Loading npm security reports…

@solongate/proxy@0.89.87: Malicious npm security report (Block) | LPM Firewall

registry / @solongate/proxy / 0.89.87

@solongate/proxy@0.89.87

AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The global setup installs command hooks into AI-client configuration. On later tool events, the hook can download and replace its own JavaScript, causing cloud-supplied code to run in those hook contexts.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user runs the package's global setup, then an enabled AI client invokes a registered hook.

Impact

A service controlling the API response can persist and execute replacement code in registered AI-tool sessions.

Mechanism

Remote hook replacement followed by AI-client command-hook execution.

Attack narrative

After explicit global setup, the package writes hooks into multiple AI-client configuration files. When the guard later runs, it requests hook content from api.solongate.com, accepts a server-supplied hash for that content, and replaces its installed JavaScript. The replacement is used on subsequent AI-tool hook events, creating a remote code-update channel inside broad agent control surfaces.

Rationale

Although npm installation has no lifecycle hook, the package establishes broad AI-client hooks and remotely replaces the code they execute. This is a concrete remote-code execution and persistence path.

Evidence

hooks/guard.mjsdist/global-install.js~/.solongate/hooks/guard.mjs~/.claude/settings.json~/.codex/hooks.json~/.gemini/config/hooks.json~/.config/opencode/plugins/solongate.js

Network endpoints

Source & flagged code

27 flagged

dist/tui/index.jsView file

Lines 1-33javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res) => function __init() {

4 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

5};

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

11// src/hook-launcher.ts

12function launcherScript(pinnedNode) {

13 const pinned = pinnedNode.replace(/'/g, `'\\''`);

14 return `#!/bin/sh

15# SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tui/index.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/tui/index.jsView on unpkg · L13

16#

17# Finds a working node and execs the hook with it. Do not edit: a reinstall

18# overwrites this file, and on macOS it is chflags-locked besides.

19#

20# The reason it exists rather than the hook naming a node directly: an absolute

21# node path recorded at install time is a Homebrew Cellar path or an nvm version

22# directory, and both are deleted by a routine upgrade. The hook then could not

23# start, nothing was enforced, nothing was logged, and every check still said

24# the guard was registered \u2014 because it was.

26set -u

28script="\${1:-}"

29[ -n "$script" ] || { echo "solongate: launcher called with no hook script" >&2; exit 1; }

30shift

32hook=\${script##*/}

33home=\${HOME:-~}

Lines 123-163javascript

123 ];

124 NODE_GLOBS = [

125 // nvm. NVM_DIR is exported by its own shell hook, which a non-interactive

126 // hook environment does not run, so the default location is tried too.

127 '"${NVM_DIR:-}"/versions/node/*/bin/node',

128 '"$home"/.nvm/versions/node/*/bin/node',

129 // fnm, both the XDG location and the macOS Application Support one.

130

Lines 877-917javascript

877 } catch {

878 }

879 try {

880 removeOpencodeGuard(p);

881 } catch {

882 }

883 if (!existsSync3(p.settingsPath)) return { ok: true

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = dist/tui/index.js matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui/index.jsView on unpkg

dist/audit/index.jsView file

Lines 1507-1547javascript

1507 title,

1508 status: "PARTIAL",

1509 evidence,

1510 summary: `${totalIssues} risky package install(s) \u2014 low frequency.`,

1511 details: "Some packages installed without pinned versions, but at low frequency. Review and pin specific versions.",

dist/cli-launch.jsView file

Lines 21-61javascript

21 "doctor",

22 "watch",

23 "alerts",

24 "webhooks",

25 "dataroom"

26 // The `browser` command is gone on purpose: the agent installs, arranges and

27 // restarts itself, and everything a person manages is on the dashboard. There

hooks/shield.mjsView file

Lines 266-299javascript

266 if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain' });

267 res.end('shield upstream error');

268 });

269 upReq.end(body);

270

hooks/guard.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * SolonGate Cloud Policy Guard Hook (PreToolUse) — GLOBAL system-wide enforcement.

