registry  /  @the-next-ai/ai-gateway  /  1.0.8

@the-next-ai/ai-gateway@1.0.8

⚠ Under review

TypeScript Fastify AI protocol gateway for OpenAI, Anthropic, Gemini, MCP and agent workflows.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 624 KB of source, external domains: api.anthropic.com, api.openai.com, auth.openai.com, chatgpt.com, gateway.local, generativelanguage.googleapis.com

Source & flagged code

4 flagged · loading source
dist/index.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @the-next-ai/ai-gateway@1.0.4 matchedIdentity = npm:QHRoZS1uZXh0LWFpL2FpLWdhdGV3YXk:1.0.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg
6`);return e.write(` L7: `),!0}catch{return!1}}function q_(e){return Zl.includes(e)}function z(e,n){return e.code(400).send({error:{message:n}})}function vn(e){return e.code(405).send({error:{message:I_}})... L8: `)})}function mu(e,n){let t={accept:"application/json",...e.headers};return n&&(t["content-type"]=n),e.apiKey&&(t[e.apiKeyHeader]=e.apiKey),t}function pf(e,n){let t=e.trim();if(!t)...
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6
1"use strict";var Lk=Object.create;var El=Object.defineProperty;var Dk=Object.getOwnPropertyDescriptor;var Uk=Object.getOwnPropertyNames;var Fk=Object.getPrototypeOf,$k=Object.proto... L2: `)}function xe(e,n){let t=e[n.toLowerCase()],r=x(typeof t=="string"||Array.isArray(t)?t:void 0);return r&&r.trim()||void 0}function o_(e){return nt(e)&&nt(e.data)?e.data:e}function... ... L6: `);return e.write(` L7: `),!0}catch{return!1}}function q_(e){return Zl.includes(e)}function z(e,n){return e.code(400).send({error:{message:n}})}function vn(e){return e.code(405).send({error:{message:I_}})... L8: `)})}function mu(e,n){let t={accept:"application/json",...e.headers};return n&&(t["content-type"]=n),e.apiKey&&(t[e.apiKeyHeader]=e.apiKey),t}function pf(e,n){let t=e.trim();if(!t)...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1
1"use strict";var Lk=Object.create;var El=Object.defineProperty;var Dk=Object.getOwnPropertyDescriptor;var Uk=Object.getOwnPropertyNames;var Fk=Object.getPrototypeOf,$k=Object.proto... L2: `)}function xe(e,n){let t=e[n.toLowerCase()],r=x(typeof t=="string"||Array.isArray(t)?t:void 0);return r&&r.trim()||void 0}function o_(e){return nt(e)&&nt(e.data)?e.data:e}function... ... L6: `);return e.write(` L7: `),!0}catch{return!1}}function q_(e){return Zl.includes(e)}function z(e,n){return e.code(400).send({error:{message:n}})}function vn(e){return e.code(405).send({error:{message:I_}})... L8: `)})}function mu(e,n){let t={accept:"application/json",...e.headers};return n&&(t["content-type"]=n),e.apiKey&&(t[e.apiKeyHeader]=e.apiKey),t}function pf(e,n){let t=e.trim();if(!t)...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Findings

1 Critical3 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings