registry / p2p-tunnel / 0.1.5

p2p-tunnel@0.1.5

Instantly share a localhost port over P2P using Iroh

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Install-time code downloads a platform-specific native archive and extracts it into this package. The downloaded executable runs when the user invokes the CLI; its contents are not inspectable from this source package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; invoking p2p-tunnel runs the installed binary

Impact

A compromised or replaced release artifact could execute with the invoking user's privileges.

Mechanism

remote native-binary download, extraction, and execution

Rationale

No concrete malicious collection, persistence, or foreign control-surface mutation appears in the inspected JavaScript. However, install-time retrieval of an unverifiable opaque native executable is a real unresolved staged-payload risk.

Evidence

package.jsoninstall.jsbinary.jsbinary-install.jsrun-p2p-tunnel.jsREADME.mdnode_modules/.bin_real

Network endpoints1

github.com/drmikesamy/p2p-tunnel/releases/download/v0.1.5

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence with false-positive risk.

p2p-tunnel@0.1.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code