registry / @suveren/gateway / 0.3.14

@suveren/gateway@0.3.14

⚠ Under review

Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 573 KB of source, external domains: 0.0.0.0, 127.0.0.1, api.github.com, api.groq.com, api.openai.com, api.together.xyz, ghcr.io, openrouter.ai, reactjs.org, registry.npmjs.org, www.humanagencyprotocol.org, www.suveren.ai, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1-31json

2 "name": "@suveren/gateway",

3 "version": "0.3.14",

4 "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",

5 "type": "module",

6 "main": "server.js",

7 "bin": {

8 "suveren-gateway": "bin/suveren-gateway.js"

9 },

10 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L10

11 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 },

13 "files": [

14 "bin",

15 "dist",

16 "scripts",

17 "content",

18 "profiles",

19 "server.js",

20 "README.md"

21 ],

22 "engines": {

23 "node": ">=20"

24 },

25 "dependencies": {

26 "@hap/core": "npm:@humanagencyp/hap-core@^0.6.1",

27 "@hpke/core": "^1.9.0",

28 "express": "^4.18.0",

29 "http-proxy-middleware": "^3.0.0",

30 "@modelcontextprotocol/sdk": "^1.12.1",

31 "zod": "^3.22.0"

bin/suveren-gateway.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * suveren-gateway CLI — wraps `node server.js` with start/stop/status/logs.

4 *

5 * Foreground by default (Ctrl+C stops). Pass --detach for a daemonized

6 * run that writes a PID file and a log file under ~/.suveren/.

7 *

8 * Cross-platform: macOS, Linux, Windows. Uses os.homedir() everywhere

9 * (no $HOME dependency). Process-existence checks via process.kill(pid, 0)

10 * which Node implements consistently across platforms.

11 */

dist/mcp-server/http.mjsView file

Lines 2049-2089javascript

2049 }

2050 running = /* @__PURE__ */ new Map();

2051 onToolsChanged = null;

2052 /**

2053 * Register a callback invoked when the tool set changes

2054 * (integration started, stopped, or crashed).

2055 */

2056 setOnToolsChanged(cb) {

dist/ui/fonts/Inter-Medium.woff2View file

•path = dist/ui/fonts/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 114348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/fonts/Inter-Medium.woff2View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/suveren-gateway.jsView file

12L13: import { spawn } from 'node:child_process'; L14: import { existsSync, mkdirSync, openSync, readFileSync, writeFileSync, unlinkSync, statSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/suveren-gateway.jsView on unpkg · L12

187// Stream new lines as they arrive. L188: const proc = spawn(platform() === 'win32' ? 'powershell' : 'tail', L189: platform() === 'win32'

High

Shell

Package source references shell execution.

bin/suveren-gateway.jsView on unpkg · L187

74const out = openSync(LOG_FILE, 'a'); L75: const child = spawn(process.execPath, [SERVER_ENTRY], { L76: detached: true, L77: stdio: ['ignore', out, out], L78: env: process.env, L79: }); ... L83: console.log(``); L84: console.log(` → Open in your browser: http://localhost:${SUVEREN_PORT}`); L85: console.log(``);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/suveren-gateway.jsView on unpkg · L74

dist/mcp-server/http.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @suveren/gateway@0.3.9 matchedIdentity = npm:QHN1dmVyZW4vZ2F0ZXdheQ:0.3.9 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp-server/http.mjsView on unpkg

2069try { L2070: execSync(`npm install --no-fund --no-audit ${npmPackage}`, { L2071: cwd: INTEGRATIONS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/mcp-server/http.mjsView on unpkg · L2069

dist/ui/fonts/Inter-Medium.woff2View file

•path = dist/ui/fonts/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 114348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/fonts/Inter-Medium.woff2View on unpkg

Findings

2 Critical6 High4 Medium4 Low

CriticalManifest Confusionpackage.json

CriticalPrevious Version Dangerous Deltadist/mcp-server/http.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/suveren-gateway.js

