@solongate/proxy@0.89.95
AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes real data-upload and remote-update capabilities after explicit user setup, but not an automatic install-time attack. This warrants a warning for dangerous agent-control and data-handling behavior rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs the interactive global guard setup and subsequently uses an enabled AI client.
Impact
Prompt and reply content can leave the machine, and the vendor can change the code executed on later tool calls.
Mechanism
Global AI-client hooks upload conversation data and self-update from a remote API.
AI rationale
The source establishes real data-upload and remote-update capabilities after explicit user setup, but not an automatic install-time attack. This warrants a warning for dangerous agent-control and data-handling behavior rather than a publish block.
Evidence
dist/global-install.jshooks/conversation.mjshooks/guard.mjs~/.claude/settings.json~/.codex/hooks.json~/.gemini/config/hooks.json~/.config/opencode/plugins/solongate.js~/.solongate/hooks/guard.mjs~/.solongate/hooks/conversation.mjs
Network endpoints1
api.solongate.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Its global setup registers command hooks across Claude, Codex, Antigravity, and OpenCode control surfaces.
- The conversation hook sends captured prompt and reply text to the vendor API after only pattern-based redaction.
- An installed guard periodically downloads hook content and atomically replaces local hook files.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle script.
- The global CLI requires an interactive human terminal before management commands run.
- Network traffic is directed to the package vendor’s configured API endpoint and uses its configured API key.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
27 flagged · loading sourcedist/tui/index.jsView file
143// src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
High
Child Process
Package source references child process execution.
dist/tui/index.jsView on unpkg · L143897try {
L898: const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
L899: return prof ? [prof] : [];
High
13const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LAUNCHER_NAME);
L150: if (process.platform === "win32") {
L151: const ok = existsSync2(process.execPath);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/tui/index.jsView on unpkg · L13•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = dist/tui/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tui/index.jsView on unpkg13const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LAUNCHER_NAME);
L150: if (process.platform === "win32") {
L151: const ok = existsSync2(process.execPath);
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/tui/index.jsView on unpkg · L13dist/audit/index.jsView file
1527var DANGEROUS_PATTERNS = [
L1528: { pattern: /eval\s*\(/, label: "eval() \u2014 arbitrary code execution" },
L1529: { pattern: /\bexec\s*\(/, label: "exec() \u2014 arbitrary code execution" },
High
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = dist/audit/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/audit/index.jsView on unpkgdist/cli-launch.jsView file
41try {
L42: const req = createRequire(import.meta.url);
L43: out.push(join(dirname(req.resolve(`@solongate/guard-${os_}-${cpu}/package.json`)), exe));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli-launch.jsView on unpkg · L41hooks/shield.mjsView file
286const { port, close } = await startProxy(upstream);
L287: const child = spawn(cmd[0], cmd.slice(1), {
L288: stdio: 'inherit',
L289: env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
L290: shell: process.platform === 'win32',
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
hooks/shield.mjsView on unpkg · L286•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = hooks/shield.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/shield.mjsView on unpkghooks/guard.mjsView file
13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call.
L14: * - API_URL defaults to https://api.solongate.com.
L15: * - Enforcement is gated on the API key (the key identifies the project +
...
L19: *
L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW.
L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
...
L24: import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, rmdirSync, openSync, readSync, closeSync, accessS...
L25: import { spawn, spawnSync } from 'node:child_process';
L26: import { resolve, join, dirname, isAbsolute } from 'node:path';
...
L28: import { createRequire } from 'node:module';
L29: import { gunzipSync } from 'node:zlib';
L30:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
hooks/guard.mjsView on unpkg · L1313* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call.
L14: * - API_URL defaults to https://api.solongate.com.
L15: * - Enforcement is gated on the API key (the key identifies the project +
...
L19: *
L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW.
L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
...
L24: import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, rmdirSync, openSync, readSync, closeSync, accessS...
L25: import { spawn, spawnSync } from 'node:child_process';
L26: import { resolve, join, dirname, isAbsolute } from 'node:path';
...
L28: import { createRequire } from 'node:module';
L29: import { gunzipSync } from 'node:zlib';
L30:
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
hooks/guard.mjsView on unpkg · L13•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = hooks/guard.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/guard.mjsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = 2b042aec1906047c
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @solongate/proxy@0.89.93
matchedPath = hooks/guard.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
shingleOverlap = 15
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
hooks/guard.mjsView on unpkghooks/guard.bundled.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
!== "string" || typeof data.sha256 !== "string")
return;
const buf = buffer.from(data.content, "base64");
if (createhash("sha256").update(buf).digest("hex") !== data.sha256)
return;
const text = buf.tostring("utf-8");
if (!text.startswith("#!/usr/bin/env node") || text.length < minlen || !text.includes(marker))
return;
const hooksdir = join(resolve(homedir(), ".solongate"), "hooks");
const tmp = join(hooksdir, "." + filename + ".tmp");
writefilesync(tmp, text);
try {
chmodsync(join(hooksdir, filename), 420);
} catch {
}
renamesync(tmp, join(hooksdir, filename));
} catch {
}
}
function installedhookversion(filename) {
try {
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
hooks/guard.bundled.mjsView on unpkg•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = hooks/guard.bundled.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/guard.bundled.mjsView on unpkgdist/global-install.jsView file
7Cross-file remote execution chain: dist/global-install.js spawns hooks/guard.bundled.mjs; helper contains network access plus dynamic code execution.
