registry / @wwkit/sshproxy / 1.0.7

@wwkit/sshproxy@1.0.7

SOCKS5 proxy manager (client SSH tunnel / server remote), CLI + web UI

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package automatically starts SSH setup and a background web server. When SSH environment configuration is present, it creates a key, adds remote SSH access, edits the user's SSH config, and starts autossh.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation.

Impact

Creates remote-account access and local SSH and background-process persistence without an explicit user command.

Mechanism

Automatic SSH key deployment and persistent proxy setup.

Attack narrative

The automatic postinstall invokes tunnel setup. Tunnel startup runs initialization, which generates or reuses a local SSH key, connects using configured SSH credentials, and appends that public key to the remote account's authorized_keys. It also appends a local SSH configuration entry, may install autossh through a package manager, starts the tunnel, and launches a detached web server. This occurs on install rather than through an explicit setup command.

AI rationale

This is concrete install-time remote-access and persistence behavior affecting local and remote SSH control surfaces. Existing credentials gate success but do not provide meaningful consent for this automatic lifecycle action.

Evidence

package.jsonscripts/postinstall.jssrc/ProxyManager.jssrc/init.jssrc/sshkey.js~/.config/sshproxy/config.json5~/.ssh/id_ed25519~/.ssh/id_ed25519.pub~/.ssh/config~/.ssh/authorized_keys~/.local/share/sshproxy/proxy.pid

@wwkit/sshproxy@1.0.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code