Loading npm security reports…

@wwkit/sshproxy@1.0.8: Malicious npm security report (Block) | LPM Firewall

registry / @wwkit/sshproxy / 1.0.8

@wwkit/sshproxy@1.0.8

SOCKS5 proxy manager (client SSH tunnel / server remote), CLI + web UI

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Installing the package automatically creates SSH access material and attempts to establish a persistent SSH SOCKS tunnel. With configured SSH credentials, it authorizes the generated key on the remote host and starts background services.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

It changes local SSH configuration, can grant persistent access to a configured remote account, installs system software, and starts background processes without an explicit user command.

Mechanism

Automatic SSH key provisioning, remote authorized-key mutation, and autossh tunnel startup

Attack narrative

On installation, postinstall invokes the tunnel command. That path creates a local SSH key before validating connection settings. If supplied SSH credentials work, it adds that key to the remote account's authorized_keys, appends a dynamic-forward entry to local SSH configuration, may install autossh through a system package manager, and launches a background autossh process. The same lifecycle script also starts a local web service.

AI rationale

This is unconsented install-time mutation of SSH credentials, local SSH configuration, remote authorized keys, system packages, and background processes. The behavior is concrete and reachable from postinstall, so it is malicious install-hook abuse.

Evidence

scripts/postinstall.jssrc/init.jssrc/sshkey.jssrc/ProxyManager.jsbin/index.js~/.config/sshproxy/config.json5~/.ssh/id_ed25519

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/sshkey.jsView file

2import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sshkey.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> src/index.js -> src/SshCommands.js -> src/sshkey.js L2: import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sshkey.jsView on unpkg · L2

2Trigger-reachable persistence chain: manifest.main -> src/index.js -> src/SshCommands.js -> src/sshkey.js L2: import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sshkey.jsView on unpkg · L2

src/OSystem.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/OSystem.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9116449b1da25d48 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/OSystem.jsView on unpkg

src/ProxyManager.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/ProxyManager.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ProxyManager.jsView on unpkg

bin/index.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = bin/index.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 26-51json

26 "proxy",

27 "ssh",

28 "autossh",

29 "chrome"

30 ],

31 "license": "MIT",

32 "publishConfig": {

33 "registry": "https://registry.npmjs.org/",

34 "access": "public"

35 },

36 "dependencies": {

37 "dotenv": "^16.4.5",

38 "json5": "^2.2.3",

39 "ssh2": "^1.16.0",

40 "@wwkit/shared": "1.0.6"

41 },

42 "devDependencies": {

43 "jest": "^29.7.0"

44 },

45 "scripts": {

46 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --no-cache tests/unit",

48 "test:all": "node --experimental-vm-modules node_modules/jest/bin/jest.js --no-cache tests/unit",

49 "release": "node ../../packages/shared/bin/release-pkg.js"

50 }

51}

src/sshkey.jsView file

Lines 1-22javascript

1import fs from 'node:fs'

2import path from 'node:path'

3import { spawnSync } from 'node:child_process'

4

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sshkey.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/OSystem.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/OSystem.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9116449b1da25d48 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/OSystem.jsView on unpkg

src/ProxyManager.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/ProxyManager.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ProxyManager.jsView on unpkg

bin/index.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = bin/index.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index.jsView on unpkg