registry / @solongate/proxy / 0.89.52
@solongate/proxy@0.89.52
AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious npm install-hook abuse because the manifest has no automatic lifecycle trigger. Its explicit cross-agent hook installation, conversation upload, remote code update, and configuration locking are nevertheless a dangerous persistent capability that warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the package's global-install, repair, or equivalent guard setup flow and then uses a hooked AI client.
Impact
A configured account can continuously monitor AI-agent activity and accept new hook code from the service; locked files make removal or modification harder.
Mechanism
Agent-hook registration, cloud conversation upload, and remote hook self-update.
AI rationale
This is not malicious npm install-hook abuse because the manifest has no automatic lifecycle trigger. Its explicit cross-agent hook installation, conversation upload, remote code update, and configuration locking are nevertheless a dangerous persistent capability that warrants a warning.
Evidence
package.jsondist/global-install.jshooks/conversation.mjshooks/guard.mjs~/.solongate/hooks/guard.mjs~/.solongate/hooks/audit.mjs~/.solongate/hooks/conversation.mjs~/.solongate/cloud-guard.json~/.claude/settings.json~/.codex/hooks.json~/.gemini/config/hooks.json~/.config/opencode/plugins/solongate.js
Network endpoints2
api.solongate.com/api/v1/conversationsapi.solongate.com/api/v1/hooks/
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- A global setup path registers command hooks for Claude, Codex, Antigravity, and OpenCode.
- The conversation hook uploads prompt and reply text to the configured SolonGate API whenever an API key is available.
- The guard downloads server-provided hook source and atomically replaces installed hook files.
- The setup locks its hook and agent configuration files after registration, creating persistent enforcement.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- The control-surface changes occur in explicit global-install and repair functionality rather than during npm installation.
- The observed network host is the package vendor's API, and the upload path performs local redaction first.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
19 flagged · loading sourcedist/tui/index.jsView file
143// src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
High
Child Process
Package source references child process execution.
dist/tui/index.jsView on unpkg · L143897try {
L898: const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
L899: return prof ? [prof] : [];
High
13const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LAUNCHER_NAME);
L150: if (process.platform === "win32") {
L151: const ok = existsSync2(process.execPath);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/tui/index.jsView on unpkg · L1313Cross-file remote execution chain: dist/tui/index.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L13: const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LA
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/tui/index.jsView on unpkg · L1313const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LAUNCHER_NAME);
L150: if (process.platform === "win32") {
L151: const ok = existsSync2(process.execPath);
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/tui/index.jsView on unpkg · L13dist/audit/index.jsView file
1527var DANGEROUS_PATTERNS = [
L1528: { pattern: /eval\s*\(/, label: "eval() \u2014 arbitrary code execution" },
L1529: { pattern: /\bexec\s*\(/, label: "exec() \u2014 arbitrary code execution" },
High
dist/cli-launch.jsView file
41try {
L42: const req = createRequire(import.meta.url);
L43: out.push(join(dirname(req.resolve(`@solongate/guard-${os_}-${cpu}/package.json`)), exe));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli-launch.jsView on unpkg · L41hooks/shield.mjsView file
286const { port, close } = await startProxy(upstream);
L287: const child = spawn(cmd[0], cmd.slice(1), {
L288: stdio: 'inherit',
L289: env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
L290: shell: process.platform === 'win32',
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
hooks/shield.mjsView on unpkg · L286•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.82.12
matchedPath = hooks/shield.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.82.12
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/shield.mjsView on unpkghooks/guard.mjsView file
13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call.
L14: * - API_URL defaults to https://api.solongate.com.
L15: * - Enforcement is gated on the API key (the key identifies the project +
...
L19: *
L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW.
L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
...
L24: import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, rmdirSync, openSync, readSync, closeSync, accessS...
L25: import { spawn, spawnSync } from 'node:child_process';
L26: import { resolve, join, dirname, isAbsolute } from 'node:path';
...
L28: import { createRequire } from 'node:module';
L29: import { gunzipSync } from 'node:zlib';
L30:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
hooks/guard.mjsView on unpkg · L1313* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call.
L14: * - API_URL defaults to https://api.solongate.com.
L15: * - Enforcement is gated on the API key (the key identifies the project +
...
L19: *
L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW.
L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
...
L24: import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, rmdirSync, openSync, readSync, closeSync, accessS...
L25: import { spawn, spawnSync } from 'node:child_process';
L26: import { resolve, join, dirname, isAbsolute } from 'node:path';
...
