registry / AI-agent control-surface risk / ginka-role-fix

ginka-role-fix

Transparent local HTTPS fix for the GINKA API: rewrites chat-completions messages with role 'developer' to 'system' (api.ginka.cloud rejects 'developer').

This report shows the evidence for ginka-role-fix@0.1.0, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package performs unconsented privileged postinstall creation of a persistent TLS interception service and changes AI request content. Its scoped host and absence of exfiltration reduce scope but do not remove the concrete control-surface risk.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package globally with administrator privileges activates the postinstall hook.

Impact

All local traffic to the targeted API is redirected through a package-controlled CA and service; AI request semantics are modified.

Mechanism

Persistent localhost TLS interception with request-role rewriting.

Policy narrative

On a privileged global install, the postinstall hook runs setup without a separate user command. Setup redirects the GINKA API hostname to localhost, trusts a generated CA, and starts a persistent service. The service decrypts target traffic and rewrites developer-role messages to system-role messages before forwarding them. Although the source limits interception to one host and shows no exfiltration, this is an unconsented install-time mutation of a broad Node and system-service trust surface.

AI rationale

Evidence

package.jsonlib/cli.jslib/platform.jslib/proxy.jslib/constants.js/etc/hosts/usr/local/share/ca-certificates/ginka-role-fix-ca.crt/etc/systemd/system/ginka-role-fix.service/etc/environment/etc/environment.d/ginka-role-fix.conf/etc/systemd/system.conf.d/ginka-role-fix.conf/var/lib/ginka-role-fix

Network endpoints1

api.ginka.cloud

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.

Evidence for policy risk

A postinstall hook automatically runs privileged setup during a global install.
The setup redirects api.ginka.cloud to localhost, installs a trusted local CA, and registers a persistent service.
The proxy terminates TLS and changes developer messages to system messages before forwarding them.
Linux configuration propagates the local CA to system and user service environments.

Evidence against

The proxy restricts accepted SNI and Host values to api.ginka.cloud.
Source contains no credential harvesting, unrelated network endpoint, or outbound exfiltration path.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 37.5 KB of source, external domains: internal.local, www.apple.com

Source & flagged code

6 flagged

package.jsonView file

Lines 8-36json

8 "ginka",

9 "deepseek",

10 "dsh",

11 "proxy",

12 "tls",

13 "mitm",

14 "developer-role"

15 ],

16 "bin": {

17 "ginka-fix": "bin/ginka-fix.js"

18 },

19 "files": [

20 "bin",

21 "lib",

22 "README.md",

23 "LICENSE"

24 ],

25 "engines": {

26 "node": ">=18"

27 },

28 "scripts": {

29 "test": "node --test \"test/**/*.test.js\"",

30 "postinstall": "node bin/ginka-fix.js postinstall"

High

Suspicious Lifecycle Evidence

A postinstall hook automatically runs privileged setup during a global install.

package.jsonView on unpkg · L28

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 },

32 "dependencies": {

33 "node-forge": "^1.3.1"

34 }

35}

bin/ginka-fix.jsView file

3L4: require('../lib/cli') L5: .main(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ginka-fix.jsView on unpkg · L3

lib/platform.jsView file

5Trigger-reachable persistence chain: scripts.postinstall -> bin/ginka-fix.js -> lib/cli.js -> lib/platform.js L5: const path = require('node:path'); L6: const { execFileSync, spawnSync } = require('node:child_process'); L7: ... L71: const result = run(cmd, args); L72: return { ok: result.status === 0, stdout: result.stdout || '', stderr: result.stderr || '' }; L73: } ... L76: return new Promise((resolve) => { L77: const net = require('node:net'); L78: const socket = net.connect({ port, host }); ... L249: fs.writeFileSync(this.plistPath, plist, { mode: 0o644 }); L250: const boot = runChecked('launchctl', ['bootstrap', 'system', this.plistPath]); L251: if (!boot.ok) runChecked('launchctl', ['load', this.plistPath]);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/platform.jsView on unpkg · L5

5const path = require('node:path'); L6: const { execFileSync, spawnSync } = require('node:child_process'); L7: ... L71: const result = run(cmd, args); L72: return { ok: result.status === 0, stdout: result.stdout || '', stderr: result.stderr || '' }; L73: } ... L76: return new Promise((resolve) => { L77: const net = require('node:net'); L78: const socket = net.connect({ port, host }); ... L249: fs.writeFileSync(this.plistPath, plist, { mode: 0o644 }); L250: const boot = runChecked('launchctl', ['bootstrap', 'system', this.plistPath]); L251: if (!boot.ok) runChecked('launchctl', ['load', this.plistPath]);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/platform.jsView on unpkg · L5

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/ginka-fix.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

28"scripts": { "test": "node --test \"test/**/*.test.js\"", "postinstall": "node bin/ginka-fix.js postinstall"

High

Suspicious Lifecycle Evidence

A postinstall hook automatically runs privileged setup during a global install.

package.jsonView on unpkg · L28

•scripts.postinstall = node bin/ginka-fix.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/ginka-fix.jsView file

Findings

3 High6 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Persistencelib/platform.js

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/ginka-fix.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/platform.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to ginka-role-fix@0.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing ginka-role-fix@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-27 07:54:04.395Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.1.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 27, 2026, 7:48 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code