registry / @solongate/proxy / 0.89.27

@solongate/proxy@0.89.27

AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection found an explicit-user global AI-agent extension with remote self-updating hooks and telemetry, not an unconsented install-time payload. This warrants a warning for lifecycle risk rather than a malware block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the global setup or management flow, then starts a configured AI-agent session.

Impact

A compromised vendor service or configured API endpoint could replace hooks that run on future agent events; configured conversation content is transmitted to the vendor service.

Mechanism

Persistent agent hooks with vendor-delivered self-updates and telemetry.

AI rationale

Evidence

package.jsondist/global-install.jshooks/guard.mjshooks/conversation.mjs~/.solongate/hooks/guard.mjs~/.solongate/hooks/audit.mjs~/.solongate/hooks/shield.mjs~/.claude/settings.json~/.codex/hooks.json~/.gemini/config/hooks.json

Network endpoints2

api.solongate.com/api/v1/hooks/api.solongate.com/api/v1/conversations

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit global setup registers command hooks for several AI-agent platforms.
The installed guard fetches newer hook source from the vendor API and atomically replaces local hook files.
A conversation hook sends redacted prompt and reply content to the configured vendor API when a credential exists.

Evidence against

The manifest contains no npm lifecycle hook, so installation alone does not activate this behavior.
Agent configuration changes occur through the package's interactive, human-only management path rather than an install script.
The observed endpoints and hook functionality are aligned with the package's stated security-proxy purpose.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Source & flagged code

19 flagged

dist/tui/index.jsView file

Lines 1-33javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res) => function __init() {

4 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

5};

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

11// src/hook-launcher.ts

12function launcherScript(pinnedNode) {

13 const pinned = pinnedNode.replace(/'/g, `'\\''`);

14 return `#!/bin/sh

15# SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tui/index.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/tui/index.jsView on unpkg · L13

16#

17# Finds a working node and execs the hook with it. Do not edit: a reinstall

18# overwrites this file, and on macOS it is chflags-locked besides.

19#

20# The reason it exists rather than the hook naming a node directly: an absolute

21# node path recorded at install time is a Homebrew Cellar path or an nvm version

22# directory, and both are deleted by a routine upgrade. The hook then could not

23# start, nothing was enforced, nothing was logged, and every check still said

24# the guard was registered \u2014 because it was.

26set -u

28script="\${1:-}"

29[ -n "$script" ] || { echo "solongate: launcher called with no hook script" >&2; exit 1; }

30shift

32hook=\${script##*/}

33home=\${HOME:-~}

Lines 123-163javascript

123 ];

124 NODE_GLOBS = [

125 // nvm. NVM_DIR is exported by its own shell hook, which a non-interactive

126 // hook environment does not run, so the default location is tried too.

127 '"${NVM_DIR:-}"/versions/node/*/bin/node',

128 '"$home"/.nvm/versions/node/*/bin/node',

129 // fnm, both the XDG location and the macOS Application Support one.

130

Lines 877-917javascript

877 } catch {

878 }

879 try {

880 removeOpencodeGuard(p);

881 } catch {

882 }

883 if (!existsSync3(p.settingsPath)) return { ok: true

13Cross-file remote execution chain: dist/tui/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L13: const pinned = pinnedNode.replace(/'/g, `'\\''`); L14: return `#!/bin/sh L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`. ... L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a L44: # hook's stderr to the person using it. Redirecting the group catches both. ... L143: // src/hook-health.ts L144: import { execFileSync } from "child_process"; L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs"; ... L149: const launcher = join3(hooksDir(), LA

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/tui/index.jsView on unpkg · L13

dist/audit/index.jsView file

Lines 1507-1547javascript

1507 title,

1508 status: "PARTIAL",

1509 evidence,

1510 summary: `${totalIssues} risky package install(s) \u2014 low frequency.`,

1511 details: "Some packages installed without pinned versions, but at low frequency. Review and pin specific versions.",

dist/cli-launch.jsView file

Lines 21-61javascript

21 "doctor",

22 "watch",

23 "alerts",

24 "webhooks",

25 "dataroom"

26 // The `browser` command is gone on purpose: the agent installs, arranges and

27 // restarts itself, and everything a person manages is on the dashboard. There

hooks/shield.mjsView file

Lines 266-299javascript

266 if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain' });

267 res.end('shield upstream error');

268 });

269 upReq.end(body);

270

hooks/guard.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * SolonGate Cloud Policy Guard Hook (PreToolUse) — GLOBAL system-wide enforcement.

4 *

5 * This is the cloud twin of the air-gapped guard hook. Identical decision engine

6 * (OPA WASM, NIST SP 800-207 PDP, fail-closed), but the policy + compiled WASM

7 * are fetched from SolonGate Cloud and authenticated with the project API key.