L28: import { createRequire } from 'node:module';
L29: import { gunzipSync } from 'node:zlib';
L30:
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
hooks/guard.mjsView on unpkg · L13dist/index.jsView file
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js
"../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/json.js"(exports, module) {
// ../../node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js
"../../node_modules/.pnpm/sprintf-js@1.1.3/node_modules/sprintf-js/src/sprintf.js"(exports) {
// ../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@open-policy-agent/opa-wasm/src/builtins/strings.js
"../../node_modules/.pnpm/@open-policy-agent+opa-wasm@1.10.0/node_modules/@
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkg43Trigger-reachable persistence chain: manifest.exports -> dist/index.js
L43: try {
L44: JSON.parse(str);
L45: return true;
...
L2983: // Keys in mapping nodes earlier in the sequence override keys specified in
L2984: // later mapping nodes. -- http://yaml.org/type/merge.html
L2985: addToJSMap(ctx, map) {
...
L4516: function shouldWarn(deprecation) {
L4517: const env = typeof process !== "undefined" && process.env || {};
L4518: if (deprecation) {
...
L5076: handle: "!!",
L5077: prefix: "tag:private.yaml.org,2002:"
L5078: }]
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L43•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkghooks/guard.bundled.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
!== "string" || typeof data.sha256 !== "string")
return;
const buf = buffer.from(data.content, "base64");
if (createhash("sha256").update(buf).digest("hex") !== data.sha256)
return;
const text = buf.tostring("utf-8");
if (!text.startswith("#!/usr/bin/env node") || text.length < minlen || !text.includes(marker))
return;
const hooksdir = join(resolve(homedir(), ".solongate"), "hooks");
const tmp = join(hooksdir, "." + filename + ".tmp");
writefilesync(tmp, text);
try {
chmodsync(join(hooksdir, filename), 420);
} catch {
}
renamesync(tmp, join(hooksdir, filename));
} catch {
}
}
function installedhookversion(filename) {
try {
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
hooks/guard.bundled.mjsView on unpkg•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.82.12
matchedPath = hooks/guard.bundled.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.82.12
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/guard.bundled.mjsView on unpkgdist/lib.jsView file
42Trigger-reachable credential exfiltration chain: manifest.main -> dist/lib.js
L42: try {
L43: JSON.parse(str);
L44: return true;
...
L2982: // Keys in mapping nodes earlier in the sequence override keys specified in
L2983: // later mapping nodes. -- http://yaml.org/type/merge.html
L2984: addToJSMap(ctx, map) {
...
L4515: function shouldWarn(deprecation) {
L4516: const env = typeof process !== "undefined" && process.env || {};
L4517: if (deprecation) {
...
L5075: handle: "!!",
L5076: prefix: "tag:private.yaml.org,2002:"
L5077: }]
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/lib.jsView on unpkg · L42•Trigger-reachable fixed external POST callback chain: manifest.main -> dist/lib.js
arg = JSON.stringify(arg, null, ph.width ? parseInt(ph.width) : 0);
if (!ctx) return JSON.stringify(this);
return JSON.stringify(jsKey);
if (!ctx || !ctx.doc) return JSON.stringify(this);
if (!ctx) return JSON.stringify(this);
if (!(item instanceof Pair)) throw new Error(`Map items must all be pairs; found ${JSON.stringify(item)} instead`);
// later mapping nodes. -- http://yaml.org/type/merge.html
const json = JSON.stringify(value);
High
Trigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
dist/lib.jsView on unpkg•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.82.12
matchedPath = dist/lib.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.82.12
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib.jsView on unpkgFindings
1 Critical16 High5 Medium4 Low
CriticalCredential Exfiltrationhooks/guard.mjs
HighChild Processdist/tui/index.js
HighShelldist/tui/index.js
HighEvaldist/audit/index.js
HighSame File Env Network Executionhooks/shield.mjs
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighSandbox Evasion Gated Capabilitydist/tui/index.js
HighCloud Metadata Accesshooks/guard.mjs
HighExternal Ai Agent Control Surface Mutationhooks/guard.bundled.mjs
HighCross File Remote Execution Contextdist/tui/index.js
HighTrigger Reachable Credential Exfiltrationdist/lib.js
HighTrigger Reachable Persistencedist/index.js
HighTrigger Reachable External Post Callbackdist/lib.js
HighSemantic Analysis Limiteddist/index.js
HighKnown Malware Source Similarityhooks/shield.mjs
HighKnown Malware Source Similarityhooks/guard.bundled.mjs
HighKnown Malware Source Similaritydist/lib.js
MediumDynamic Requiredist/cli-launch.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/tui/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @solongate/proxy@0.89.52.
See all versions of @solongate/proxy for other recorded verdicts.
- Review the evidence and your use of @solongate/proxy@0.89.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.