4 *

5 * This is the cloud twin of the air-gapped guard hook. Identical decision engine

6 * (OPA WASM, NIST SP 800-207 PDP, fail-closed), but the policy + compiled WASM

7 * are fetched from SolonGate Cloud and authenticated with the project API key.

8 * Installed globally (~/.claude/settings.json) it intercepts EVERY tool call from

9 * EVERY Claude Code session on the machine — exactly like the air-gapped product,

10 * just sourced from the cloud instead of a local docker API.

hooks/guard.bundled.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: !== "string" || typeof data.sha256 !== "string") return; const buf = buffer.from(data.content, "base64"); if (createhash("sha256").update(buf).digest("hex") !== data.sha256) return; const text = buf.tostring("utf-8"); if (!text.startswith("#!/usr/bin/env node") || text.length < minlen || !text.includes(marker)) return; const hooksdir = join(resolve(homedir(), ".solongate"), "hooks"); const tmp = join(hooksdir, "." + filename + ".tmp"); writefilesync(tmp, text); try { chmodsync(join(hooksdir, filename), 420); } catch { } renamesync(tmp, join(hooksdir, filename)); } catch { } } function installedhookversion(filename) { try {

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

hooks/guard.bundled.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = hooks/guard.bundled.mjs matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/guard.bundled.mjsView on unpkg

dist/global-install.jsView file

7Cross-file remote execution chain: dist/global-install.js spawns hooks/guard.bundled.mjs; helper contains network access plus dynamic code execution. L7: import { createInterface } from "readline"; L8: import { execFileSync as execFileSync2, spawn } from "child_process"; L9: ... L41: const pinned = pinnedNode.replace(/'/g, `'\\''`); L42: return `#!/bin/sh L43: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`. ... L70: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does L71: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a L72: # hook's stderr to the person using it. Redirecting the group catches both. ... L140: import { homedir } from "os"; L141: var sgDir = () => join(homedir(), ".solongate")

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-install.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = dist/global-install.js matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/global-install.jsView on unpkg

dist/lib.jsView file

42Trigger-reachable credential exfiltration chain: manifest.main -> dist/lib.js L42: try { L43: JSON.parse(str); L44: return true; ... L2982: // Keys in mapping nodes earlier in the sequence override keys specified in L2983: // later mapping nodes. -- http://yaml.org/type/merge.html L2984: addToJSMap(ctx, map) { ... L4515: function shouldWarn(deprecation) { L4516: const env = typeof process !== "undefined" && process.env || {}; L4517: if (deprecation) { ... L5075: handle: "!!", L5076: prefix: "tag:private.yaml.org,2002:" L5077: }]

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/lib.jsView on unpkg · L42

•Trigger-reachable fixed external POST callback chain: manifest.main -> dist/lib.js arg = JSON.stringify(arg, null, ph.width ? parseInt(ph.width) : 0); if (!ctx) return JSON.stringify(this); return JSON.stringify(jsKey); if (!ctx || !ctx.doc) return JSON.stringify(this); if (!ctx) return JSON.stringify(this); if (!(item instanceof Pair)) throw new Error(`Map items must all be pairs; found ${JSON.stringify(item)} instead`); // later mapping nodes. -- http://yaml.org/type/merge.html const json = JSON.stringify(value);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

dist/lib.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = dist/lib.js matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/index.jsView file

43Trigger-reachable persistence chain: manifest.exports -> dist/index.js L43: try { L44: JSON.parse(str); L45: return true; ... L2983: // Keys in mapping nodes earlier in the sequence override keys specified in L2984: // later mapping nodes. -- http://yaml.org/type/merge.html L2985: addToJSMap(ctx, map) { ... L4516: function shouldWarn(deprecation) { L4517: const env = typeof process !== "undefined" && process.env || {}; L4518: if (deprecation) { ... L5076: handle: "!!", L5077: prefix: "tag:private.yaml.org,2002:" L5078: }]

