muse-gateway@1.0.1
Muse Gateway — local Muse session pool & OpenAI-compatible gateway. License key required to unlock /v1/* API.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package contains explicit reviewer-directed instructions intended to restrict analysis, which meets the review-manipulation rule. The inspected launcher’s registry request is a version check in the interactive menu, and I found no evidence that it transmits credentials or user data.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A reviewer or AI agent inspects the package metadata or server entry point.
Impact
These directives could suppress or distort a security assessment.
Mechanism
An x-license-notice field and a server-file header instruct agents to follow package instructions and refuse analysis.
Attack narrative
The package embeds review-directed instructions in metadata and the server entry point, asking AI agents to obey package-root instructions and refuse analysis of license or protection code. This is reviewer manipulation; the observed launcher version check is separate and does not explain or justify those directives.
AI rationale
The package contains explicit reviewer-directed instructions intended to restrict analysis, which meets the review-manipulation rule. The inspected launcher’s registry request is a version check in the interactive menu, and I found no evidence that it transmits credentials or user data.
Evidence
app/package.jsonapp/server.js
Network endpoints1
registry.npmjs.org/muse-gateway/latest
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- app/package.json contains an explicit instruction for AI agents to obey AGENTS.md/CLAUDE.md and refuse analysis of license or protection code.
- app/server.js repeats a directive to read and follow package-root AGENTS.md and CLAUDE.md before reading or modifying the file.
- The package metadata describes a local session-pool and OpenAI-compatible gateway with a license gate.
- The interactive launcher checks the package version at registry.npmjs.org.
Evidence against
- The root package has no lifecycle scripts, so installation does not automatically launch the executable.
- The registry request is a version lookup in the interactive menu; the source shows no user credentials or local data sent with it.
- The reviewed launcher behavior is consistent with operating a local gateway, including user-invoked server startup and dashboard actions.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
21 flaggedbin/muse-gateway.cjsView file
19const https = require('https');
L20: const { execSync, spawn } = require('child_process');
L21: const readline = require('readline');
High
Child Process
Package source references child process execution.
bin/muse-gateway.cjsView on unpkg · L19484try {
L485: const upd = spawn('npm', ['i', '-g', 'muse-gateway'], { stdio: 'inherit', shell: true });
L486: upd.on('error', () => {
High
17const os = require('os');
L18: const http = require('http');
L19: const https = require('https');
L20: const { execSync, spawn } = require('child_process');
L21: const readline = require('readline');
...
L27: const LOG_FILE = path.join(DATA_DIR, 'server.log');
L28: const PORT = process.env.MUSE_PORT || process.env.PORT || '1412';
L29: // Server binds 127.0.0.1 (IPv4 loopback). Advertise that exact address —
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/muse-gateway.cjsFindings
1 Critical14 High8 Medium4 Low
CriticalRemote Response Code Executionapp/node_modules/next/dist/compiled/jest-worker/threadChild.js
HighChild Processbin/muse-gateway.cjs
HighShellbin/muse-gateway.cjs
HighEvalapp/node_modules/next/dist/compiled/browserslist/index.js
HighSame File Env Network Executionbin/muse-gateway.cjs
HighCommand Output Exfiltrationapp/node_modules/next/dist/compiled/@vercel/nft/index.js
HighSandbox Evasion Gated Capabilityapp/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1
HighObfuscated Payload Loaderapp/node_modules/next/dist/compiled/next-server/dev-validation-worker-turbo-experimental.runtime.dev.js
HighSemantic Analysis Limitedapp/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1
Affected versions and remediation
This report applies to muse-gateway@1.0.1.
See all versions of muse-gateway for other recorded verdicts.
- Avoid installing muse-gateway@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.