Loading npm security reports…

dexrelay@0.1.77: Malicious npm security report (Block) | LPM Firewall

registry / dexrelay / 0.1.77

dexrelay@0.1.77

Mac-side CLI/bootstrap runtime for the DexRelay iPhone app.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

A global npm postinstall installs persistent background services. The network-exposed bridge accepts RPC requests that execute arbitrary commands, while the helper can fetch and run a remote installer.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global installation on macOS; then any network client reaching the bridge/helper.

Impact

Remote code execution as the installing user, persistent launch agents, and arbitrary file/process access.

Mechanism

Postinstall persistence plus unauthenticated network command execution and remote-script execution.

Attack narrative

On global macOS install, postinstall launches install.sh, which writes and enables persistent LaunchAgents. The resulting bridge listens on 0.0.0.0 and routes local/exec requests to child_process.spawn without authentication. A second unauthenticated helper on 0.0.0.0 can download install.sh from assets.dexrelay.app and execute it with the user environment. This creates an externally reachable command-execution and remote-payload path without a user command after npm installation.

Rationale

This is concrete install-time persistence combined with network-reachable arbitrary command execution and remote script execution. It exceeds a package-aligned local relay because these high-impact surfaces are automatically installed and exposed.

Evidence

package.jsonpostinstall.jsinstall.shbridge.jshelper.py$HOME/Library/LaunchAgents$HOME/.zprofile$HOME/Library/Application Support/DexRelay/runtime

Source & flagged code

6 flagged

package.jsonView file

Lines 25-65json

25 "install.sh",

26 "ios_testflight_common.py",

27 "og-dexrelay-2x.png",

28 "og-dexrelay.png",

29 "package.json",

30 "postinstall.js",

31 "prepare-ios-testflight.py",

32 "publish-ios-adhoc-ota.sh",

33 "quic-bridge-gateway.swift",

34 "rebuild-workspace-services.py",

35 "relay-connector.js",

36 "relay-server.js",

37 "run-ios-device.sh",

38 "run-ios-on-phone.sh",

39 "servicectl.py",

40 "services.registry.json",

41 "setup-guide.html",

42 "xcode-devdir.sh"

43 ],

44 "scripts": {

45 "postinstall": "node ./postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "test": "./dexrelay version"

47 },

48 "keywords": [

49 "dexrelay",

50 "codex",

51 "mac",

52 "ios",

53 "cli",

54 "bootstrap"

55 ],

56 "author": "DexRelay",

57 "license": "MIT",

58 "homepage": "https://github.com/dexrelay-app/dexrelay#readme",

59 "repository": {

60 "type": "git",

61 "url": "git+https://github.com/dexrelay-app/dexrelay.git"

62 },

63 "bugs": {

64 "url": "https://github.com/dexrelay-app/dexrelay/issues"

65 },

servicectl.pyView file

•path = servicectl.py kind = build_helper sizeBytes = 13291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

servicectl.pyView on unpkg

bridge.jsView file

•matchType = normalized_sha256 matchedPackage = dexrelay@0.1.75 matchedPath = bridge.js matchedIdentity = npm:ZGV4cmVsYXk:0.1.75 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = dexrelay@0.1.70 matchedIdentity = npm:ZGV4cmVsYXk:0.1.70 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge.jsView on unpkg

postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = dexrelay@0.1.75 matchedPath = postinstall.js matchedIdentity = npm:ZGV4cmVsYXk:0.1.75 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg