registry / @solongate/proxy / 0.61.0

@solongate/proxy@0.61.0

AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicitly installed global AI-agent hook can intercept Claude Code tool calls, obtain cloud policy, report audit events, and self-update its package-owned hook files. No unconsented npm lifecycle trigger was found.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the documented global initialization command and later uses the configured AI agent.

Impact

A configured SolonGate account can centrally control policy behavior and update hooks that run across local Claude Code sessions.

Mechanism

Cloud-managed global hook enforcement, audit upload, and remote hook self-update.

Rationale

This package deliberately implements a cloud-managed, global AI-agent control surface with remote self-updating hooks. The installation is user-invoked rather than an unconsented lifecycle action, so it warrants a warning rather than a block.

Evidence

package.jsonhooks/guard.mjshooks/audit.mjshooks/shield.mjsdist/index.jsdist/shield.js~/.claude/settings.json~/.solongate/cloud-guard.json~/.solongate/hooks/guard.mjs~/.solongate/hooks/audit.mjs~/.solongate/hooks/shield.mjs

Network endpoints3

api.solongate.com/api/v1/hooks/api.solongate.com/api/v1/policies/activeapi.solongate.com/api/v1/audit-logs

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`hooks/guard.mjs` documents global Claude hook enforcement via `init --global`.
`hooks/guard.mjs` fetches and atomically replaces `guard.mjs`, `audit.mjs`, and `shield.mjs` from SolonGate Cloud.
Installed guard runs on AI tool calls and reads project `.env` plus `~/.solongate/cloud-guard.json`.
`hooks/audit.mjs` sends tool names and argument summaries to the cloud audit API when configured.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle scripts.
Global hook setup is documented as an explicit `npx @solongate/proxy init --global` action.
Hook download requires a configured SolonGate API key and checks expected markers before replacing files.
`hooks/guard.mjs` explicitly rejects cloud metadata and private webhook destinations.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 1.44 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.solongate.com, cdn.solongate.com, dashboard.solongate.com, solongate.com

Source & flagged code

11 flagged

dist/shield.jsView file

Lines 1-23javascript

1// src/shield.ts

2import { createServer, request as httpRequest } from "http";

3import { request as httpsRequest } from "https";

4import { spawn } from "child_process";

5import { URL } from "url";

High

Child Process

Package source references child process execution.

dist/shield.jsView on unpkg · L3

6import { readFileSync, existsSync, readdirSync, statSync } from "fs";

7import { resolve } from "path";

8import { homedir } from "os";

9var log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}

10`);

11var DLP_PATTERNS = [

12 { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },

13 { name: "private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },

14 { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },

15 { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },

16 { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },

17 { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },

18 { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },

19 { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },

20 { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },

21 { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },

22 { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },

23 { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },

Lines 249-289javascript

249 }

250 });

251 });

252 return new Promise((resolveP) => {

253 server.listen(0, "127.0.0.1", () => {

254 const addr = server.address();

255 const

dist/lib.jsView file

Lines 22-62javascript

22 }

23 return to;

24};

25var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

dist/audit/index.jsView file

Lines 1375-1415javascript

1375 title,

1376 status: "PARTIAL",

1377 evidence,

1378 summary: `${totalIssues} risky package install(s) \u2014 low frequency.`,

1379 details: "Some packages installed without pinned versions, but at low frequency. Review and pin specific versions.",

1380 recommendation: "Pin all package versions. Add deny-undeclared-default rule. Add tool allowlist."

dist/index.jsView file

Lines 21-61javascript

21 if (!__hasOwnProp.call(to, key) && key !== except)

22 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

23 }

24 return to;

25};

hooks/guard.mjsView file

13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call. L14: * - API_URL defaults to https://api.solongate.com. L15: * - Enforcement is gated on the API key (the key identifies the project + ... L19: * L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW. L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs. ... L24: import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from 'node:fs'; L25: import { spawn } from 'node:child_process'; L26: import { resolve, join, dirname, isAbsolute } from 'node:path'; L27: import { homedir } from 'node:os'; L28: import { gunzipSync } from 'node:zlib'; L29: import { createHash } from 'node:crypto';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

hooks/guard.mjsView on unpkg · L13

Source & flagged code

11 flagged · loading source

dist/shield.jsView file

3import { request as httpsRequest } from "https"; L4: import { spawn } from "child_process"; L5: import { URL } from "url";

High

Child Process

Package source references child process execution.

dist/shield.jsView on unpkg · L3

269log(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`); L270: const child = spawn(cmd[0], cmd.slice(1), { L271: stdio: "inherit", L272: env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` }, L273: shell: process.platform === "win32"

