registry  /  @the-next-ai/ai-gateway  /  1.0.6

@the-next-ai/ai-gateway@1.0.6

⚠ Under review

TypeScript Fastify AI protocol gateway for OpenAI, Anthropic, Gemini, MCP and agent workflows.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 623 KB of source, external domains: api.anthropic.com, api.openai.com, auth.openai.com, chatgpt.com, gateway.local, generativelanguage.googleapis.com

Source & flagged code

4 flagged · loading source
dist/index.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @the-next-ai/ai-gateway@1.0.4 matchedIdentity = npm:QHRoZS1uZXh0LWFpL2FpLWdhdGV3YXk:1.0.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg
6`);return e.write(` L7: `),!0}catch{return!1}}function GR(e){return Ql.includes(e)}function z(e,n){return e.code(400).send({error:{message:n}})}function vn(e){return e.code(405).send({error:{message:PR}})... L8: `)})}function gu(e,n){let t={accept:"application/json",...e.headers};return n&&(t["content-type"]=n),e.apiKey&&(t[e.apiKeyHeader]=e.apiKey),t}function lf(e,n){let t=e.trim();if(!t)...
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6
1"use strict";var qk=Object.create;var xl=Object.defineProperty;var Bk=Object.getOwnPropertyDescriptor;var Lk=Object.getOwnPropertyNames;var Dk=Object.getPrototypeOf,Uk=Object.proto... L2: `)}function Pe(e,n){let t=e[n.toLowerCase()],r=x(typeof t=="string"||Array.isArray(t)?t:void 0);return r&&r.trim()||void 0}function tR(e){return nt(e)&&nt(e.data)?e.data:e}function... ... L6: `);return e.write(` L7: `),!0}catch{return!1}}function GR(e){return Ql.includes(e)}function z(e,n){return e.code(400).send({error:{message:n}})}function vn(e){return e.code(405).send({error:{message:PR}})... L8: `)})}function gu(e,n){let t={accept:"application/json",...e.headers};return n&&(t["content-type"]=n),e.apiKey&&(t[e.apiKeyHeader]=e.apiKey),t}function lf(e,n){let t=e.trim();if(!t)...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1
1"use strict";var qk=Object.create;var xl=Object.defineProperty;var Bk=Object.getOwnPropertyDescriptor;var Lk=Object.getOwnPropertyNames;var Dk=Object.getPrototypeOf,Uk=Object.proto... L2: `)}function Pe(e,n){let t=e[n.toLowerCase()],r=x(typeof t=="string"||Array.isArray(t)?t:void 0);return r&&r.trim()||void 0}function tR(e){return nt(e)&&nt(e.data)?e.data:e}function... ... L6: `);return e.write(` L7: `),!0}catch{return!1}}function GR(e){return Ql.includes(e)}function z(e,n){return e.code(400).send({error:{message:n}})}function vn(e){return e.code(405).send({error:{message:PR}})... L8: `)})}function gu(e,n){let t={accept:"application/json",...e.headers};return n&&(t["content-type"]=n),e.apiKey&&(t[e.apiKeyHeader]=e.apiKey),t}function lf(e,n){let t=e.trim();if(!t)...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Findings

1 Critical3 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings