polyrouter@1.0.17: Suspicious npm security report (Warn)

Loading npm security reports…

polyrouter@1.0.17: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

19 flagged

package.jsonView file

Lines 1-41json

2 "name": "polyrouter",

3 "version": "1.0.17",

4 "description": "Local AI gateway and OpenAI-compatible API router for AI coding tools and 40+ providers",

5 "bin": {

6 "polyrouter": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepublishOnly": "npm run build"

23 },

24 "dependencies": {

25 "enquirer": "^2.4.1",

26 "node-forge": "^1.3.3",

27 "node-machine-id": "^1.1.12",

28 "react": "19.2.1",

29 "react-dom": "19.2.1"

30 },

31 "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.polyrouter/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",

32 "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.polyrouter/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",

33 "engines": {

34 "node": ">=18.0.0"

35 },

36 "keywords": [

37 "polyrouter",

38 "ai gateway",

39 "ai router",

40 "openai compatible",

41 "openai api",

app/src/mitm/server.jsView file

Lines 12-52javascript

12`),a+=Xr.util.encode64(e.body,t.maxline||64)+`\r

13`,a+="-----END "+e.type+`-----\r

14`,a};xi.decode=function(e){for(var t=[],a=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s

cli.jsView file

Lines 205-245javascript

205 process.kill(pid, "SIGKILL");

206 }

207 } catch { }

208 try { fs.unlinkSync(pidFile); } catch { }

209 } catch { }

210}

211

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require

app/src/realtime/runtime.jsView file

Lines 1-21javascript

1import { WebSocketServer, WebSocket } from "ws";

2import RealtimeUpstream from "./upstream.js";

3import {

4 MAX_PENDING_BYTES,

5 REALTIME_PATH,

6 makeError,

7 validateClientEvent,

app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4004 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/public/downloads/polyrouter-connector.zipView file

•path = app/public/downloads/polyrouter-connector.zip kind = high_entropy_blob sizeBytes = 41186 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = compressed_blob sizeBytes = 41186 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = nested_archive_needs_inspection sizeBytes = 41186 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

app/public/downloads/polyrouter-connector.zipView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node hooks/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node hooks/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/src/mitm/server.jsView file

32`)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Po(e){let t=42949672... L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolU... L34: $proc = Start-Process powershell -ArgumentList @(

High

Child Process

Package source references child process execution.

app/src/mitm/server.jsView on unpkg · L32

24Private-MAC: `+B.digest().toHex()+`\r L25: `,s};ma.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return vr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};ma.private... L26: `);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ea(`[SSE in] ${y.slice(0,200... ... L32: `)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Po(e){let t=42949672... L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolU.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

app/src/mitm/server.jsView on unpkg · L24

cli.jsView file

773console.log(`🔔 PolyRouter is running in tray (PID: ${process.pid})`); L774: console.log(` Server: http://${displayHost}:${port}`); L775: console.log(`\n💡 You can close this terminal. Right-click tray icon to quit.\n`); ... L783: L784: const bgProcess = spawn(process.execPath, ["--dns-result-order=ipv4first", __filename, "--tray", "--skip-update", "-p", port.toString()], { L785: detached: true, ... L787: windowsHide: true, L788: env: { ...process.env } L789: });

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

cli.jsView on unpkg · L773

2L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const net = require("net"); ... L36: start() { L37: if (process.stdout.isTTY) { L38: process.stdout.write(`\r${frames[0]} ${currentText}`); L39: interval = setInterval(() => { ... L64: L65: const pkg = require("./package.json");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

cli.jsView on unpkg · L2

2Trigger-reachable chain: scripts.dev -> cli.js L2: L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const net = require("net"); ... L36: start() { L37: if (process.stdout.isTTY) { L38: process.stdout.write(`\r${frames[0]} ${currentText}`); L39: interval = setInterval(() => { ... L64: L65: const pkg = require("./package.json");

Critical

Trigger Reachable Dangerous Capability

app/server.jsView file

1const path = require('path') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

src/cli/tray/autostart.jsView file

3Trigger-reachable persistence chain: scripts.dev -> cli.js -> src/cli/tray/autostart.js L3: const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/cli/tray/autostart.jsView on unpkg · L3

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

app/src/realtime/runtime.jsView file

1import { WebSocketServer, WebSocket } from "ws"; L2: import RealtimeUpstream from "./upstream.js"; ... L19: const internalHost = getInternalAuthHost(host); L20: const response = await fetch(`http://${internalHost}:${process.env.PORT || 20128}/api/realtime/authorize`, { L21: method: "POST", ... L32: }, L33: body: JSON.stringify({ L34: model: url.searchParams.get("model"), ... L40: }); L41: const payload = await response.json().catch(() => ({})); L42: if (!response.ok || !payload.accessToken) throw new Error(payload.error || "Realtime authentication failed.");