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/shield.jsView on unpkg · L269

dist/lib.jsView file

6541/\bbash\s+-c\b/i, L6542: // Subshell wrapper: bash -c L6543: /\bsh\s+-c\b/i,

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L6541

42try { L43: JSON.parse(str); L44: return true; ... L2982: // Keys in mapping nodes earlier in the sequence override keys specified in L2983: // later mapping nodes. -- http://yaml.org/type/merge.html L2984: addToJSMap(ctx, map) { ... L4515: function shouldWarn(deprecation) { L4516: const env = typeof process !== "undefined" && process.env || {}; L4517: if (deprecation) { ... L5075: handle: "!!", L5076: prefix: "tag:private.yaml.org,2002:" L5077: }]

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/lib.jsView on unpkg · L42

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib.jsView on unpkg · L42

dist/audit/index.jsView file

1395var DANGEROUS_PATTERNS = [ L1396: { pattern: /eval\s*\(/, label: "eval() \u2014 arbitrary code execution" }, L1397: { pattern: /\bexec\s*\(/, label: "exec() \u2014 arbitrary code execution" },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/audit/index.jsView on unpkg · L1395

dist/index.jsView file

8695__dirname = dirname(fileURLToPath(import.meta.url)); L8696: HOOKS_DIR = resolve4(__dirname, "..", "hooks"); L8697: SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>"; ... L8703: var login_exports = {}; L8704: import { spawn } from "child_process"; L8705: function startSpinner(text) { L8706: if (!process.stderr.isTTY) { L8707: process.stderr.write(` ${text} L8708: `);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L8695

41try { L42: const p = join(homedir(), ".solongate", "cloud-guard.json"); L43: if (!existsSync(p)) return {}; L44: const c2 = JSON.parse(readFileSync(p, "utf-8")); L45: return c2 && typeof c2 === "object" ? c2 : {}; ... L52: if (!resolvedId) { L53: const listRes = await fetch(`${apiUrl}/api/v1/policies`, { L54: headers: { "Authorization": `Bearer ${apiKey}` }, ... L120: const resBody = await res.text().catch(() => ""); L121: process.stderr.write(`[SolonGate] Audit log rejected (${res.status}): ${resBody} L122: `); ... L262: if (!apiKey) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L41

41Cross-file remote execution chain: dist/index.js spawns dist/audit/index.js; helper contains network access plus dynamic code execution. L41: try { L42: const p = join(homedir(), ".solongate", "cloud-guard.json"); L43: if (!existsSync(p)) return {}; L44: const c2 = JSON.parse(readFileSync(p, "utf-8")); L45: return c2 && typeof c2 === "object" ? c2 : {}; ... L52: if (!resolvedId) { L53: const listRes = await fetch(`${apiUrl}/api/v1/policies`, { L54: headers: { "Authorization": `Bearer ${apiKey}` }, ... L120: const resBody = await res.text().catch(() => ""); L121: process.stderr.write(`[SolonGate] Audit log rejected (${res.status}): ${resBody} L122: `); ... L262: if (!apiKey) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L41

9469const pm = detectPackageManager(); L9470: const cmd = pm === "yarn" ? "yarn add @solongate/proxy" : `${pm} install @solongate/proxy`; L9471: log3(` Installing @solongate/proxy via ${pm}...`); L9472: try { L9473: execSync(cmd, { stdio: "pipe", cwd: process.cwd() }); L9474: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L9469

hooks/guard.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

hooks/guard.mjsView on unpkg · L13

Findings

9 High4 Medium5 Low

HighChild Processdist/shield.js

HighShelldist/lib.js

HighSame File Env Network Executiondist/shield.js

HighCredential Exfiltrationdist/lib.js

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCloud Metadata Accesshooks/guard.mjs

HighCross File Remote Execution Contextdist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/lib.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/audit/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

91%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorSolonGate

Maintainerscodeyevsky

Version0.66.1

PublishedJul 12, 2026

LicenseMIT

Dependencies6

Integrityverified

Package size370 KB

Files126

Keywordsai-tool-securityai-tool-proxysecurityproxygatewayfirewallai-securitytool-security

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/lib.jstypes → ./dist/lib.d.tsexports mapbin → proxy, solongate, solongate-audit +1

Runtimenode >=18.0.0

Artifact1.55 MB · 126 files1 signature(s)

Install lifecycleNo install hooks · other: build, build:hooks, build:types, clean +2

Behavioral surface

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean