registry / @solongate/proxy / 0.89.64
@solongate/proxy@0.89.64
AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiNo npm lifecycle script causes automatic installation, but the explicit global setup creates a broad, persistent AI-agent control surface with cloud-delivered executable updates and conversation uploads. This is a dangerous capability that warrants warning rather than a malicious-install block under the stated policy.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the solongate repair command or uses its corresponding setup flow.
Impact
Future AI-agent events can execute vendor-controlled hook code and send redacted prompt or reply content to the vendor service.
Mechanism
Global AI-agent hook registration with remote hook self-updating.
AI rationale
No npm lifecycle script causes automatic installation, but the explicit global setup creates a broad, persistent AI-agent control surface with cloud-delivered executable updates and conversation uploads. This is a dangerous capability that warrants warning rather than a malicious-install block under the stated policy.
Evidence
dist/index.jsdist/global-install.jshooks/conversation.mjshooks/guard.mjs~/.solongate/hooks/guard.mjs~/.solongate/hooks/conversation.mjs~/.claude/settings.json~/.codex/hooks.json~/.config/opencode/plugins/solongate.js
Network endpoints1
api.solongate.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The repair command invokes a global installer that writes hooks into several AI client configurations.
- It registers command hooks for Codex tool, prompt, and stop events.
- The installed conversation hook sends prompt or reply bodies to the vendor API.
- An installed guard hook periodically downloads and atomically replaces its own hook code.
- The installer makes its hook and client-configuration targets immutable where supported.
Evidence against
- package.json defines no npm preinstall, install, or postinstall lifecycle hook.
- The invasive behavior is reached through the human-only CLI repair flow, not package installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
26 flagged · loading sourcedist/tui/index.jsView file
143// src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
High
Child Process
Package source references child process execution.
dist/tui/index.jsView on unpkg · L143897try {
L898: const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
L899: return prof ? [prof] : [];
High
13const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LAUNCHER_NAME);
L150: if (process.platform === "win32") {
L151: const ok = existsSync2(process.execPath);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/tui/index.jsView on unpkg · L13•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/tui/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tui/index.jsView on unpkg13const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LAUNCHER_NAME);
L150: if (process.platform === "win32") {
L151: const ok = existsSync2(process.execPath);
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/tui/index.jsView on unpkg · L13dist/cli-launch.jsView file
41try {
L42: const req = createRequire(import.meta.url);
L43: out.push(join(dirname(req.resolve(`@solongate/guard-${os_}-${cpu}/package.json`)), exe));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli-launch.jsView on unpkg · L41hooks/shield.mjsView file
286const { port, close } = await startProxy(upstream);
L287: const child = spawn(cmd[0], cmd.slice(1), {
L288: stdio: 'inherit',
L289: env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
L290: shell: process.platform === 'win32',
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
hooks/shield.mjsView on unpkg · L286•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/shield.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/shield.mjsView on unpkgdist/lib.jsView file
42try {
L43: JSON.parse(str);
L44: return true;
...
L2982: // Keys in mapping nodes earlier in the sequence override keys specified in
L2983: // later mapping nodes. -- http://yaml.org/type/merge.html
L2984: addToJSMap(ctx, map) {
...
L4515: function shouldWarn(deprecation) {
L4516: const env = typeof process !== "undefined" && process.env || {};
L4517: if (deprecation) {
...
L5075: handle: "!!",
L5076: prefix: "tag:private.yaml.org,2002:"
L5077: }]
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
dist/lib.jsView on unpkg · L4242Trigger-reachable credential exfiltration chain: manifest.main -> dist/lib.js
L42: try {
L43: JSON.parse(str);
L44: return true;
...
L2982: // Keys in mapping nodes earlier in the sequence override keys specified in
L2983: // later mapping nodes. -- http://yaml.org/type/merge.html
L2984: addToJSMap(ctx, map) {
...
L4515: function shouldWarn(deprecation) {
L4516: const env = typeof process !== "undefined" && process.env || {};
L4517: if (deprecation) {
...
L5075: handle: "!!",
L5076: prefix: "tag:private.yaml.org,2002:"
L5077: }]
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/lib.jsView on unpkg · L42•Trigger-reachable fixed external POST callback chain: manifest.main -> dist/lib.js
arg = JSON.stringify(arg, null, ph.width ? parseInt(ph.width) : 0);
if (!ctx) return JSON.stringify(this);
return JSON.stringify(jsKey);
if (!ctx || !ctx.doc) return JSON.stringify(this);
if (!ctx) return JSON.stringify(this);
if (!(item instanceof Pair)) throw new Error(`Map items must all be pairs; found ${JSON.stringify(item)} instead`);
// later mapping nodes. -- http://yaml.org/type/merge.html
const json = JSON.stringify(value);
High
Trigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
dist/lib.jsView on unpkg•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/lib.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib.jsView on unpkghooks/guard.mjsView file
13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call.
