Loading npm security reports…

@wwkit/sshproxy@1.0.6: Malicious npm security report (Block) | LPM Firewall

registry / @wwkit/sshproxy / 1.0.6

@wwkit/sshproxy@1.0.6

SOCKS5 proxy manager (client SSH tunnel / server remote), CLI + web UI

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package automatically attempts to establish and persist an SSH SOCKS tunnel. It can create SSH credentials, add remote access authorization, edit local SSH configuration, install autossh, and launch a local web control server.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

A package install can grant persistent SSH access to a configured remote host and modify the installing user's system without an explicit command.

Mechanism

Automatic SSH key provisioning, remote authorized-key installation, and detached tunnel/server startup.

Attack narrative

On installation, postinstall invokes the tunnel command. If SSH settings are available from the environment or existing configuration, startup generates a local key, connects to the configured host, appends that key to the remote authorized_keys file, modifies local SSH configuration, may install autossh, and starts a detached tunnel. The hook also starts a local web server. These security-sensitive changes are automatic rather than initiated by an explicit CLI request.

AI rationale

The package performs persistent remote-access and system-configuration actions from postinstall. The behavior is concrete, automatic, and exceeds safe package setup.

Evidence

package.jsonscripts/postinstall.jssrc/init.jssrc/sshkey.jssrc/ProxyManager.js~/.config/sshproxy/config.json5~/.ssh/id_ed25519~/.ssh/id_ed25519.pub

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/sshkey.jsView file

2import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sshkey.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> src/index.js -> src/SshCommands.js -> src/sshkey.js L2: import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sshkey.jsView on unpkg · L2

2Trigger-reachable persistence chain: manifest.main -> src/index.js -> src/SshCommands.js -> src/sshkey.js L2: import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sshkey.jsView on unpkg · L2

src/OSystem.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.7 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/OSystem.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9116449b1da25d48 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @wwkit/sshproxy@1.0.7 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.7 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/OSystem.jsView on unpkg

src/ProxyManager.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.7 matchedPath = src/ProxyManager.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ProxyManager.jsView on unpkg

bin/index.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.7 matchedPath = bin/index.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 26-51json

26 "proxy",

27 "ssh",

28 "autossh",

29 "chrome"

30 ],

31 "license": "MIT",

32 "publishConfig": {

33 "registry": "https://registry.npmjs.org/",

34 "access": "public"

35 },

36 "dependencies": {

37 "dotenv": "^16.4.5",

38 "json5": "^2.2.3",

39 "ssh2": "^1.16.0",

40 "@wwkit/shared": "1.0.4"

41 },

42 "devDependencies": {

43 "jest": "^29.7.0"

44 },

45 "scripts": {

46 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --no-cache tests/unit",

48 "test:all": "node --experimental-vm-modules node_modules/jest/bin/jest.js --no-cache tests/unit",

49 "release": "node ../../packages/shared/bin/release-pkg.js"

50 }

51}

src/sshkey.jsView file

Lines 1-22javascript

1import fs from 'node:fs'

2import path from 'node:path'

3import { spawnSync } from 'node:child_process'

4

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sshkey.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/OSystem.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.7 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/OSystem.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9116449b1da25d48 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @wwkit/sshproxy@1.0.7 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.7 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/OSystem.jsView on unpkg

src/ProxyManager.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.7 matchedPath = src/ProxyManager.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ProxyManager.jsView on unpkg

bin/index.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.7 matchedPath = bin/index.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index.jsView on unpkg