registry / kcgrouter / 0.10.2

kcgrouter@0.10.2

Lightweight AI proxy gateway — route chat completions to upstream providers

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation creates an OS login-persistence entry that starts a background daemon. This occurs by default, without an explicit user startup command.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation

Impact

Persistent background execution at user login.

Mechanism

cross-platform autostart registration for kcgrouter --daemon

Attack narrative

The package's automatic postinstall invokes a script that writes Windows Startup, macOS LaunchAgent, or Linux XDG autostart entries. Those entries launch `kcgrouter --daemon` at each login. Although the package exposes explicit startup-management CLI commands, the lifecycle hook performs the same persistence by default, so installation alone alters the user's OS startup configuration.

Rationale

This is concrete, unconsented install-time persistence. The absence of observed install-time exfiltration does not remove the risk of automatic background execution.

Evidence

package.jsonscripts/postinstall.mjs~/.config/autostart/kcgrouter.desktop~/Library/LaunchAgents/com.kcgrouter.plistWindows Startup/kcgrouter-startup.vbs

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs scripts/postinstall.mjs automatically on installation.
Postinstall registers a login startup task unless KCGRouter_SKIP_STARTUP is pre-set.
The startup entries launch kcgrouter --daemon across Windows, macOS, and Linux.

Evidence against

No install-time network request or credential exfiltration was found in the reviewed lifecycle script.
Runtime network code is consistent with the declared AI proxy/provider functionality.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 235 file(s), 1.72 MB of source, external domains: api.anthropic.com, api.commandcode.ai, api.openai.com, api.xiaomimimo.com, api2.qoder.sh, api3.qoder.sh, codewhisperer.us-east-1.amazonaws.com, generativelanguage.googleapis.com, github.com, openapi.qoder.sh, q.us-east-1.amazonaws.com, qoder.com, react.dev, registry.npmjs.org, www.apple.com, www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 17-57json

17 "bunfig.toml",

18 "tsconfig.json",

19 "!src/**/__tests__/**",

20 "!src/**/*.test.ts",

21 "!src/**/*.test.tsx",

22 "!src/test-setup.ts"

23 ],

24 "engines": {

25 "bun": ">=1.2.3"

26 },

27 "scripts": {

28 "dev": "bun --hot src/index.ts",

29 "start": "NODE_ENV=production bun src/index.ts",

30 "build": "bun run build.ts",

31 "check": "biome check --write ./src",

32 "lint": "biome lint --write ./src",

33 "format": "biome format --write ./src",

34 "gen-env": "bash scripts/gen-env.sh",

35 "generate-icon": "bun scripts/generate-icon.ts",

36 "test": "bash scripts/test.sh",

37 "postinstall": "bun scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "prepublishOnly": "bun run build"

39 },

40 "dependencies": {

41 "@clack/prompts": "^1.7.0",

42 "@radix-ui/react-label": "^2.1.7",

43 "@radix-ui/react-select": "^2.2.6",

44 "@radix-ui/react-slot": "^1.2.3",

45 "bun-plugin-tailwind": "^0.1.2",

46 "class-variance-authority": "^0.7.1",

47 "clsx": "^2.1.1",

48 "jsonc-parser": "^3.3.1",

49 "lucide-react": "^1",

50 "radix-ui": "^1.6.7",

51 "react": "^19",

52 "react-dom": "^19",

53 "recharts": "^3.10.1",

54 "sonner": "^2.0.7",

55 "systray2": "^2.1.4",

56 "tailwind-merge": "^3.3.1",

57 "tailwindcss": "^4.1.11",

scripts/postinstall.mjsView file

Lines 1-26javascript

1// Cross-platform postinstall: prepares systray2's native tray binaries and

2// registers kcgrouter to start automatically at user login.

3// On Unix it makes them executable and creates the platform symlinks that

4// systray2 looks for in debug mode. On Windows (where `chmod`/`ln` are not

5// available in bun's shell) it copies the binary instead of symlinking,

6// because creating symlinks requires admin privileges / Developer Mode.

7import { execSync } from "node:child_process";

8import { chmodSync, copyFileSync, existsSync, mkdirSync, symlinkSync, unlinkSync, writeFileSync }

src/server/providers/qoder/cosy.tsView file

Lines 30-70typescript

30 QODER_MACHINE_OS,

31 QODER_MACHINE_TYPE,

32 QODER_RSA_PUBLIC_KEY,

33} from "./constants";

35export interface CosyCreds {

src/server/routes/settings.routes.tsView file

Lines 14-54typescript

14 updateCommand: string;

15 fetchedAt: number;

16} | null = null;

18const VERSION_CACHE_TTL = 60

src/lib/startup.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = kcgrouter@0.10.0 matchedIdentity = npm:a2Nncm91dGVy:0.10.0 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/lib/startup.tsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = bun scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

6// because creating symlinks requires admin privileges / Developer Mode. L7: import { execSync } from "node:child_process"; L8: import { chmodSync, copyFileSync, existsSync, mkdirSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L6

Findings

1 Critical4 High6 Medium7 Low

CriticalPrevious Version Dangerous Deltasrc/lib/startup.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.mjs

HighShell

HighRuntime Package Installsrc/server/routes/settings.routes.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/postinstall.mjs

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/server/providers/qoder/cosy.ts