L7: import { createInterface } from "readline";
L8: import { execFileSync as execFileSync2, spawn } from "child_process";
L9:
...
L41: const pinned = pinnedNode.replace(/'/g, `'\\''`);
L42: return `#!/bin/sh
L43: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L70: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L71: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L72: # hook's stderr to the person using it. Redirecting the group catches both.
...
L140: import { homedir } from "os";
L141: var sgDir = () => join(homedir(), ".solongate")
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/global-install.jsView on unpkg · L7•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = dist/global-install.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/global-install.jsView on unpkgdist/lib.jsView file
42Trigger-reachable credential exfiltration chain: manifest.main -> dist/lib.js
L42: try {
L43: JSON.parse(str);
L44: return true;
...
L2982: // Keys in mapping nodes earlier in the sequence override keys specified in
L2983: // later mapping nodes. -- http://yaml.org/type/merge.html
L2984: addToJSMap(ctx, map) {
...
L4515: function shouldWarn(deprecation) {
L4516: const env = typeof process !== "undefined" && process.env || {};
L4517: if (deprecation) {
...
L5075: handle: "!!",
L5076: prefix: "tag:private.yaml.org,2002:"
L5077: }]
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/lib.jsView on unpkg · L42•Trigger-reachable fixed external POST callback chain: manifest.main -> dist/lib.js
arg = JSON.stringify(arg, null, ph.width ? parseInt(ph.width) : 0);
if (!ctx) return JSON.stringify(this);
return JSON.stringify(jsKey);
if (!ctx || !ctx.doc) return JSON.stringify(this);
if (!ctx) return JSON.stringify(this);
if (!(item instanceof Pair)) throw new Error(`Map items must all be pairs; found ${JSON.stringify(item)} instead`);
// later mapping nodes. -- http://yaml.org/type/merge.html
const json = JSON.stringify(value);
High
Trigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
dist/lib.jsView on unpkg•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = dist/lib.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib.jsView on unpkgdist/index.jsView file
43Trigger-reachable persistence chain: manifest.exports -> dist/index.js
L43: try {
L44: JSON.parse(str);
L45: return true;
...
L2983: // Keys in mapping nodes earlier in the sequence override keys specified in
L2984: // later mapping nodes. -- http://yaml.org/type/merge.html
L2985: addToJSMap(ctx, map) {
...
L4516: function shouldWarn(deprecation) {
L4517: const env = typeof process !== "undefined" && process.env || {};
L4518: if (deprecation) {
...
L5076: handle: "!!",
L5077: prefix: "tag:private.yaml.org,2002:"
L5078: }]
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L43•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = dist/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkgdist/global-install.js#virtual:string-array:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/global-install.js#virtual:string-array:round1View on unpkgdist/commands/index.jsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = dist/commands/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/index.jsView on unpkgdist/logs-server.jsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = dist/logs-server.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/logs-server.jsView on unpkghooks/conversation.mjsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.89.93
matchedPath = hooks/conversation.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.89.93
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/conversation.mjsView on unpkgFindings
1 Critical24 High5 Medium4 Low
CriticalCredential Exfiltrationhooks/guard.mjs
HighChild Processdist/tui/index.js
HighShelldist/tui/index.js
HighEvaldist/audit/index.js
HighSame File Env Network Executionhooks/shield.mjs
HighSandbox Evasion Gated Capabilitydist/tui/index.js
HighCloud Metadata Accesshooks/guard.mjs
HighExternal Ai Agent Control Surface Mutationhooks/guard.bundled.mjs
HighCross File Remote Execution Contextdist/global-install.js
HighTrigger Reachable Credential Exfiltrationdist/lib.js
HighTrigger Reachable Persistencedist/index.js
HighTrigger Reachable External Post Callbackdist/lib.js
HighSemantic Analysis Limiteddist/global-install.js#virtual:string-array:round1
HighKnown Malware Source Similarityhooks/guard.mjs
HighKnown Malware Source Similaritydist/global-install.js
HighKnown Malware Source Similaritydist/tui/index.js
HighKnown Malware Source Similaritydist/commands/index.js
HighKnown Malware Source Similarityhooks/shield.mjs
HighKnown Malware Source Similaritydist/audit/index.js
HighKnown Malware Source Similaritydist/logs-server.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similarityhooks/conversation.mjs
HighKnown Malware Source Similarityhooks/guard.bundled.mjs
HighKnown Malware Source Similaritydist/lib.js
HighKnown Malware Source Fingerprint Signaturehooks/guard.mjs
MediumDynamic Requiredist/cli-launch.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/tui/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @solongate/proxy@0.89.95.
See all versions of @solongate/proxy for other recorded verdicts.
- Review the evidence and your use of @solongate/proxy@0.89.95 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.