HighShellbin/suveren-gateway.js

HighSame File Env Network Executionbin/suveren-gateway.js

HighRuntime Package Installdist/mcp-server/http.mjs

HighShips High Entropy Blobdist/ui/fonts/Inter-Medium.woff2

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 1-31json

2 "name": "@suveren/gateway",

3 "version": "0.3.14",

4 "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",

5 "type": "module",

6 "main": "server.js",

7 "bin": {

8 "suveren-gateway": "bin/suveren-gateway.js"

9 },

10 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L10

11 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 },

13 "files": [

14 "bin",

15 "dist",

16 "scripts",

17 "content",

18 "profiles",

19 "server.js",

20 "README.md"

21 ],

22 "engines": {

23 "node": ">=20"

24 },

25 "dependencies": {

26 "@hap/core": "npm:@humanagencyp/hap-core@^0.6.1",

27 "@hpke/core": "^1.9.0",

28 "express": "^4.18.0",

29 "http-proxy-middleware": "^3.0.0",

30 "@modelcontextprotocol/sdk": "^1.12.1",

31 "zod": "^3.22.0"

bin/suveren-gateway.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * suveren-gateway CLI — wraps `node server.js` with start/stop/status/logs.

4 *

5 * Foreground by default (Ctrl+C stops). Pass --detach for a daemonized

6 * run that writes a PID file and a log file under ~/.suveren/.

7 *

8 * Cross-platform: macOS, Linux, Windows. Uses os.homedir() everywhere

9 * (no $HOME dependency). Process-existence checks via process.kill(pid, 0)

10 * which Node implements consistently across platforms.

11 */

dist/mcp-server/http.mjsView file

Lines 2049-2089javascript

2049 }

2050 running = /* @__PURE__ */ new Map();

2051 onToolsChanged = null;

2052 /**

2053 * Register a callback invoked when the tool set changes

2054 * (integration started, stopped, or crashed).

2055 */

2056 setOnToolsChanged(cb) {

dist/ui/fonts/Inter-Medium.woff2View file

•path = dist/ui/fonts/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 114348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/fonts/Inter-Medium.woff2View on unpkg

Lines 54-94javascript

54 printHelp(); break;

55 default:

56 console.error(`Unknown command: ${cmd}\n`);

57 printHelp();

58 process.exit(2);

59}

61// ─── Implementations ────────────────────────────────────────────────────

63async function start(args) {

64 const detach = args.includes('--detach') || args.includes('-d');

66 if (await isAlreadyRunning()) {

67 console.error(`suveren-gateway is already running (pid ${readPid()}). Use \`suveren-gateway stop\` first or \`suveren-gateway restart\`.`);

68 process.exit(1);

69 }

71 ensureDataDir();

73 if (detach) {

74 const out = openSync(LOG_FILE, 'a');

75 const child = spawn(process.execPath, [SERVER_ENTRY], {

76 detached: true,

77 stdio: ['ignore', out, out],

78 env: process.env,

79 });

80 writeFileSync(PID_FILE, String(child.pid), 'utf8');

81 child.unref();

82 console.log(`suveren-gateway started (pid ${child.pid})`);

83 console.log(``);

84 console.log(` → Open in your browser: http://localhost:${SUVEREN_PORT}`);

85 console.log(``);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/suveren-gateway.jsView on unpkg · L74

86 console.log(` Logs: ${LOG_FILE}`);

87 console.log(` Stop: suveren-gateway stop`);

88 } else {

89 // Foreground — replace this CLI process with server.js's stdio.

90 console.log(`Starting suveren-gateway… open http://localhost:${SUVEREN_PORT} once "up" appears below. Ctrl+C to stop.`);

91 console.log(``);

92 const child = spawn(process.execPath, [SERVER_ENTRY], {

93 stdio: 'inherit',

94 env: process.env,