registry / polyrouter / 1.0.33

polyrouter@1.0.33

⚠ Under review

Local AI gateway and OpenAI-compatible API router for AI coding tools and 40+ providers

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 42 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 50 file(s), 613 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.example.com, chatgpt.com, fzdduustinwqhotqlpua.supabase.co, registry.npmjs.org, www.apple.com

Source & flagged code

33 flagged

package.jsonView file

Lines 1-41json

2 "name": "polyrouter",

3 "version": "1.0.33",

4 "description": "Local AI gateway and OpenAI-compatible API router for AI coding tools and 40+ providers",

5 "bin": {

6 "polyrouter": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepublishOnly": "npm run build"

23 },

24 "dependencies": {

25 "enquirer": "^2.4.1",

26 "node-forge": "^1.3.3",

27 "node-machine-id": "^1.1.12",

28 "react": "19.2.1",

29 "react-dom": "19.2.1"

30 },

31 "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.polyrouter/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",

32 "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.polyrouter/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",

33 "engines": {

34 "node": ">=18.0.0"

35 },

36 "keywords": [

37 "polyrouter",

38 "ai gateway",

39 "ai router",

40 "openai compatible",

41 "openai api",

app/.next-cli-build/server/instrumentation.jsView file

8patternName = generic_password severity = medium line = 8

Medium

Secret Pattern

Package contains a possible secret pattern.

app/.next-cli-build/server/instrumentation.jsView on unpkg · L8

app/src/mitm/server.jsView file

Lines 12-52javascript

12`),a+=Xr.util.encode64(e.body,t.maxline||64)+`\r

13`,a+="-----END "+e.type+`-----\r

14`,a};xi.decode=function(e){for(var t=[],a=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s

app/node_modules/minimizer-webpack-plugin/dist/minify.jsView file

Lines 467-496javascript

467 warnings,

468 errors,

469 extractedComments

470 };

471}

472

473/**

474 * @param {string} options options

475 * @returns

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

app/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.jsView file

Lines 1-21javascript

1/*

2 MIT License http://www.opensource.org/licenses/mit-license.php

3 Author Tobias Koppers @sokra

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

app/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.jsView on unpkg · L1

4*/

6"use strict";

8const vm

app/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

39}; L40: var __privateIn = (member, obj) => { L41: if (Object(obj) !== obj) ... L71: L72: // ../../node_modules/.pnpm/undici@6.21.0/node_modules/undici/lib/core/symbols.js L73: var require_symbols = __commonJS({ ... L98: kBodyUsed: Symbol("used"), L99: kBody: Symbol("abstracted request body"), L100: kRunning: Symbol("running"), ... L564: } L565: const code = this.code = key.charCodeAt(index); L566: if (code > 127) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

app/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

src/cli/tray/autostart.jsView file

3Trigger-reachable persistence chain: scripts.dev -> cli.js -> src/cli/tray/autostart.js L3: const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/cli/tray/autostart.jsView on unpkg · L3

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

cli.jsView file

783console.log(`🔔 PolyRouter is running in tray (PID: ${process.pid})`); L784: console.log(` Server: http://${displayHost}:${port}`); L785: console.log(`\n💡 You can close this terminal. Right-click tray icon to quit.\n`); ... L793: L794: const bgProcess = spawn(process.execPath, ["--dns-result-order=ipv4first", __filename, "--tray", "--skip-update", "-p", port.toString()], { L795: detached: true, ... L797: windowsHide: true, L798: env: { ...process.env } L799: });

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

cli.jsView on unpkg · L783

2L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const net = require("net"); ... L36: start() { L37: if (process.stdout.isTTY) { L38: process.stdout.write(`\r${frames[0]} ${currentText}`); L39: interval = setInterval(() => { ... L64: L65: const pkg = require("./package.json");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

cli.jsView on unpkg · L2

2Trigger-reachable chain: scripts.dev -> cli.js L2: L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const net = require("net"); ... L36: start() { L37: if (process.stdout.isTTY) { L38: process.stdout.write(`\r${frames[0]} ${currentText}`); L39: interval = setInterval(() => { ... L64: L65: const pkg = require("./package.json");

