@solongate/proxy@0.81.69: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@solongate/proxy@0.81.69: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

dist/tui/index.jsView file

2450patternName = aws_access_key severity = critical line = 2450 matchedText = var SAMP...i"];

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/tui/index.jsView on unpkg · L2450

2450patternName = aws_access_key severity = critical line = 2450 matchedText = var SAMP...i"];

Critical

Secret Pattern

AWS access key ID in dist/tui/index.js

dist/tui/index.jsView on unpkg · L2450

740const ps = `Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::In... L741: const p = spawn2("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true }); L742: p.on("error", () => {

High

Shell

Package source references shell execution.

dist/tui/index.jsView on unpkg · L740

58try { L59: const raw = readFileSync(join(homedir(), ".solongate", "tui-config.json"), "utf-8"); L60: const j = JSON.parse(raw); L61: cached = { ... L253: import { homedir as homedir3 } from "os"; L254: var DEFAULT_API_URL = "https://api.solongate.com"; L255: var accountsFile = () => join3(homedir3(), ".solongate", "accounts.json"); ... L372: const file = loginCredentialFile(); L373: const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey(); L374: if (!apiKey) throw new NotAuthenticatedError(); ... L403: headers: { ...headers, Connection: "close" }, L404: body: bodyInit,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tui/index.jsView on unpkg · L58

58Cross-file remote execution chain: dist/tui/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L58: try { L59: const raw = readFileSync(join(homedir(), ".solongate", "tui-config.json"), "utf-8"); L60: const j = JSON.parse(raw); L61: cached = { ... L253: import { homedir as homedir3 } from "os"; L254: var DEFAULT_API_URL = "https://api.solongate.com"; L255: var accountsFile = () => join3(homedir3(), ".solongate", "accounts.json"); ... L372: const file = loginCredentialFile(); L373: const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey(); L374: if (!apiKey) throw new NotAuthenticatedError(); ... L403: headers: { ...headers, Connection: "close" }, L404: body: bodyInit,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/tui/index.jsView on unpkg · L58

dist/shield.jsView file

3import { request as httpsRequest } from "https"; L4: import { spawn } from "child_process"; L5: import { URL } from "url";

High

Child Process

Package source references child process execution.

dist/shield.jsView on unpkg · L3

281log(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`); L282: const child = spawn(cmd[0], cmd.slice(1), { L283: stdio: "inherit", L284: env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` }, L285: shell: process.platform === "win32"

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/shield.jsView on unpkg · L281

dist/audit/index.jsView file

1395var DANGEROUS_PATTERNS = [ L1396: { pattern: /eval\s*\(/, label: "eval() \u2014 arbitrary code execution" }, L1397: { pattern: /\bexec\s*\(/, label: "exec() \u2014 arbitrary code execution" },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/audit/index.jsView on unpkg · L1395

dist/lib.jsView file

42try { L43: JSON.parse(str); L44: return true; ... L2982: // Keys in mapping nodes earlier in the sequence override keys specified in L2983: // later mapping nodes. -- http://yaml.org/type/merge.html L2984: addToJSMap(ctx, map) { ... L4515: function shouldWarn(deprecation) { L4516: const env = typeof process !== "undefined" && process.env || {}; L4517: if (deprecation) { ... L5075: handle: "!!", L5076: prefix: "tag:private.yaml.org,2002:" L5077: }]

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/lib.jsView on unpkg · L42

42try { L43: JSON.parse(str); L44: return true; ... L2982: // Keys in mapping nodes earlier in the sequence override keys specified in L2983: // later mapping nodes. -- http://yaml.org/type/merge.html L2984: addToJSMap(ctx, map) { ... L4515: function shouldWarn(deprecation) { L4516: const env = typeof process !== "undefined" && process.env || {}; L4517: if (deprecation) { ... L5075: handle: "!!", L5076: prefix: "tag:private.yaml.org,2002:" L5077: }]

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib.jsView on unpkg · L42

dist/index.jsView file

9425patternName = aws_access_key severity = critical line = 9425 matchedText = SAMPLES ...i"];

Critical

Secret Pattern

AWS access key ID in dist/index.js

dist/index.jsView on unpkg · L9425

12271__dirname = dirname3(fileURLToPath3(import.meta.url)); L12272: HOOKS_DIR = resolve4(__dirname, "..", "hooks"); L12273: SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>"; ... L12279: var login_exports = {}; L12280: import { spawn as spawn5 } from "child_process"; L12281: function startSpinner(text) { L12282: if (!process.stderr.isTTY) { L12283: process.stderr.write(` ${text} L12284: `);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L12271

13082const pm = detectPackageManager(); L13083: const cmd = pm === "yarn" ? "yarn add @solongate/proxy" : `${pm} install @solongate/proxy`; L13084: log3(` Installing @solongate/proxy via ${pm}...`); L13085: try { L13086: execSync(cmd, { stdio: "pipe", cwd: process.cwd() }); L13087: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L13082

hooks/guard.mjsView file

13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call. L14: * - API_URL defaults to https://api.solongate.com. L15: * - Enforcement is gated on the API key (the key identifies the project + ... L19: * L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW. L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs. ... L24: import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from 'node:fs'; L25: import { spawn } from 'node:child_process'; L26: import { resolve, join, dirname, isAbsolute } from 'node:path'; L27: import { homedir } from 'node:os'; L28: import { gunzipSync } from 'node:zlib'; L29: import { createHash } from 'node:crypto';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

hooks/guard.mjsView on unpkg · L13

Source & flagged code

14 flagged

dist/tui/index.jsView file

Lines 720-760javascript

720 list: () => list4

721});

