Loading npm security reports…

nexusroute@1.0.5: Suspicious npm security report (Warn) | LPM Firewall

registry / nexusroute / 1.0.5

nexusroute@1.0.5

The Intelligent AI Nexus — one gateway, every AI provider, $0 to start.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Explicit CLI startup launches a local gateway using a packaged remote MongoDB default. User-supplied provider credentials may be persisted there under a package-known encryption key; no install-time execution was found.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `nexusgate` or `npx nexusroute` and configures provider credentials.

Impact

Provider API keys and OAuth tokens may be exposed to the remote database operator or anyone with the bundled database access.

Mechanism

Remote default database plus package-known credential-encryption material.

Rationale

This is not a lifecycle-based malware block: execution requires an explicit user command and the README mentions cloud storage. However, the default remote credential store, fixed encryption material, and pervasive obfuscation create a concrete credential-exposure risk.

Evidence

package.jsonREADME.mddist/cli.jsnexus-api/dist/app.module.jsnexus-api/dist/modules/connections/connections.service.jsnexus-api/dist/modules/settings/sync.service.js

Network endpoints1

cluster0.77x40ds.mongodb.net

Decision evidence

public snapshot

Source & flagged code

4 flagged

.next/standalone/.envView file

•patternName = blocked_file severity = critical matchedText = .next/standalone/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.next/standalone/.envView on unpkg

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var n=require("node:child_process"),g=require("node:fs"),a=require("node:path"),m=require("node:os"),$=typeof __dirname<"u"?(0,a.resolve)(__dirname,".."):process.cwd();function k(o){if(!(0,g.existsSync)(o))return{};let r={};try{let i=(0,g.readFileSync)(o,"utf8");for(let v of i.split(/\r?\n/)){let u=v.trim();if(!u||u.startsWith("#"))continue;let b=u.indexOf("=");if(b===-1)continue;let t=u.slice(0,b).trim(),s=u.slice(b+1).trim();(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),t&&(r[t]=s)}}catch{}return r}var e={reset:"\x1B[0m",dim:"\x1B[2m ...

3${e.magenta}${e.bold} \u2554\u2557 \u2554\u2557${e.reset} ${e.bold}NexusGate v${o}${e.reset}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1

4${e.magenta}${e.bold} \u2551\u2551 \u2551\u2551${e.reset} ${e.dim}The Intelligent AI Nexus${e.reset}

5${e.magenta}${e.bold} \u2551\u255A\u2550\u255D\u2551${e.reset} ${e.dim}https://nexusgate.dev${e.reset}

6${e.magenta}${e.bold} \u255A\u2550\u2550\u2550\u255D${e.reset}

7`);let r=(0,a.join)($,"nexus-api","dist","main.js"),i=(0,a.join)($,".next","standalone","server.js");(0,g.existsSync)(r)||(x(`Backend not built. Expected: ${r}`),w("Run: npm run build:api"),process.exit(1)),(0,g.existsSync)(i)||(x(`Frontend not built. Expected: ${i}`),w("Run: npm run build:web"),process.exit(1)),d(`Starting API server on ${e.bold}:${p}${e.reset}...`);let v=k((0,a.join)(process.cwd(),".env")),b={MONGODB_URI:"mongodb+srv://Tanimur:Tani1234@cluster0.77x40ds.mongodb.net/nexusgate",JWT_ACCESS_SECRET:"sdgdsgdsgsdgsdg",JWT_REFRESH_SECRET:"sdgdsgsdgsd",ENCRYPTION_KEY:"68d1838634fa68b7 ...

8${e.bold}NexusGate${e.reset} \u2014 The Intelligent AI Gateway

9

10${e.bold}Usage:${e.reset}

11 nexusgate Start API + dashboard servers

12 nexusgate start Same as above

13 nexusgate stop Stop running servers

14 nexusgate version Show version

15

16${e.bold}Options:${e.reset}

17 --port <number> Web dashboard port (default: 4200)

18 --api-port <number> API server port (default: 4444)

19 --host <addr> Bind address (default: 0.0.0.0)

20 --no-browser Don't auto-open browser

21

Long lines were clipped for display.

nexus-api/dist/config/env-validation.jsView file

Lines 1-1javascript

1'use strict';var a9_0x734323=a9_0x1372;(function(_0x319628,_0x3f633d){var _0x2c665e=a9_0x1372,_0x49321c=_0x319628();while(!![]){try{var _0x251d79=-

.next/standalone/.next/static/media/bbc41e54d2fcbd21-s.1rgnod-3esatf.woff2View file

•path = .next/standalone/.[redacted]-s.1rgnod-3esatf.woff2 kind = high_entropy_blob sizeBytes = 14712 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/.next/static/media/bbc41e54d2fcbd21-s.1rgnod-3esatf.woff2View on unpkg