Loading npm security reports…

@solongate/proxy@0.82.12: Malicious npm security report (Block) | LPM Firewall

registry / @solongate/proxy / 0.82.12

@solongate/proxy@0.82.12

AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

After user-enabled global installation, every supported agent tool invocation can execute a hook that fetches and installs cloud-supplied JavaScript. The hooks also can alter agent-visible output and upload tool metadata.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the package login/global-install flow, then uses Claude Code or Antigravity tools.

Impact

Remote server control can become code execution in future agent-hook invocations and can intercept or conceal agent tool activity.

Mechanism

Remote hook replacement plus global AI-agent hook registration and cloud audit logging.

Attack narrative

The explicit installation flow places package hooks into global Claude Code and Antigravity configuration. On later tool calls, guard.mjs fetches higher-version hook source from the configured API and writes it over installed hook files; its hash check compares a server-provided hash to that same server-provided payload. The replacement then executes on subsequent agent events. The hooks can send tool arguments to the audit API and rewrite outputs to hide policy-selected paths.

Rationale

This is more than a benign scanner primitive: source confirms remotely supplied executable hook replacement in a broad AI-agent control surface, plus interception and concealment of agent activity. Although initial setup is user-invoked and there is no npm lifecycle hook, the remote payload execution chain warrants blocking.

Evidence

package.jsondist/global-install.jshooks/guard.mjshooks/audit.mjshooks/shield.mjs~/.solongate/hooks/guard.mjs~/.solongate/hooks/audit.mjs

Source & flagged code

11 flagged · loading source

dist/shield.jsView file

3import { request as httpsRequest } from "https"; L4: import { spawn } from "child_process"; L5: import { URL } from "url";

High

Child Process

Package source references child process execution.

dist/shield.jsView on unpkg · L3

282log(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`); L283: const child = spawn(cmd[0], cmd.slice(1), { L284: stdio: "inherit", L285: env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` }, L286: shell: process.platform === "win32"

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/shield.jsView on unpkg · L282

dist/tui/index.jsView file

807const ps = `Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::In... L808: const p = spawn2("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true }); L809: p.on("error", () => {

High

Shell

Package source references shell execution.

dist/tui/index.jsView on unpkg · L807

58Cross-file remote execution chain: dist/tui/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L58: try { L59: const raw = readFileSync(join(homedir(), ".solongate", "tui-config.json"), "utf-8"); L60: const j = JSON.parse(raw); L61: cached = { ... L297: import { homedir as homedir3 } from "os"; L298: var DEFAULT_API_URL = "https://api.solongate.com"; L299: var accountsFile = () => join3(homedir3(), ".solongate", "accounts.json"); ... L438: const file = loginCredentialFile(); L439: const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey(); L440: if (!apiKey) throw new NotAuthenticatedError(); ... L469: headers: { ...headers, Connection: "close" }, L470: body: bodyInit,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/tui/index.jsView on unpkg · L58

58try { L59: const raw = readFileSync(join(homedir(), ".solongate", "tui-config.json"), "utf-8"); L60: const j = JSON.parse(raw); L61: cached = { ... L297: import { homedir as homedir3 } from "os"; L298: var DEFAULT_API_URL = "https://api.solongate.com"; L299: var accountsFile = () => join3(homedir3(), ".solongate", "accounts.json"); ... L438: const file = loginCredentialFile(); L439: const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey(); L440: if (!apiKey) throw new NotAuthenticatedError(); ... L469: headers: { ...headers, Connection: "close" }, L470: body: bodyInit,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/tui/index.jsView on unpkg · L58

dist/audit/index.jsView file

1408var DANGEROUS_PATTERNS = [ L1409: { pattern: /eval\s*\(/, label: "eval() \u2014 arbitrary code execution" }, L1410: { pattern: /\bexec\s*\(/, label: "exec() \u2014 arbitrary code execution" },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/audit/index.jsView on unpkg · L1408

dist/lib.jsView file

42try { L43: JSON.parse(str); L44: return true; ... L2982: // Keys in mapping nodes earlier in the sequence override keys specified in L2983: // later mapping nodes. -- http://yaml.org/type/merge.html L2984: addToJSMap(ctx, map) { ... L4515: function shouldWarn(deprecation) { L4516: const env = typeof process !== "undefined" && process.env || {}; L4517: if (deprecation) { ... L5075: handle: "!!", L5076: prefix: "tag:private.yaml.org,2002:" L5077: }]

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/lib.jsView on unpkg · L42

dist/index.jsView file

41try { L42: const p = join(homedir(), ".solongate", "cloud-guard.json"); L43: if (!existsSync(p)) return {}; L44: const c2 = JSON.parse(readFileSync(p, "utf-8")); L45: return c2 && typeof c2 === "object" ? c2 : {}; ... L52: if (!resolvedId) { L53: const listRes = await fetch(`${apiUrl}/api/v1/policies`, { L54: headers: { "Authorization": `Bearer ${apiKey}` }, ... L120: const resBody = await res.text().catch(() => ""); L121: process.stderr.write(`[SolonGate] Audit log rejected (${res.status}): ${resBody} L122: `); ... L262: if (!apiKey) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L41

13127const pm = detectPackageManager(); L13128: const cmd = pm === "yarn" ? "yarn add @solongate/proxy" : `${pm} install @solongate/proxy`; L13129: log3(` Installing @solongate/proxy via ${pm}...`); L13130: try { L13131: execSync(cmd, { stdio: "pipe", cwd: process.cwd() }); L13132: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L13127

hooks/guard.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @solongate/proxy@0.81.78 matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.81.78 similarity = 0.706 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/guard.mjsView on unpkg