722function list4() {

723 return request("GET", "/mcp-servers");

724}

725

726// src/api-client/index.ts

727var api = { auth: auth_exports, policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports, keys: keys_exports, mcp: mcp_exports };

728

729// src/tui/notify.ts

730import { spawn as spawn2 } from "child_process";

731function desktopNotify(title, msg) {

732 try {

733 if (process.platform === "linux") {

734 const p = spawn2("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });

735 p.on("error", () => {

736 });

737 p.unref();

738 } else if (process.platform === "win32") {

739 const q = (s) => s.replace(/'/g, "''");

740 const ps = `Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;$n.ShowBalloonTip(6000,'${q(title)}','${q(msg)}',[System.Windows.Forms.ToolTipIcon]::Warning);Start-Sleep -Milliseconds 6500;$n.Dispose()`;

741 const p = spawn2("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true });

742 p.on("error", () => {

High

Shell

Package source references shell execution.

dist/tui/index.jsView on unpkg · L740

743 });

744 p.unref();

745 } else if (process.platform === "darwin") {

746 const esc = (s) => s.replace(/"/g, '\\"');

747 const p = spawn2("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });

748 p.on("error", () => {

749 });

750 p.unref();

751 }

752 } catch {

753 }

754}

755

756// src/tui/hooks.ts

757import { useCallback, useEffect, useRef, useState } from "react";

758function useLoader(fn, deps = []) {

759 const [data, setData] = useState(null);

760 const [error, setError] = useState(null);

Lines 2430-2470javascript

2430 setNewName(v.trim());

2431 setAdding("re");

2432 }

2433 }

2434 ) : /* @__PURE__ */ jsx5(

2435 TextInput3,

2436 {

2437 value: newRe,

2450patternName = aws_access_key severity = critical line = 2450 matchedText = var SAMP...i"];

Critical

Secret Pattern

AWS access key ID in dist/tui/index.js

dist/tui/index.jsView on unpkg · L2450

58try { L59: const raw = readFileSync(join(homedir(), ".solongate", "tui-config.json"), "utf-8"); L60: const j = JSON.parse(raw); L61: cached = { ... L253: import { homedir as homedir3 } from "os"; L254: var DEFAULT_API_URL = "https://api.solongate.com"; L255: var accountsFile = () => join3(homedir3(), ".solongate", "accounts.json"); ... L372: const file = loginCredentialFile(); L373: const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey(); L374: if (!apiKey) throw new NotAuthenticatedError(); ... L403: headers: { ...headers, Connection: "close" }, L404: body: bodyInit,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tui/index.jsView on unpkg · L58

58Cross-file remote execution chain: dist/tui/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L58: try { L59: const raw = readFileSync(join(homedir(), ".solongate", "tui-config.json"), "utf-8"); L60: const j = JSON.parse(raw); L61: cached = { ... L253: import { homedir as homedir3 } from "os"; L254: var DEFAULT_API_URL = "https://api.solongate.com"; L255: var accountsFile = () => join3(homedir3(), ".solongate", "accounts.json"); ... L372: const file = loginCredentialFile(); L373: const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey(); L374: if (!apiKey) throw new NotAuthenticatedError(); ... L403: headers: { ...headers, Connection: "close" }, L404: body: bodyInit,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/tui/index.jsView on unpkg · L58

dist/shield.jsView file

Lines 1-23javascript

1// src/shield.ts

2import { createServer, request as httpRequest } from "http";

3import { request as httpsRequest } from "https";

4import { spawn } from "child_process";

dist/audit/index.jsView file

Lines 1375-1415javascript

1375 title,

1376 status: "PARTIAL",

1377 evidence,

1378 summary: `${totalIssues} risky package install(s) \u2014 low frequency.`,

1379 details: "Some packages installed without pinned versions, but at low frequency. Review and pin specific versions.",

dist/lib.jsView file

Lines 22-62javascript

22 }

23 return to;

24};

25var __toESM = (mod, isNodeMode, target) => (target = mod != null

dist/index.jsView file

9425patternName = aws_access_key severity = critical line = 9425 matchedText = SAMPLES ...i"];

Critical

Secret Pattern

AWS access key ID in dist/index.js

dist/index.jsView on unpkg · L9425

12271__dirname = dirname3(fileURLToPath3(import.meta.url)); L12272: HOOKS_DIR = resolve4(__dirname, "..", "hooks"); L12273: SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>"; ... L12279: var login_exports = {}; L12280: import { spawn as spawn5 } from "child_process"; L12281: function startSpinner(text) { L12282: if (!process.stderr.isTTY) { L12283: process.stderr.write(` ${text} L12284: `);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L12271

13082const pm = detectPackageManager(); L13083: const cmd = pm === "yarn" ? "yarn add @solongate/proxy" : `${pm} install @solongate/proxy`; L13084: log3(` Installing @solongate/proxy via ${pm}...`); L13085: try { L13086: execSync(cmd, { stdio: "pipe", cwd: process.cwd() }); L13087: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L13082

hooks/guard.mjsView file

13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call. L14: * - API_URL defaults to https://api.solongate.com. L15: * - Enforcement is gated on the API key (the key identifies the project + ... L19: * L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW. L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs. ... L24: import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from 'node:fs'; L25: import { spawn } from 'node:child_process'; L26: import { resolve, join, dirname, isAbsolute } from 'node:path'; L27: import { homedir } from 'node:os'; L28: import { gunzipSync } from 'node:zlib'; L29: import { createHash } from 'node:crypto';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

hooks/guard.mjsView on unpkg · L13