L14: * - API_URL defaults to https://api.solongate.com.
L15: * - Enforcement is gated on the API key (the key identifies the project +
...
L19: *
L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW.
L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
...
L24: import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, rmdirSync, openSync, readSync, closeSync, accessS...
L25: import { spawn, spawnSync } from 'node:child_process';
L26: import { resolve, join, dirname, isAbsolute } from 'node:path';
...
L28: import { createRequire } from 'node:module';
L29: import { gunzipSync } from 'node:zlib';
L30:
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
hooks/guard.mjsView on unpkg · L13•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/guard.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/guard.mjsView on unpkghooks/guard.bundled.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
!== "string" || typeof data.sha256 !== "string")
return;
const buf = buffer.from(data.content, "base64");
if (createhash("sha256").update(buf).digest("hex") !== data.sha256)
return;
const text = buf.tostring("utf-8");
if (!text.startswith("#!/usr/bin/env node") || text.length < minlen || !text.includes(marker))
return;
const hooksdir = join(resolve(homedir(), ".solongate"), "hooks");
const tmp = join(hooksdir, "." + filename + ".tmp");
writefilesync(tmp, text);
try {
chmodsync(join(hooksdir, filename), 420);
} catch {
}
renamesync(tmp, join(hooksdir, filename));
} catch {
}
}
function installedhookversion(filename) {
try {
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
hooks/guard.bundled.mjsView on unpkg•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/guard.bundled.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/guard.bundled.mjsView on unpkgdist/global-install.jsView file
7Cross-file remote execution chain: dist/global-install.js spawns hooks/guard.bundled.mjs; helper contains network access plus dynamic code execution.
L7: import { createInterface } from "readline";
L8: import { execFileSync as execFileSync2, spawn } from "child_process";
L9:
...
L41: const pinned = pinnedNode.replace(/'/g, `'\\''`);
L42: return `#!/bin/sh
L43: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L70: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L71: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L72: # hook's stderr to the person using it. Redirecting the group catches both.
...
L140: import { homedir } from "os";
L141: var sgDir = () => join(homedir(), ".solongate")
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/global-install.jsView on unpkg · L7•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/global-install.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/global-install.jsView on unpkgdist/index.jsView file
43Trigger-reachable persistence chain: manifest.exports -> dist/index.js
L43: try {
L44: JSON.parse(str);
L45: return true;
...
L2983: // Keys in mapping nodes earlier in the sequence override keys specified in
L2984: // later mapping nodes. -- http://yaml.org/type/merge.html
L2985: addToJSMap(ctx, map) {
...
L4516: function shouldWarn(deprecation) {
L4517: const env = typeof process !== "undefined" && process.env || {};
L4518: if (deprecation) {
...
L5076: handle: "!!",
L5077: prefix: "tag:private.yaml.org,2002:"
L5078: }]
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L43•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkgdist/global-install.js#virtual:string-array:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/global-install.js#virtual:string-array:round1View on unpkgdist/commands/index.jsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/commands/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/index.jsView on unpkgdist/audit/index.jsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/audit/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/audit/index.jsView on unpkgdist/logs-server.jsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/logs-server.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/logs-server.jsView on unpkghooks/audit.mjsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/audit.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/audit.mjsView on unpkghooks/conversation.mjsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/conversation.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/conversation.mjsView on unpkgFindings
24 High5 Medium5 Low
HighChild Processdist/tui/index.js
HighShelldist/tui/index.js
HighSame File Env Network Executionhooks/shield.mjs
HighCredential Exfiltrationdist/lib.js
HighSandbox Evasion Gated Capabilitydist/tui/index.js
HighCloud Metadata Accesshooks/guard.mjs
HighExternal Ai Agent Control Surface Mutationhooks/guard.bundled.mjs
HighCross File Remote Execution Contextdist/global-install.js
HighTrigger Reachable Credential Exfiltrationdist/lib.js
HighTrigger Reachable Persistencedist/index.js
HighTrigger Reachable External Post Callbackdist/lib.js
HighSemantic Analysis Limiteddist/global-install.js#virtual:string-array:round1
HighKnown Malware Source Similarityhooks/guard.mjs
HighKnown Malware Source Similaritydist/global-install.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/tui/index.js
HighKnown Malware Source Similarityhooks/guard.bundled.mjs
HighKnown Malware Source Similaritydist/commands/index.js
HighKnown Malware Source Similarityhooks/shield.mjs
HighKnown Malware Source Similaritydist/audit/index.js
HighKnown Malware Source Similaritydist/logs-server.js
HighKnown Malware Source Similarityhooks/audit.mjs
HighKnown Malware Source Similaritydist/lib.js
HighKnown Malware Source Similarityhooks/conversation.mjs
MediumDynamic Requiredist/cli-launch.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/tui/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @solongate/proxy@0.89.64.
See all versions of @solongate/proxy for other recorded verdicts.
- Review the evidence and your use of @solongate/proxy@0.89.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.