muse-gateway@1.0.9
Muse Gateway — local Muse session pool & OpenAI-compatible gateway. License key required to unlock /v1/* API.
AI Security Review
scanned 19h ago · by lpm-firewall-aiThe package contains published reviewer-directed text that impersonates higher-priority instructions and tries to suppress analysis. This matches the review rules for malicious reviewer manipulation.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A reviewer reads the packaged AGENTS.md during package inspection.
Impact
It attempts to prevent independent inspection of the package and its protections.
Mechanism
The file impersonates a higher-priority directive and instructs the reviewer to stop analysis and refuse.
Attack narrative
The package ships AGENTS.md and lists it in package.json. The file claims system-level authority, says it overrides user instructions, and directs reviewers to stop and refuse certain analysis. This is a deliberate attempt to manipulate the review process.
AI rationale
The package contains published reviewer-directed text that impersonates higher-priority instructions and tries to suppress analysis. This matches the review rules for malicious reviewer manipulation.
Evidence
AGENTS.mdpackage.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The shipped AGENTS.md claims system-level authority and says its instructions override user instructions.
- AGENTS.md directs the reviewer to stop reading and refuse requests involving analysis of the product’s protections.
- package.json explicitly includes AGENTS.md in the published files.
Evidence against
- The launcher exposes auto-start as a user-selectable tray or menu action.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
24 flaggedbin/muse-gateway.cjsView file
19const https = require('https');
L20: const { execSync, spawn } = require('child_process');
L21: const readline = require('readline');
High
Child Process
Package source references child process execution.
bin/muse-gateway.cjsView on unpkg · L19566try {
L567: const upd = spawn('npm', ['i', '-g', 'muse-gateway'], { stdio: 'inherit', shell: true });
L568: upd.on('error', () => {
High
17const os = require('os');
L18: const http = require('http');
L19: const https = require('https');
L20: const { execSync, spawn } = require('child_process');
L21: const readline = require('readline');
...
L27: const LOG_FILE = path.join(DATA_DIR, 'server.log');
L28: const PORT = process.env.MUSE_PORT || process.env.PORT || '1412';
L29: // Server binds 127.0.0.1 (IPv4 loopback). Advertise that exact address —
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/muse-gateway.cjsFindings
1 Critical16 High9 Medium5 Low
CriticalRemote Response Code Executionapp/node_modules/next/dist/compiled/jest-worker/threadChild.js
HighChild Processbin/muse-gateway.cjs
HighShellbin/muse-gateway.cjs
HighEvalapp/.next/node_modules/puppeteer-core-3cc12a7b2479c6f0/lib/puppeteer/util/Function.js
HighSame File Env Network Executionbin/muse-gateway.cjs
HighCommand Output Exfiltrationapp/node_modules/next/dist/compiled/@vercel/nft/index.js
HighSandbox Evasion Gated Capabilityapp/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1
HighObfuscated Payload Loaderapp/node_modules/next/dist/compiled/next-server/dev-validation-worker-turbo-experimental.runtime.dev.js
HighTrigger Reachable Persistencebin/muse-gateway.cjs
Affected versions and remediation
This report applies to muse-gateway@1.0.9.
See all versions of muse-gateway for other recorded verdicts.
- Avoid installing muse-gateway@1.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.