@solongate/proxy@0.90.26
AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis package is not malicious at npm install time because it has no install lifecycle hook. Its explicit setup nevertheless creates a persistent, locked, cross-agent monitoring surface that can export conversation content, so it warrants a warning.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user installs or repairs the SolonGate guard through its CLI or interface, then uses an affected AI tool.
Impact
The package can observe tool activity and send user prompts or agent replies to its configured service; hooks are subsequently protected with OS-level locks.
Mechanism
Global AI-agent hook registration with cloud audit and conversation reporting.
AI rationale
This package is not malicious at npm install time because it has no install lifecycle hook. Its explicit setup nevertheless creates a persistent, locked, cross-agent monitoring surface that can export conversation content, so it warrants a warning.
Evidence
dist/global-install.jshooks/conversation.mjs~/.codex/hooks.json~/.solongate/cloud-guard.json~/.solongate/hooks/conversation.mjs~/.config/opencode/plugins/solongate.js~/.claude/settings.json
Network endpoints1
api.solongate.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The global setup writes command hooks into Codex for every supported hook event.
- The installed conversation hook sends prompt and reply text to the SolonGate API using a stored API key.
- Setup locks protection files after registering hooks, making removal or modification harder.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- The hook installation path is reached through the interactive CLI or its repair/update flows, not package installation.
- The package checks for an interactive human terminal before CLI management actions.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
26 flagged · loading sourcedist/tui/index.jsView file
143// src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
High
Child Process
Package source references child process execution.
dist/tui/index.jsView on unpkg · L143897try {
L898: const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
L899: return prof ? [prof] : [];
High
13const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LAUNCHER_NAME);
L150: if (process.platform === "win32") {
L151: const ok = existsSync2(process.execPath);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/tui/index.jsView on unpkg · L13•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/tui/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tui/index.jsView on unpkg13const pinned = pinnedNode.replace(/'/g, `'\\''`);
L14: return `#!/bin/sh
L15: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L42: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L43: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L44: # hook's stderr to the person using it. Redirecting the group catches both.
...
L143: // src/hook-health.ts
L144: import { execFileSync } from "child_process";
L145: import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
...
L149: const launcher = join3(hooksDir(), LAUNCHER_NAME);
L150: if (process.platform === "win32") {
L151: const ok = existsSync2(process.execPath);
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/tui/index.jsView on unpkg · L13dist/cli-launch.jsView file
41try {
L42: const req = createRequire(import.meta.url);
L43: out.push(join(dirname(req.resolve(`@solongate/guard-${os_}-${cpu}/package.json`)), exe));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli-launch.jsView on unpkg · L41hooks/shield.mjsView file
286const { port, close } = await startProxy(upstream);
L287: const child = spawn(cmd[0], cmd.slice(1), {
L288: stdio: 'inherit',
L289: env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
L290: shell: process.platform === 'win32',
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
hooks/shield.mjsView on unpkg · L286•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/shield.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/shield.mjsView on unpkgdist/lib.jsView file
42try {
L43: JSON.parse(str);
L44: return true;
...
L2982: // Keys in mapping nodes earlier in the sequence override keys specified in
L2983: // later mapping nodes. -- http://yaml.org/type/merge.html
L2984: addToJSMap(ctx, map) {
...
L4515: function shouldWarn(deprecation) {
L4516: const env = typeof process !== "undefined" && process.env || {};
L4517: if (deprecation) {
...
L5075: handle: "!!",
L5076: prefix: "tag:private.yaml.org,2002:"
L5077: }]
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
dist/lib.jsView on unpkg · L4242Trigger-reachable credential exfiltration chain: manifest.main -> dist/lib.js
L42: try {
L43: JSON.parse(str);
L44: return true;
...
L2982: // Keys in mapping nodes earlier in the sequence override keys specified in
L2983: // later mapping nodes. -- http://yaml.org/type/merge.html
L2984: addToJSMap(ctx, map) {
...
L4515: function shouldWarn(deprecation) {
L4516: const env = typeof process !== "undefined" && process.env || {};
L4517: if (deprecation) {
...
L5075: handle: "!!",
L5076: prefix: "tag:private.yaml.org,2002:"
L5077: }]
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/lib.jsView on unpkg · L42•Trigger-reachable fixed external POST callback chain: manifest.main -> dist/lib.js
arg = JSON.stringify(arg, null, ph.width ? parseInt(ph.width) : 0);
if (!ctx) return JSON.stringify(this);
return JSON.stringify(jsKey);
if (!ctx || !ctx.doc) return JSON.stringify(this);
if (!ctx) return JSON.stringify(this);
if (!(item instanceof Pair)) throw new Error(`Map items must all be pairs; found ${JSON.stringify(item)} instead`);
// later mapping nodes. -- http://yaml.org/type/merge.html
const json = JSON.stringify(value);
High
Trigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
dist/lib.jsView on unpkg•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/lib.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib.jsView on unpkghooks/guard.mjsView file
13* - API_KEY (sg_live_…/sg_test_…) from env/.env, attached to every API call.
L14: * - API_URL defaults to https://api.solongate.com.
L15: * - Enforcement is gated on the API key (the key identifies the project +
...