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

app/src/realtime/runtime.jsView on unpkg · L1

app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4004 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/public/downloads/polyrouter-connector.zipView file

•path = app/public/downloads/polyrouter-connector.zip kind = high_entropy_blob sizeBytes = 41186 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = compressed_blob sizeBytes = 41186 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = nested_archive_needs_inspection sizeBytes = 41186 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

app/public/downloads/polyrouter-connector.zipView on unpkg

Source & flagged code

19 flagged

package.jsonView file

Lines 1-41json

2 "name": "polyrouter",

3 "version": "1.0.17",

4 "description": "Local AI gateway and OpenAI-compatible API router for AI coding tools and 40+ providers",

5 "bin": {

6 "polyrouter": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepublishOnly": "npm run build"

23 },

24 "dependencies": {

25 "enquirer": "^2.4.1",

26 "node-forge": "^1.3.3",

27 "node-machine-id": "^1.1.12",

28 "react": "19.2.1",

29 "react-dom": "19.2.1"

30 },

33 "engines": {

34 "node": ">=18.0.0"

35 },

36 "keywords": [

37 "polyrouter",

38 "ai gateway",

39 "ai router",

40 "openai compatible",

41 "openai api",

app/src/mitm/server.jsView file

Lines 12-52javascript

12`),a+=Xr.util.encode64(e.body,t.maxline||64)+`\r

13`,a+="-----END "+e.type+`-----\r

14`,a};xi.decode=function(e){for(var t=[],a=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s

cli.jsView file

Lines 205-245javascript

205 process.kill(pid, "SIGKILL");

206 }

207 } catch { }

208 try { fs.unlinkSync(pidFile); } catch { }

209 } catch { }

210}

211

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require

app/src/realtime/runtime.jsView file

Lines 1-21javascript

1import { WebSocketServer, WebSocket } from "ws";

2import RealtimeUpstream from "./upstream.js";

3import {

4 MAX_PENDING_BYTES,

5 REALTIME_PATH,

6 makeError,

7 validateClientEvent,

app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4004 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/public/downloads/polyrouter-connector.zipView file

•path = app/public/downloads/polyrouter-connector.zip kind = high_entropy_blob sizeBytes = 41186 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = compressed_blob sizeBytes = 41186 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = nested_archive_needs_inspection sizeBytes = 41186 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

app/public/downloads/polyrouter-connector.zipView on unpkg

Lines 753-793javascript

753 const { startTerminalUI } = require("./src/cli/terminalUI");

754 await startTerminalUI(port);

755 // Loop continues, show menu again

756 } else if (choice === "hide") {

757 const { clearScreen } = require("./src/cli/utils/display");

758 clearScreen();

759

760 // Enable auto startup on OS boot

761 try {

762 const { enableAutoStart } = require("./src/cli/tray/autostart");

763 enableAutoStart(__filename);

764 } catch (e) { }

765

766 if (process.platform === "darwin") {

767 // macOS: keep current process alive — spawning a detached child puts

768 // it outside the login session so NSStatusItem silently fails.

769 process.removeAllListeners("SIGHUP");

770 process.on("SIGHUP", () => {});

771

772 console.log(`\n⏳ Switching to tray mode... (icon already visible in menu bar)`);

773 console.log(`🔔 PolyRouter is running in tray (PID: ${process.pid})`);

774 console.log(` Server: http://${displayHost}:${port}`);

775 console.log(`\n💡 You can close this terminal. Right-click tray icon to quit.\n`);

776

777 // Tray already init'd at startup — just keep event loop alive.

778 return;

779 }

780

781 // Windows/Linux: spawn detached bgProcess (systray works fine in child)

782 console.log(`\n⏳ Starting background process... (tray icon will appear in ~3s)`);

783

784 const bgProcess = spawn(process.execPath, ["--dns-result-order=ipv4first", __filename, "--tray", "--skip-update", "-p", port.toString()], {

785 detached: true,

786 stdio: "ignore",

787 windowsHide: true,

788 env: { ...process.env }

789 });

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

cli.jsView on unpkg · L773

790 bgProcess.unref();

791

792 console.log(`🔔 PolyRouter is now running in background (PID: ${bgProcess.pid})`);

793 console.log(` Server: http://${displayHost}:${port}`);

polyrouter@1.0.17

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code