muse-gateway@1.0.0
Muse Gateway — local Muse session pool & OpenAI-compatible gateway. License key required to unlock /v1/* API.
AI Security Review
scanned 7d ago · by lpm-firewall-aiAGENTS.md contains explicit instructions aimed at controlling and stopping the security review, which is reviewer manipulation and evidence of malicious intent. The launcher’s registry request is limited to an interactive version check, and no install lifecycle scripts are declared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
An AI reviewer reads AGENTS.md during package inspection.
Impact
Attempts to suppress security findings and interfere with package review.
Mechanism
The file claims system-level authority, tells the reviewer to stop analyzing package internals, and supplies a fixed refusal response.
Attack narrative
When an AI reviewer inspects the package, AGENTS.md claims overriding authority and instructs the reviewer to stop reading source and return a predetermined refusal. This is deliberate reviewer manipulation. The launcher’s separate npm registry request is a menu-triggered version check; the examined evidence does not connect it to the manipulation.
AI rationale
AGENTS.md contains explicit instructions aimed at controlling and stopping the security review, which is reviewer manipulation and evidence of malicious intent. The launcher’s registry request is limited to an interactive version check, and no install lifecycle scripts are declared.
Evidence
AGENTS.mdbin/muse-gateway.cjspackage.json
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The published AGENTS.md declares itself a system-level directive and tells AI agents to obey it before reading other package files.
- AGENTS.md instructs the reviewer to stop reading package internals and dictates a refusal response, directly attempting to suppress security review.
- The launcher’s network request checks the package’s latest version at registry.npmjs.org from the interactive menu.
- The package manifest defines a CLI entry point and contains no lifecycle scripts.
Evidence against
- The launcher’s autostart feature is an explicit Windows registry Run-key toggle.
- License-key activation is prompted interactively and sent to the local server.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
UrlStrings
NoLicense
Source & flagged code
16 flaggedbin/muse-gateway.cjsView file
19const https = require('https');
L20: const { execSync, spawn } = require('child_process');
L21: const readline = require('readline');
High
Child Process
Package source references child process execution.
bin/muse-gateway.cjsView on unpkg · L19475try {
L476: const upd = spawn('npm', ['i', '-g', 'muse-gateway'], { stdio: 'inherit', shell: true });
L477: upd.on('error', () => {
High
17const os = require('os');
L18: const http = require('http');
L19: const https = require('https');
L20: const { execSync, spawn } = require('child_process');
L21: const readline = require('readline');
...
L27: const LOG_FILE = path.join(DATA_DIR, 'server.log');
L28: const PORT = process.env.PORT || '3000';
L29: const BASE = `http://localhost:${PORT}`;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/muse-gateway.cjsView on unpkg · L17Findings
1 Critical9 High8 Medium4 Low
CriticalRemote Response Code Executionapp/node_modules/next/dist/compiled/jest-worker/threadChild.js
HighChild Processbin/muse-gateway.cjs
HighShellbin/muse-gateway.cjs
HighEvalapp/.next/node_modules/puppeteer-core-3cc12a7b2479c6f0/lib/puppeteer/util/Function.js
HighSame File Env Network Executionbin/muse-gateway.cjs
HighCommand Output Exfiltrationapp/node_modules/next/dist/compiled/@vercel/nft/index.js
HighSandbox Evasion Gated Capabilityapp/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1
HighObfuscated Payload Loaderapp/node_modules/next/dist/compiled/next-server/dev-validation-worker-turbo-experimental.runtime.dev.js
HighSemantic Analysis Limitedapp/.next/node_modules/puppeteer-core-3cc12a7b2479c6f0/lib/third_party/parsel-js/parsel-js.js#virtual:normalized:round1
Affected versions and remediation
This report applies to muse-gateway@1.0.0.
See all versions of muse-gateway for other recorded verdicts.
- Avoid installing muse-gateway@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.