Loading npm security reports…

nexusroute@1.0.4: Suspicious npm security report (Warn) | LPM Firewall

registry / nexusroute / 1.0.4

nexusroute@1.0.4

The Intelligent AI Nexus — one gateway, every AI provider, $0 to start.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Running `nexusgate` launches a gateway that defaults to a publisher-controlled remote MongoDB backend. Its credential auto-detection code reads local Cursor state/authentication data, and connection handling persists provider API-key material through that backend.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `nexusgate` or starts the packaged gateway.

Impact

IDE authentication data and provider API keys can leave the local machine to an undisclosed remote MongoDB deployment.

Mechanism

Harvest local IDE authentication state and store gateway credentials in a default remote database.

Rationale

This is not merely an insecure default: the package combines local IDE credential harvesting with automatic persistence to an external database selected by the package. The disclosed gateway purpose does not justify silently defaulting sensitive credential storage to that remote endpoint. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonREADME.mddist/cli.jsnexus-api/dist/app.module.jsnexus-api/dist/modules/connections/auto-detect.jsnexus-api/dist/modules/connections/connections.service.js

Network endpoints1

cluster0.77x40ds.mongodb.net

Decision evidence

Source & flagged code

4 flagged

.next/standalone/.envView file

•patternName = blocked_file severity = critical matchedText = .next/standalone/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.next/standalone/.envView on unpkg

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var n=require("node:child_process"),g=require("node:fs"),a=require("node:path"),m=require("node:os"),$=typeof __dirname<"u"?(0,a.resolve)(__dirname,".."):process.cwd();function k(o){if(!(0,g.existsSync)(o))return{};let r={};try{let i=(0,g.readFileSync)(o,"utf8");for(let v of i.split(/\r?\n/)){let u=v.trim();if(!u||u.startsWith("#"))continue;let b=u.indexOf("=");if(b===-1)continue;let t=u.slice(0,b).trim(),s=u.slice(b+1).trim();(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),t&&(r[t]=s)}}catch{}return r}var e={reset:"\x1B[0m",dim:"\x1B[2m ...

3${e.magenta}${e.bold} \u2554\u2557 \u2554\u2557${e.reset} ${e.bold}NexusGate v${o}${e.reset}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1

4${e.magenta}${e.bold} \u2551\u2551 \u2551\u2551${e.reset} ${e.dim}The Intelligent AI Nexus${e.reset}

5${e.magenta}${e.bold} \u2551\u255A\u2550\u255D\u2551${e.reset} ${e.dim}https://nexusgate.dev${e.reset}

6${e.magenta}${e.bold} \u255A\u2550\u2550\u2550\u255D${e.reset}

7`);let r=(0,a.join)($,"nexus-api","dist","main.js"),i=(0,a.join)($,".next","standalone","server.js");(0,g.existsSync)(r)||(x(`Backend not built. Expected: ${r}`),w("Run: npm run build:api"),process.exit(1)),(0,g.existsSync)(i)||(x(`Frontend not built. Expected: ${i}`),w("Run: npm run build:web"),process.exit(1)),d(`Starting API server on ${e.bold}:${p}${e.reset}...`);let v=k((0,a.join)(process.cwd(),".env")),b={MONGODB_URI:"mongodb+srv://Tanimur:Tani1234@cluster0.77x40ds.mongodb.net/nexusgate",JWT_ACCESS_SECRET:"sdgdsgdsgsdgsdg",JWT_REFRESH_SECRET:"sdgdsgsdgsd",ENCRYPTION_KEY:"68d1838634fa68b7 ...

8${e.bold}NexusGate${e.reset} \u2014 The Intelligent AI Gateway

9

10${e.bold}Usage:${e.reset}

11 nexusgate Start API + dashboard servers

12 nexusgate start Same as above

13 nexusgate stop Stop running servers

14 nexusgate version Show version

15

16${e.bold}Options:${e.reset}

17 --port <number> Web dashboard port (default: 4200)

18 --api-port <number> API server port (default: 4444)

19 --host <addr> Bind address (default: 0.0.0.0)

20 --no-browser Don't auto-open browser

21

Long lines were clipped for display.

nexus-api/dist/config/env-validation.jsView file

Lines 1-1javascript

1'use strict';var a9_0x7d983e=a9_0x26b7;(function(_0x1069cd,_0x5c69c9){var _0x215335=a9_0x26b7,_0x3010de=_0x1069cd();while(!![]){try{var _0xe369e1=-

.next/standalone/.next/static/media/bbc41e54d2fcbd21-s.1rgnod-3esatf.woff2View file

•path = .next/standalone/.[redacted]-s.1rgnod-3esatf.woff2 kind = high_entropy_blob sizeBytes = 14712 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/.next/static/media/bbc41e54d2fcbd21-s.1rgnod-3esatf.woff2View on unpkg