registry / @miraj181/ipingyou / 2.1.9

@miraj181/ipingyou@2.1.9

⚠ Under review

SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 247 KB of source, external domains: 127.0.0.1, api.groq.com, api.ipify.org, developers.cloudflare.com, github.com, ipingyou.onrender.com, pkg.cloudflare.com, www.openssh.com

Source & flagged code

4 flagged

src/modes/ai.jsView file

Lines 279-319javascript

279

280 let uid;

281 let password;

282 let username;

283

284 if (targetMode === 'alias') {

285 const { aliasName } = await inquirer.prompt([{

286 type: 'input',

287 name: 'aliasName',

288 message: 'Alias name:',

289 validate: v => v.trim().length > 0 || 'Required',

290 }]);

291 const alias = getAlias(aliasName.trim());

292 if (!alias) throw new Error(`Alias not found: ${aliasName.trim()}`);

293 uid = alias.uid;

294 password = alias.password;

295 username = alias.username;

296 } else {

297 const answers = await inquirer.prompt([

298 { type: 'input', name: 'uid', message: 'Remote host UID:', validate: v => v.trim().length > 0 || 'Required' },

299 { type: 'password', name: 'password', message: 'Session password:', mask: '*' },

Medium

Secret Pattern

Package contains a possible secret pattern.

src/modes/ai.jsView on unpkg · L299

300 { type: 'input', name: 'username', message: 'SSH username:', default: process.env.USER || process.env.USERNAME || 'root' },

301 ]);

302 uid = answers.uid.trim();

303 password = answers.password;

304 username = answers.username.trim();

305 }

306

307 const payload = await resolveUID(BROKER_URL, uid, password);

308 if (!payload || payload.type !== 'ssh') {

309 throw new Error('AI remote mode requires an active SSH host session');

310 }

311

312 let privateKeyPath = null;

313 if (payload.privateKey) {

314 privateKeyPath = await writeEphemeralPrivateKey(payload.privateKey);

315 }

316

317 return {

318 scope: 'remote',

319 username,

Lines 599-634javascript

599 const result = await execa('scp', scpArgs, { stdio: 'inherit', reject: false });

600 if (result.exitCode === 0) {

601 console.log(chalk.green(' ✅ Transfer completed via active remote session.'));

602 recordEvent('ai_transfer_success', { direction, localPath, remotePath, hostname: context.hostname, reusedContext: true

src/modes/host.jsView file

Lines 1-35javascript

1/**

2 * ============================================================

3 * Host Mode — "Allow Remote Access"

4 * ============================================================

5 * 1. Generate a session UID

6 * 2. Ensure local SSH service is running

7 * 3. Spawn cloudflared tunnel → localhost:22

8 * 4. ENCRYPT tunnel URL locally, send ciphertext to Broker

9 * 5. Monitor connections & provide termination controls

10 *

11 * Security: The broker NEVER sees the plaintext tunnel URL.

Source & flagged code

4 flagged · loading source

src/modes/ai.jsView file

299patternName = generic_password severity = medium line = 299 matchedText = { type: ...' },

Medium

Secret Pattern

Package contains a possible secret pattern.

src/modes/ai.jsView on unpkg · L299

619patternName = generic_password severity = medium line = 619 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in src/modes/ai.js

src/modes/ai.jsView on unpkg · L619

src/modes/host.jsView file

15L16: import { execa } from 'execa'; L17: import chalk from 'chalk'; ... L34: L35: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L36: let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com'; L37: ... L72: try { L73: const { stdout } = await execa('sudo', ['systemsetup', '-getremotelogin'], { reject: false }); L74: if (stdout.toLowerCase().includes('off')) { ... L200: if (!homedir) { L201: throw new Error('Could not resolve the current user home directory for authorized_keys');

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/modes/host.jsView on unpkg · L15

15Trigger-reachable chain: manifest.main -> src/cli.js -> src/modes/host.js L15: L16: import { execa } from 'execa'; L17: import chalk from 'chalk'; ... L34: L35: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L36: let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com'; L37: ... L72: try { L73: const { stdout } = await execa('sudo', ['systemsetup', '-getremotelogin'], { reject: false }); L74: if (stdout.toLowerCase().includes('off')) { ... L200: if (!homedir) { L201: throw new Error('Could not resolve the current user home directory for authorized_keys');

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/modes/host.jsView on unpkg · L15

Findings

2 Critical5 Medium5 Low

CriticalPersistence Backdoorsrc/modes/host.js

CriticalTrigger Reachable Dangerous Capabilitysrc/modes/host.js

MediumSecret Patternsrc/modes/ai.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/modes/ai.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/modes/ai.jsView file

Lines 279-319javascript

279

280 let uid;

281 let password;

282 let username;

283

284 if (targetMode === 'alias') {

285 const { aliasName } = await inquirer.prompt([{

286 type: 'input',

287 name: 'aliasName',

288 message: 'Alias name:',

289 validate: v => v.trim().length > 0 || 'Required',

290 }]);

291 const alias = getAlias(aliasName.trim());

292 if (!alias) throw new Error(`Alias not found: ${aliasName.trim()}`);

293 uid = alias.uid;

294 password = alias.password;

295 username = alias.username;

296 } else {

297 const answers = await inquirer.prompt([

298 { type: 'input', name: 'uid', message: 'Remote host UID:', validate: v => v.trim().length > 0 || 'Required' },

299 { type: 'password', name: 'password', message: 'Session password:', mask: '*' },

Medium

Secret Pattern

Package contains a possible secret pattern.

src/modes/ai.jsView on unpkg · L299

300 { type: 'input', name: 'username', message: 'SSH username:', default: process.env.USER || process.env.USERNAME || 'root' },

301 ]);

302 uid = answers.uid.trim();

303 password = answers.password;

304 username = answers.username.trim();

305 }

306

307 const payload = await resolveUID(BROKER_URL, uid, password);

308 if (!payload || payload.type !== 'ssh') {

309 throw new Error('AI remote mode requires an active SSH host session');

310 }

311

312 let privateKeyPath = null;

313 if (payload.privateKey) {

314 privateKeyPath = await writeEphemeralPrivateKey(payload.privateKey);

315 }

316

317 return {

318 scope: 'remote',

319 username,

Lines 599-634javascript

599 const result = await execa('scp', scpArgs, { stdio: 'inherit', reject: false });

600 if (result.exitCode === 0) {

601 console.log(chalk.green(' ✅ Transfer completed via active remote session.'));

602 recordEvent('ai_transfer_success', { direction, localPath, remotePath, hostname: context.hostname, reusedContext: true

src/modes/host.jsView file

Lines 1-35javascript

1/**

2 * ============================================================

3 * Host Mode — "Allow Remote Access"

4 * ============================================================

5 * 1. Generate a session UID

6 * 2. Ensure local SSH service is running

7 * 3. Spawn cloudflared tunnel → localhost:22

8 * 4. ENCRYPT tunnel URL locally, send ciphertext to Broker

9 * 5. Monitor connections & provide termination controls

10 *

11 * Security: The broker NEVER sees the plaintext tunnel URL.