@myassis/gateway@1.0.52

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Running the gateway server or invoking CLI/API service-management and AI tool workflows

Potential local privilege-impacting service changes or arbitrary local file/command actions if exposed or misused, but no covert exfiltration or attacker-controlled payload execution was confirmed.

local gateway service management plus AI tool execution

Static inspection did not show an npm lifecycle payload, credential harvesting, covert exfiltration, or reviewer/prompt manipulation. The concerning code is product-visible gateway functionality: service install/update/start/stop code, an AI exec tool, and broad file operations. The unauthenticated service routes are a real security risk if the local server is reachable, but the source does not establish malicious intent or a covert package attack.

Marking suspicious because the package exposes dangerous local service-management and AI command/file capabilities, including unauthenticated service routes, but inspection found no concrete malicious npm-package attack behavior. Scanner secret and persistence labels are noisy or package-aligned: dist/.env has config values and persistence occurs through explicit service flows.