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L43

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = dist/index.js matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

dist/global-install.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-install.js#virtual:string-array:round1View on unpkg

dist/commands/index.jsView file

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = dist/commands/index.js matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/index.jsView on unpkg

dist/logs-server.jsView file

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = dist/logs-server.js matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/logs-server.jsView on unpkg

hooks/conversation.mjsView file

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = hooks/conversation.mjs matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/conversation.mjsView on unpkg

Source & flagged code

27 flagged · loading source

dist/tui/index.jsView file

143// src/hook-health.ts L144: import { execFileSync } from "child_process"; L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/tui/index.jsView on unpkg · L143

897try { L898: const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim(); L899: return prof ? [prof] : [];

High

Shell

Package source references shell execution.

dist/tui/index.jsView on unpkg · L897

13const pinned = pinnedNode.replace(/'/g, `'\\''`); L14: return `#!/bin/sh L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`. ... L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a L44: # hook's stderr to the person using it. Redirecting the group catches both. ... L143: // src/hook-health.ts L144: import { execFileSync } from "child_process"; L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs"; ... L149: const launcher = join3(hooksDir(), LAUNCHER_NAME); L150: if (process.platform === "win32") { L151: const ok = existsSync2(process.execPath);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tui/index.jsView on unpkg · L13

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui/index.jsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/tui/index.jsView on unpkg · L13

dist/audit/index.jsView file

1527var DANGEROUS_PATTERNS = [ L1528: { pattern: /eval\s*\(/, label: "eval() \u2014 arbitrary code execution" }, L1529: { pattern: /\bexec\s*\(/, label: "exec() \u2014 arbitrary code execution" },

High

Eval

Package source references dynamic code evaluation.

dist/audit/index.jsView on unpkg · L1527

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = dist/audit/index.js matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/index.jsView on unpkg

dist/cli-launch.jsView file

41try { L42: const req = createRequire(import.meta.url); L43: out.push(join(dirname(req.resolve(`@solongate/guard-${os_}-${cpu}/package.json`)), exe));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-launch.jsView on unpkg · L41

hooks/shield.mjsView file

286const { port, close } = await startProxy(upstream); L287: const child = spawn(cmd[0], cmd.slice(1), { L288: stdio: 'inherit', L289: env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` }, L290: shell: process.platform === 'win32',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

hooks/shield.mjsView on unpkg · L286

•matchType = normalized_sha256 matchedPackage = @solongate/proxy@0.89.83 matchedPath = hooks/shield.mjs matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/shield.mjsView on unpkg

hooks/guard.mjsView file

13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call. L14: * - API_URL defaults to https://api.solongate.com. L15: * - Enforcement is gated on the API key (the key identifies the project + ... L19: * L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW. L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs. ... L24: import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, rmdirSync, openSync, readSync, closeSync, accessS... L25: import { spawn, spawnSync } from 'node:child_process'; L26: import { resolve, join, dirname, isAbsolute } from 'node:path'; ... L28: import { createRequire } from 'node:module'; L29: import { gunzipSync } from 'node:zlib'; L30:

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

hooks/guard.mjsView on unpkg · L13

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

hooks/guard.mjsView on unpkg · L13

hooks/guard.bundled.mjsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

hooks/guard.bundled.mjsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/guard.bundled.mjsView on unpkg

dist/global-install.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-install.jsView on unpkg · L7

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/global-install.jsView on unpkg

dist/lib.jsView file

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/lib.jsView on unpkg · L42

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

dist/lib.jsView on unpkg

dist/index.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L43

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

dist/global-install.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-install.js#virtual:string-array:round1View on unpkg

dist/commands/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/index.jsView on unpkg

dist/logs-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/logs-server.jsView on unpkg

hooks/conversation.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/conversation.mjsView on unpkg