8 * Installed globally (~/.claude/settings.json) it intercepts EVERY tool call from

9 * EVERY Claude Code session on the machine — exactly like the air-gapped product,

10 * just sourced from the cloud instead of a local docker API.

dist/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: // ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js"(exports, module) { // ../../node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js "../../node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js"(exports) { // ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js "../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

43Trigger-reachable persistence chain: manifest.exports -> dist/index.js L43: try { L44: JSON.parse(str); L45: return true; ... L2983: // Keys in mapping nodes earlier in the sequence override keys specified in L2984: // later mapping nodes. -- http://yaml.org/type/merge.html L2985: addToJSMap(ctx, map) { ... L4516: function shouldWarn(deprecation) { L4517: const env = typeof process !== "undefined" && process.env || {}; L4518: if (deprecation) { ... L5076: handle: "!!", L5077: prefix: "tag:private.yaml.org,2002:" L5078: }]

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L43

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

hooks/guard.bundled.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: !== "string" || typeof data.sha256 !== "string") return; const buf = buffer.from(data.content, "base64"); if (createhash("sha256").update(buf).digest("hex") !== data.sha256) return; const text = buf.tostring("utf-8"); if (!text.startswith("#!/usr/bin/env node") || text.length < minlen || !text.includes(marker)) return; const hooksdir = join(resolve(homedir(), ".solongate"), "hooks"); const tmp = join(hooksdir, "." + filename + ".tmp"); writefilesync(tmp, text); try { chmodsync(join(hooksdir, filename), 420); } catch { } renamesync(tmp, join(hooksdir, filename)); } catch { } } function installedhookversion(filename) { try {

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

hooks/guard.bundled.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.82.12 matchedPath = hooks/guard.bundled.mjs matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.82.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/guard.bundled.mjsView on unpkg

dist/lib.jsView file

42Trigger-reachable credential exfiltration chain: manifest.main -> dist/lib.js L42: try { L43: JSON.parse(str); L44: return true; ... L2982: // Keys in mapping nodes earlier in the sequence override keys specified in L2983: // later mapping nodes. -- http://yaml.org/type/merge.html L2984: addToJSMap(ctx, map) { ... L4515: function shouldWarn(deprecation) { L4516: const env = typeof process !== "undefined" && process.env || {}; L4517: if (deprecation) { ... L5075: handle: "!!", L5076: prefix: "tag:private.yaml.org,2002:" L5077: }]

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/lib.jsView on unpkg · L42

•Trigger-reachable fixed external POST callback chain: manifest.main -> dist/lib.js arg = JSON.stringify(arg, null, ph.width ? parseInt(ph.width) : 0); if (!ctx) return JSON.stringify(this); return JSON.stringify(jsKey); if (!ctx || !ctx.doc) return JSON.stringify(this); if (!ctx) return JSON.stringify(this); if (!(item instanceof Pair)) throw new Error(`Map items must all be pairs; found ${JSON.stringify(item)} instead`); // later mapping nodes. -- http://yaml.org/type/merge.html const json = JSON.stringify(value);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

dist/lib.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.82.12 matchedPath = dist/lib.js matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.82.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

Source & flagged code

19 flagged · loading source

dist/tui/index.jsView file

143// src/hook-health.ts L144: import { execFileSync } from "child_process"; L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/tui/index.jsView on unpkg · L143

897try { L898: const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim(); L899: return prof ? [prof] : [];

High

Shell

Package source references shell execution.

dist/tui/index.jsView on unpkg · L897

13const pinned = pinnedNode.replace(/'/g, `'\\''`); L14: return `#!/bin/sh L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`. ... L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a L44: # hook's stderr to the person using it. Redirecting the group catches both. ... L143: // src/hook-health.ts L144: import { execFileSync } from "child_process"; L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs"; ... L149: const launcher = join3(hooksDir(), LAUNCHER_NAME); L150: if (process.platform === "win32") { L151: const ok = existsSync2(process.execPath);

Findings

1 Critical16 High5 Medium4 Low

CriticalCredential Exfiltrationhooks/guard.mjs

HighChild Processdist/tui/index.js

HighShelldist/tui/index.js

HighEvaldist/audit/index.js

HighSame File Env Network Executionhooks/shield.mjs

HighEntrypoint Foreign Package Code Overwritedist/index.js

HighSandbox Evasion Gated Capabilitydist/tui/index.js

HighCloud Metadata Accesshooks/guard.mjs

HighExternal Ai Agent Control Surface Mutationhooks/guard.bundled.mjs

HighCross File Remote Execution Contextdist/tui/index.js

HighTrigger Reachable Credential Exfiltrationdist/lib.js

High

Affected versions and remediation

This report applies to @solongate/proxy@0.89.27.

See all versions of @solongate/proxy for other recorded verdicts.

Review the evidence and your use of @solongate/proxy@0.89.27 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 00:16:00.634Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code