13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call. L14: * - API_URL defaults to https://api.solongate.com. L15: * - Enforcement is gated on the API key (the key identifies the project + ... L19: * L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW. L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs. ... L24: import { readFileSync, existsSync, statSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync } from 'node:fs'; L25: import { spawn } from 'node:child_process'; L26: import { resolve, join, dirname, isAbsolute } from 'node:path'; L27: import { homedir } from 'node:os'; L28: import { gunzipSync } from 'node:zlib'; L29: import { createHash } from 'node:crypto';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

hooks/guard.mjsView on unpkg · L13

Source & flagged code

11 flagged

dist/shield.jsView file

Lines 1-23javascript

1// src/shield.ts

2import { createServer, request as httpRequest } from "http";

3import { request as httpsRequest } from "https";

4import { spawn } from "child_process";

5import { URL } from "url";

High

Child Process

Package source references child process execution.

dist/shield.jsView on unpkg · L3

6import { readFileSync, existsSync, readdirSync, statSync } from "fs";

7import { resolve } from "path";

8import { homedir } from "os";

9var log = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}

10`);

11var DLP_PATTERNS = [

12 { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },

13 { name: "Private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },

14 { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },

15 { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },

16 { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },

17 { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },

18 { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },

19 { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },

20 { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },

21 { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },

22 { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },

23 { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },

Lines 262-302javascript

262 }

263 });

264 });

265 return new Promise((resolveP) => {

266 server.listen(0, "127.0.0.1", () => {

267 const

dist/tui/index.jsView file

Lines 38-78javascript

38 " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557 \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",

39 " \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551

dist/audit/index.jsView file

Lines 1388-1428javascript

1388 title,

1389 status: "PARTIAL",

1390 evidence,

1391 summary: `${totalIssues} risky package install(s) \u2014 low frequency.`,

1392 details: "Some packages installed without pinned versions, but at low frequency. Review and pin specific versions.",

dist/lib.jsView file

Lines 22-62javascript

22 }

23 return to;

24};

25var __toESM = (mod, isNodeMode, target) => (target = mod != null

dist/index.jsView file

41try { L42: const p = join(homedir(), ".solongate", "cloud-guard.json"); L43: if (!existsSync(p)) return {}; L44: const c2 = JSON.parse(readFileSync(p, "utf-8")); L45: return c2 && typeof c2 === "object" ? c2 : {}; ... L52: if (!resolvedId) { L53: const listRes = await fetch(`${apiUrl}/api/v1/policies`, { L54: headers: { "Authorization": `Bearer ${apiKey}` }, ... L120: const resBody = await res.text().catch(() => ""); L121: process.stderr.write(`[SolonGate] Audit log rejected (${res.status}): ${resBody} L122: `); ... L262: if (!apiKey) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L41

13127const pm = detectPackageManager(); L13128: const cmd = pm === "yarn" ? "yarn add @solongate/proxy" : `${pm} install @solongate/proxy`; L13129: log3(` Installing @solongate/proxy via ${pm}...`); L13130: try { L13131: execSync(cmd, { stdio: "pipe", cwd: process.cwd() }); L13132: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L13127

hooks/guard.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * SolonGate Cloud Policy Guard Hook (PreToolUse) — GLOBAL system-wide enforcement.

4 *

5 * This is the cloud twin of the air-gapped guard hook. Identical decision engine

6 * (OPA WASM, NIST SP 800-207 PDP, fail-closed), but the policy + compiled WASM

7 * are fetched from SolonGate Cloud and authenticated with the project API key.

8 * Installed globally (~/.claude/settings.json) it intercepts EVERY tool call from

9 * EVERY Claude Code session on the machine — exactly like the air-gapped product,

10 * just sourced from the cloud instead of a local docker API.

Lines 787-827javascript

787 list: () => list4

788});

789function list4() {

790 return request("GET", "/mcp-servers");

791}

792

793// src/api-client/index.ts

794var api = { auth: auth_exports, policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports, keys: keys_exports, mcp: mcp_exports };

795

796// src/tui/notify.ts

797import { spawn as spawn2 } from "child_process";

798function desktopNotify(title, msg) {

799 try {

800 if (process.platform === "linux") {

801 const p = spawn2("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });

802 p.on("error", () => {

803 });

804 p.unref();

805 } else if (process.platform === "win32") {

806 const q = (s) => s.replace(/'/g, "''");

807 const ps = `Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;$n.ShowBalloonTip(6000,'${q(title)}','${q(msg)}',[System.Windows.Forms.ToolTipIcon]::Warning);Start-Sleep -Milliseconds 6500;$n.Dispose()`;

808 const p = spawn2("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true });

809 p.on("error", () => {

High

Shell

Package source references shell execution.

dist/tui/index.jsView on unpkg · L807

810 });

811 p.unref();

812 } else if (process.platform === "darwin") {

813 const esc = (s) => s.replace(/"/g, '\\"');

814 const p = spawn2("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });

815 p.on("error", () => {

816 });

817 p.unref();

818 }

819 } catch {

820 }

821}

822

823// src/tui/hooks.ts

824import { useCallback, useEffect, useRef, useState } from "react";

825function useLoader(fn, deps = []) {

826 const [data, setData] = useState(null);

827 const [error, setError] = useState(null);