registry / AI-agent capability abuse / pennyrouter / 0.3.49

pennyrouter@0.3.49

Install and manage PennyRouter local coding-agent integrations.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The source shows a first-party, user-invoked agent integration that changes Claude Code statusline configuration. Under the agent integration policy this guarded capability merits a warning; the inspected code does not establish malicious activity.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user invokes the package CLI setup flow.

Impact

Claude Code runs the package's statusline script as part of the configured statusline integration.

Mechanism

The setup path configures a statusline command and writes the resulting Claude launch settings, preserving an existing statusline command for restoration.

AI rationale

Evidence

src/launch.jssrc/statusline.js

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes a user-run CLI and has no install lifecycle hook.
The CLI launch setup configures and persists a Claude Code statusline command; the integration preserves an existing command for later restoration.
The other indicated locations concern per-profile Codex config, test fixtures, session paths, or local transcript state; these excerpts do not establish a separate attack.
This is a guarded agent configuration capability activated through setup, with no confirmed attack behavior.

Evidence against

The package describes itself as an installer and manager for local coding-agent integrations.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 451 KB of source, external domains: 127.0.0.1, api.pennyrouter.com, app.example, chatgpt.com, gateway.example, gateway.example.com, gateway.internal.example.com, gw.example, new.example, old.example, opencode.ai, openrouter.example.test, other.example, pennyrouter.com, private.example, private.example.test, proxy.example.com, www.perplexity.ai

Source & flagged code

7 flagged

src/launch.test.jsView file

Lines 1-21javascript

1import assert from "node:assert/strict";

2import { spawnSync } from "node:child_process";

3import fs from "node:fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/launch.test.jsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

7import {

8 buildPennyInvocation,

9 claudeDesktopConfigLibraryPath,

10 claudeDesktopCredentialHelperPath,

11 claudeLaunchSettingsPath,

12 claudeUserSkillPath,

13 codexLaunchProfilePath,

14 codexModelCatalogPath,

15 configureClaudeDesktopProfile,

16 createCodexDesktopHome,

17 configurePennyHarness,

18 fileMode,

19 installPennyCompare,

20 installPennyRuntime,

21 isClaudeDesktopRunning,

src/harnesses/codegpt.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/harnesses/codegpt.jsView on unpkg · L1

3export const codeGptHarness = {

4 id: "codegpt",

src/statusline.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: tatusline (all lines) |] penny segment (penny / penny (sub) // / penny (byok) / penny off). the wrapped statusline's first line gets the penny suffix; // any further lines (e.g. a context bar) pass through verbatim. // never blocks on the network: reads a per-session cache and refreshes it detached. import { readfilesync, mkdirsync, writefilesync, statsync } from "node:fs"; import { spawn, spawnsync } from "node:child_process"; import { join, basename } from "node:path"; import os from "node:os"; const statedir = join( process.env.xdg_state_home || join(os.homedir(), ".local", "state"), "pennyrouter", ); const cachedir = join(statedir, "statusline-cache"); const titlesessionfile = process.env.pe

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/statusline.jsView on unpkg

src/launch.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function pennydatadir() { if (process.platform === "win32") { return join(process.env.localappdata || process.env.appdata || homedir(), "pennyrouter"); } return join(process.env.xdg_data_home || join(homedir(), ".local", "share"), "pennyrouter"); } export function pennyruntimedir() { return join(pennydatadir(), "runtime"); } export function pennycomparedir() { return join(pennydatadir(), "compare"); } export function pennybindir() { if (process.platform === "win32") return join(pennydatadir(), "bin"); return join(homedir(), ".local", "bin"); } export function pennyshimpath() { return join(pennybindir(), process.platform === "win32" ? "penny.cmd" :

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/launch.jsView on unpkg

standalone/claude-proxy.shView file

•path = standalone/claude-proxy.sh kind = build_helper sizeBytes = 8224 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standalone/claude-proxy.shView on unpkg

src/mcp-register.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/mcp-register.js#virtual:normalized:round1View on unpkg

src/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pennyrouter@0.3.17 matchedIdentity = npm:cGVubnlyb3V0ZXI:0.3.17 similarity = 0.710 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

src/launch.test.jsView file

1import assert from "node:assert/strict"; L2: import { spawnSync } from "node:child_process"; L3: import fs from "node:fs"; ... L54: async function main() { L55: if (!(["darwin", "linux"].includes(process.platform))) { L56: console.log("launch.test.js: skipped on unsupported platform"); ... L60: const root = fs.mkdtempSync(path.join(os.tmpdir(), "pr-launch-test-")); L61: const previous = Object.fromEntries(ENV_KEYS.map((key) => [key, process.env[key]])); L62: const home = path.join(root, "home"); ... L68: }, null, 2)}\n`; L69: const nativeCodex = 'model = "native-model"\n\nmodel_provider = "pennyrouter"\n\n[model_providers.pennyrouter]\nname = "PennyRouter"\nbase_url = "http://localhost:8400/v1"\n'; L70: fs.writeFileSync(path.join(home, ".claude", "settings.json"), nativeClaude);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/launch.test.jsView on unpkg · L1

src/harnesses/codegpt.jsView file

1import { spawnSync } from "node:child_process"; L2: ... L52: L53: // The record carries the base URL this install actually wrote, so a private/self-hosted L54: // gateway is named here instead of the hosted default the user never configured. ... L58: console.log(" Open CodeGPT settings and remove or replace the PennyRouter provider:"); L59: console.log(` - Base URL: ${record?.changes?.base_url || "https://api.pennyrouter.com/v1"}`); L60: console.log(" - API Key: pr-..."); ... L66: const commands = L67: process.platform === "darwin" L68: ? [["pbcopy"]] L69: : process.platform === "win32"

Findings

5 High5 Medium4 Low

HighSandbox Evasion Gated Capabilitysrc/harnesses/codegpt.js

HighExternal Ai Agent Control Surface Mutationsrc/statusline.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/launch.js

HighSemantic Analysis Limitedsrc/mcp-register.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltasrc/cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/launch.test.js

MediumShips Build Helperstandalone/claude-proxy.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to pennyrouter@0.3.49.

See all versions of pennyrouter for other recorded verdicts.

Review the evidence and your use of pennyrouter@0.3.49 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 19:36:26.501Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.