/db/connection.jsView file

•matchType = token_shingles matchedPackage = @jait/gateway@0.1.848 matchedPath = dist/db/connection.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/db/connection.jsView on unpkg

Source & flagged code

28 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install-runtime.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/safe-update.mjsView file

1/** Staged updates shared by the CLI and HTTP gateway. Never install over live files. */ L2: import { execFile } from "node:child_process"; L3: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

bin/safe-update.mjsView on unpkg · L1

bin/jait.mjsView file

737L738: const execArgs = [nodePath, jaitBin]; L739: if (existsSync(envFlag)) execArgs.push("--env", envFlag);

High

Findings

2 Critical22 High7 Medium5 Low

CriticalCredential Exfiltrationdist/tools/browser-tools.js

CriticalTrigger Reachable Dangerous Capabilitydist/tools/browser-tools.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/safe-update.mjs

HighShellbin/jait.mjs

HighEntrypoint Build Divergencebin/jait.mjs

HighSame File Env Network Executiondist/tools/redeploy-tools.js

HighCopied Package Dependency Bridgedist/surfaces/browser.js

HighTrigger Reachable Credential Exfiltrationdist/services/git-forge.js

HighRuntime Package Installdist/tools/redeploy-tools.js

HighShips High Entropy Blobweb-dist/noVNC/app/sounds/bell.oga

Affected versions and remediation

This report applies to @jait/gateway@0.1.939.

See all versions of @jait/gateway for other recorded verdicts.

Review the evidence and your use of @jait/gateway@0.1.939 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 22:20:56.770Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.