Critical

Trigger Reachable Dangerous Capability

app/src/realtime/runtime.jsView file

1import { WebSocketServer, WebSocket } from "ws"; L2: import RealtimeUpstream from "./upstream.js"; ... L19: const internalHost = getInternalAuthHost(host); L20: const response = await fetch(`http://${internalHost}:${process.env.PORT || 20128}/api/realtime/authorize`, { L21: method: "POST", ... L32: }, L33: body: JSON.stringify({ L34: model: url.searchParams.get("model"), ... L40: }); L41: const payload = await response.json().catch(() => ({})); L42: if (!response.ok || !payload.accessToken) throw new Error(payload.error || "Realtime authentication failed.");

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

app/src/realtime/runtime.jsView on unpkg · L1

app/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View file

50const _picocolors = require("../../lib/picocolors"); L51: const _child_process = /*#__PURE__*/ _interop_require_default._(require("child_process")); L52: const _fs = /*#__PURE__*/ _interop_require_default._(require("fs")); ... L177: // Explicit config always wins L178: if (process.env.REACT_EDITOR) { L179: return _shellquote.default.parse(process.env.REACT_EDITOR); ... L184: try { L185: if (process.platform === "darwin") { L186: const output = _child_process.default.execSync("ps x").toString(); ... L259: // L260: // https://developer.apple.[redacted]ASLR_classes.html#//apple_ref/doc/uid/TP40000983-CH1g-BBCIAHJF:~:... L261: return input.replaceAll(/[\\"]/g, (original)=>`\\${original}`);\n}\nfunction launchEditor(fileName, line1, column1) {\n if (!_fs.default.existsSync(fileName)) {\

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

app/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View on unpkg · L50

app/node_modules/playwright-core/lib/coreBundle.jsView file

21933"use strict"; L21934: source5 = '\nvar __commonJS = obj => {\n let required = false;\n let result;\n return function __require() {\n if (!required) {\n required = true;\n let fn;\n ... L21935: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

app/node_modules/playwright-core/lib/coreBundle.jsView on unpkg · L21933

app/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={582:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

app/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView file

•path = app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.node kind = binary_string_ioc sizeBytes = 11022768 magicHex = [redacted] matchedPrintableString = x.crates.io-6f17d22bba15001f/proxy-protocol-0.5.0/src/version1.rscryptoproviderkx_groupssignature_verification_algorithmssecure_randomkey_providerillegaladdressfamilymissingaddressinvalidaddressinvalidportillegalheaderendingstdiodestinationhttps://ngrok.com/docs/errors "0", "1", "2", or "3"0, 1, or 2struct authrespstruct authrespextrastruct bindrespextrastruct starttunnelwithlabelrespstruct unbindrespstruct proxyheaderevent /[redacted].crates.io-6f17d2

Critical

Binary String Ioc

Native or WebAssembly artifact printable strings contain known collector or webhook infrastructure.

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView on unpkg

•path = app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.node kind = native_binary sizeBytes = 11022768 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView on unpkg

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4795 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/public/downloads/polyrouter-connector.zipView file

•path = app/public/downloads/polyrouter-connector.zip kind = high_entropy_blob sizeBytes = 41038 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = compressed_blob sizeBytes = 41038 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = nested_archive_needs_inspection sizeBytes = 41038 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

app/public/downloads/polyrouter-connector.zipView on unpkg

app/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 54

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View on unpkg

app/node_modules/@next/env/dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/node_modules/@next/env/dist/index.jsView on unpkg

app/.next-cli-build/server/chunks/7688.jsView file

197patternName = generic_password severity = medium line = 197

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/server/chunks/7688.js

app/.next-cli-build/server/chunks/7688.jsView on unpkg · L197

app/.next-cli-build/server/chunks/6770.jsView file

215patternName = generic_password severity = medium line = 215

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/server/chunks/6770.js

app/.next-cli-build/server/chunks/6770.jsView on unpkg · L215

app/.next-cli-build/static/chunks/main-57701982fcb04dc2.jsView file

6patternName = generic_password severity = medium line = 6

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/static/chunks/main-57701982fcb04dc2.js

app/.next-cli-build/static/chunks/main-57701982fcb04dc2.jsView on unpkg · L6

app/.next-cli-build/static/chunks/3771-a1dfd661ba6e0720.jsView file

9patternName = generic_password severity = medium line = 9

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/static/chunks/3771-a1dfd661ba6e0720.js

app/.next-cli-build/static/chunks/3771-a1dfd661ba6e0720.jsView on unpkg · L9

Source & flagged code

33 flagged · loading source

polyrouter@1.0.33

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code