L19: *
L20: * Exit code 2 = BLOCK, exit code 0 = ALLOW.
L21: * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
...
L24: import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, rmdirSync, openSync, readSync, closeSync, accessS...
L25: import { spawn, spawnSync } from 'node:child_process';
L26: import { resolve, join, dirname, isAbsolute } from 'node:path';
...
L28: import { createRequire } from 'node:module';
L29: import { gunzipSync } from 'node:zlib';
L30:
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
hooks/guard.mjsView on unpkg · L13•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/guard.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/guard.mjsView on unpkghooks/guard.bundled.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
!== "string" || typeof data.sha256 !== "string")
return;
const buf = buffer.from(data.content, "base64");
if (createhash("sha256").update(buf).digest("hex") !== data.sha256)
return;
const text = buf.tostring("utf-8");
if (!text.startswith("#!/usr/bin/env node") || text.length < minlen || !text.includes(marker))
return;
const hooksdir = join(resolve(homedir(), ".solongate"), "hooks");
const tmp = join(hooksdir, "." + filename + ".tmp");
writefilesync(tmp, text);
try {
chmodsync(join(hooksdir, filename), 420);
} catch {
}
renamesync(tmp, join(hooksdir, filename));
} catch {
}
}
function installedhookversion(filename) {
try {
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
hooks/guard.bundled.mjsView on unpkg•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/guard.bundled.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/guard.bundled.mjsView on unpkgdist/global-install.jsView file
7Cross-file remote execution chain: dist/global-install.js spawns hooks/guard.bundled.mjs; helper contains network access plus dynamic code execution.
L7: import { createInterface } from "readline";
L8: import { execFileSync as execFileSync2, spawn } from "child_process";
L9:
...
L41: const pinned = pinnedNode.replace(/'/g, `'\\''`);
L42: return `#!/bin/sh
L43: # SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
...
L70: # SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
L71: # not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
L72: # hook's stderr to the person using it. Redirecting the group catches both.
...
L140: import { homedir } from "os";
L141: var sgDir = () => join(homedir(), ".solongate")
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/global-install.jsView on unpkg · L7•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/global-install.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/global-install.jsView on unpkgdist/index.jsView file
43Trigger-reachable persistence chain: manifest.exports -> dist/index.js
L43: try {
L44: JSON.parse(str);
L45: return true;
...
L2983: // Keys in mapping nodes earlier in the sequence override keys specified in
L2984: // later mapping nodes. -- http://yaml.org/type/merge.html
L2985: addToJSMap(ctx, map) {
...
L4516: function shouldWarn(deprecation) {
L4517: const env = typeof process !== "undefined" && process.env || {};
L4518: if (deprecation) {
...
L5076: handle: "!!",
L5077: prefix: "tag:private.yaml.org,2002:"
L5078: }]
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L43•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkgdist/global-install.js#virtual:string-array:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/global-install.js#virtual:string-array:round1View on unpkgdist/commands/index.jsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/commands/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/index.jsView on unpkgdist/audit/index.jsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/audit/index.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/audit/index.jsView on unpkgdist/logs-server.jsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = dist/logs-server.js
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/logs-server.jsView on unpkghooks/audit.mjsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/audit.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/audit.mjsView on unpkghooks/conversation.mjsView file
•matchType = normalized_sha256
matchedPackage = @solongate/proxy@0.90.65
matchedPath = hooks/conversation.mjs
matchedIdentity = npm:QHNvbG9uZ2F0ZS9wcm94eQ:0.90.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
hooks/conversation.mjsView on unpkgFindings
24 High5 Medium5 Low
HighChild Processdist/tui/index.js
HighShelldist/tui/index.js
HighSame File Env Network Executionhooks/shield.mjs
HighCredential Exfiltrationdist/lib.js
HighSandbox Evasion Gated Capabilitydist/tui/index.js
HighCloud Metadata Accesshooks/guard.mjs
HighExternal Ai Agent Control Surface Mutationhooks/guard.bundled.mjs
HighCross File Remote Execution Contextdist/global-install.js
HighTrigger Reachable Credential Exfiltrationdist/lib.js
HighTrigger Reachable Persistencedist/index.js
HighTrigger Reachable External Post Callbackdist/lib.js
HighSemantic Analysis Limiteddist/global-install.js#virtual:string-array:round1
HighKnown Malware Source Similarityhooks/guard.mjs
HighKnown Malware Source Similaritydist/global-install.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/tui/index.js
HighKnown Malware Source Similarityhooks/guard.bundled.mjs
HighKnown Malware Source Similaritydist/commands/index.js
HighKnown Malware Source Similarityhooks/shield.mjs
HighKnown Malware Source Similaritydist/audit/index.js
HighKnown Malware Source Similaritydist/logs-server.js
HighKnown Malware Source Similarityhooks/audit.mjs
HighKnown Malware Source Similaritydist/lib.js
HighKnown Malware Source Similarityhooks/conversation.mjs
MediumDynamic Requiredist/cli-launch.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/tui/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @solongate/proxy@0.90.26.
See all versions of @solongate/proxy for other recorded verdicts.
- Review the evidence and your use of @solongate/proxy@0.90.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.