@myassis/gateway@1.0.48

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

User starts the gateway, invokes service management, update, or authenticated agent/tool workflows.

Dual-use local command/service control if a trusted user/model invokes those features; no evidence of unsolicited malware behavior.

Authenticated local AI gateway with service management and tool execution capabilities.

Static inspection shows a local AI gateway with authenticated API routes, updater/service-management code, and model-invoked tools, but no lifecycle execution, credential harvesting, covert exfiltration, or unconsented persistence. The scanner’s secret and persistence findings map to default configuration and documented service/update functionality, so the package should not be blocked as malicious.