Source & flagged code

27 flagged

dist/tui/index.jsView file

Lines 1-33javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res) => function __init() {

4 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

5};

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

11// src/hook-launcher.ts

12function launcherScript(pinnedNode) {

13 const pinned = pinnedNode.replace(/'/g, `'\\''`);

14 return `#!/bin/sh

15# SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tui/index.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/tui/index.jsView on unpkg · L13

16#

17# Finds a working node and execs the hook with it. Do not edit: a reinstall

18# overwrites this file, and on macOS it is chflags-locked besides.

19#

20# The reason it exists rather than the hook naming a node directly: an absolute

21# node path recorded at install time is a Homebrew Cellar path or an nvm version

22# directory, and both are deleted by a routine upgrade. The hook then could not

23# start, nothing was enforced, nothing was logged, and every check still said

24# the guard was registered \u2014 because it was.

26set -u

28script="\${1:-}"

29[ -n "$script" ] || { echo "solongate: launcher called with no hook script" >&2; exit 1; }

30shift

32hook=\${script##*/}

33home=\${HOME:-~}

Lines 123-163javascript

123 ];

124 NODE_GLOBS = [

125 // nvm. NVM_DIR is exported by its own shell hook, which a non-interactive

126 // hook environment does not run, so the default location is tried too.

127 '"${NVM_DIR:-}"/versions/node/*/bin/node',

128 '"$home"/.nvm/versions/node/*/bin/node',

129 // fnm, both the XDG location and the macOS Application Support one.

130

Lines 877-917javascript

877 } catch {

878 }

879 try {

880 removeOpencodeGuard(p);

881 } catch {

882 }

883 if (!existsSync3(p.settingsPath)) return { ok: true

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui/index.jsView on unpkg

dist/audit/index.jsView file

Lines 1507-1547javascript

1507 title,

1508 status: "PARTIAL",

1509 evidence,

1510 summary: `${totalIssues} risky package install(s) \u2014 low frequency.`,

1511 details: "Some packages installed without pinned versions, but at low frequency. Review and pin specific versions.",

dist/cli-launch.jsView file

Lines 21-61javascript

21 "doctor",

22 "watch",

23 "alerts",

24 "webhooks",

25 "dataroom"

26 // The `browser` command is gone on purpose: the agent installs, arranges and

27 // restarts itself, and everything a person manages is on the dashboard. There

hooks/shield.mjsView file

Lines 266-299javascript

266 if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain' });

267 res.end('shield upstream error');

268 });

269 upReq.end(body);

270

hooks/guard.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * SolonGate Cloud Policy Guard Hook (PreToolUse) — GLOBAL system-wide enforcement.

4 *

5 * This is the cloud twin of the air-gapped guard hook. Identical decision engine

6 * (OPA WASM, NIST SP 800-207 PDP, fail-closed), but the policy + compiled WASM

7 * are fetched from SolonGate Cloud and authenticated with the project API key.

8 * Installed globally (~/.claude/settings.json) it intercepts EVERY tool call from

9 * EVERY Claude Code session on the machine — exactly like the air-gapped product,

10 * just sourced from the cloud instead of a local docker API.

hooks/guard.bundled.mjsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

hooks/guard.bundled.mjsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/guard.bundled.mjsView on unpkg

dist/global-install.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-install.jsView on unpkg · L7

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/global-install.jsView on unpkg

dist/lib.jsView file

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/lib.jsView on unpkg · L42

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

dist/lib.jsView on unpkg

dist/index.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L43

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

dist/global-install.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-install.js#virtual:string-array:round1View on unpkg

dist/commands/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/index.jsView on unpkg

dist/logs-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/logs-server.jsView on unpkg

hooks/conversation.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/conversation.mjsView on unpkg

@solongate/proxy@0.89.87

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code