registry  /  @onyxsecurity/mcp-gateway  /  1.0.117

@onyxsecurity/mcp-gateway@1.0.117

A TypeScript SSE proxy for MCP servers that use stdio transport.

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 18 file(s), 787 KB of source, external domains: example.com, github.com

Source & flagged code

5 flagged · loading source
dist/secretstore-Bb3anONL.jsView file
1import{join as e}from"node:path";import{env as t,platform as n}from"node:process";import{clearTimeout as r,setTimeout as i}from"node:timers";import{execFile as a}from"node:child_pr... L2: //# sourceMappingURL=secretstore-Bb3anONL.js.map
High
Child Process

Package source references child process execution.

dist/secretstore-Bb3anONL.jsView on unpkg · L1
dist/helpers-BPQVbZuN.jsView file
1import{__commonJSMin as e,__toESM as t}from"./chunk-CrDKVgUD.js";import{createRequire as n}from"node:module";import{readFileSync as r,readdirSync as i}from"node:fs";import{format a... L2: `).map(e=>e.split(` `)),n=0;return t.forEach(e=>{e.length>1&&C.stringWidth(e[0])>n&&(n=Math.min(Math.floor(this.width*.5),C.stringWidth(e[0])))}),t.forEach(e=>{this.div(...e.map((t...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/helpers-BPQVbZuN.jsView on unpkg · L1
1import{__commonJSMin as e,__toESM as t}from"./chunk-CrDKVgUD.js";import{createRequire as n}from"node:module";import{readFileSync as r,readdirSync as i}from"node:fs";import{format a... L2: `).map(e=>e.split(` `)),n=0;return t.forEach(e=>{e.length>1&&C.stringWidth(e[0])>n&&(n=Math.min(Math.floor(this.width*.5),C.stringWidth(e[0])))}),t.forEach(e=>{this.div(...e.map((t... ... L4: `):e.text.split(` L5: `),e.border&&(r.unshift(`.`+`-`.repeat(this.negatePadding(e)+2)+`.`),r.push(`'`+`-`.repeat(this.negatePadding(e)+2)+`'`)),e.padding&&(r.unshift(...Array(e.padding[0]||0).fill(``)),... L6: `),l=[...c],u=0;for(let[e,t]of l.entries()){if(r+=t,Me.has(t)){let{groups:e}=RegExp(`(?:\\[(?<code>\\d+)m|\\${Ne}(?<uri>.*))`).exec(c.slice(u))||{groups:{}};if(e.code!==void 0){le... ... L29: */ L30: var D;(function(e){e.BOOLEAN=`boolean`,e.STRING=`string`,e.NUMBER=`number`,e.ARRAY=`array`})(D||={});let O;var qe=class{constructor(e){O=e}parse(e,t){let n=Object.assign({alias:voi... L31: `);b.div(`${e}\n`)}return b.toString().replace(/\s*$/,``)};function _(e,n,r){let i=0;return Array.isArray(e)||(e=Object.values(e).map(e=>[e])),e.forEach(e=>{i=Math.max(t.stringWidt... ... L35: # L36: # Installation:
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/helpers-BPQVbZuN.jsView on unpkg · L1
dist/main-Z7TJtcJI.jsView file
1import{AccessControlBlockError as e,Client as t,ConfigurationError as n,ProxyConnectionError as r,ReadBuffer as i,Server as a,StdioServerTransport as o,compressClientInfo as s,getS... L2: `);this.buffer=r.pop()||``;let i=[];for(let e of r)e.trim().startsWith(`{`)?i.push(e):e.trim().length>0&&this.logDroppedLine(e);if(i.length>0){let e=`${i.join(` L3: `)}\n`;n(null,Buffer.from(e))}else n(null,null)}logDroppedLine(e){if(!(this.droppedLinesLogged>50)){if(this.droppedLinesLogged===50){this.droppedLinesLogged+=1,b.info(`Suppressing ... L4: `);return Ge({exitCode:1,logMessage:`MCP server blocked by access control policy`,meta:{error:t.message,eventType:`mcp_access_control_block`,reason:t.reason},reason:e,respondToClie...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main-Z7TJtcJI.jsView on unpkg · L1
1import{AccessControlBlockError as e,Client as t,ConfigurationError as n,ProxyConnectionError as r,ReadBuffer as i,Server as a,StdioServerTransport as o,compressClientInfo as s,getS... L2: `);this.buffer=r.pop()||``;let i=[];for(let e of r)e.trim().startsWith(`{`)?i.push(e):e.trim().length>0&&this.logDroppedLine(e);if(i.length>0){let e=`${i.join(`
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main-Z7TJtcJI.jsView on unpkg · L1

Findings

3 High5 Medium7 Low
HighChild Processdist/secretstore-Bb3anONL.js
HighSame File Env Network Executiondist/main-Z7TJtcJI.js
HighCommand Output Exfiltrationdist/main-Z7TJtcJI.js
MediumDynamic Requiredist/helpers-BPQVbZuN.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/helpers-BPQVbZuN.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License