Loading npm security reports…

polyrouter@1.0.35: AI-agent control-surface risk | LPM Firewall

registry / polyrouter / 1.0.35

polyrouter@1.0.35

Local AI gateway and OpenAI-compatible API router for AI coding tools and 60+ providers

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The ChatGPT Web MCP flow injects a developer-style prompt that directs an AI agent to use PolyRouter-controlled tools before responding. This changes the agent's control flow rather than merely routing an API request.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A ChatGPT Web request with tools while MCP is not explicitly disabled.

Impact

An AI agent can be steered into package-selected tool execution and away from normal response behavior, subject only to the outer client's sandbox and approvals.

Mechanism

The bundled server code adds instructions to bind a turn token, inventory tools, invoke the required tool, continue tool use until completion, and hide proposed tool calls.

Policy narrative

When the ChatGPT Web MCP path is active, the package inserts a directive into the model context. It requires a token-binding call and subsequent PolyRouter tool calls before any answer, tells the model to keep calling tools until completion, and prohibits displaying proposed calls. This is active control of an AI agent's tool-use behavior, not ordinary transport routing.

AI rationale

The bundled runtime contains an active, default-enabled AI control prompt that compels package-selected tool use and suppresses transparent assistant behavior. Although the outer client retains its approval policy, this is concrete agent-control hijacking behavior.

Evidence

app/.next-cli-build/server/chunks/8836.js

Decision evidence

public snapshot

Source & flagged code

33 flagged

package.jsonView file

Lines 1-41json

2 "name": "polyrouter",

3 "version": "1.0.35",

4 "description": "Local AI gateway and OpenAI-compatible API router for AI coding tools and 60+ providers",

5 "bin": {

6 "polyrouter": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepublishOnly": "npm run build"

23 },

24 "dependencies": {

25 "enquirer": "^2.4.1",

26 "node-forge": "^1.3.3",

27 "node-machine-id": "^1.1.12",

28 "react": "19.2.1",

29 "react-dom": "19.2.1"

30 },

31 "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.polyrouter/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",

32 "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.polyrouter/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",

33 "engines": {

34 "node": ">=18.0.0"

35 },

36 "keywords": [

37 "polyrouter",

38 "ai gateway",

39 "ai router",

40 "openai compatible",

41 "openai api",

app/.next-cli-build/server/instrumentation.jsView file

8patternName = generic_password severity = medium line = 8

Medium

Secret Pattern

Package contains a possible secret pattern.

app/.next-cli-build/server/instrumentation.jsView on unpkg · L8

app/src/mitm/server.jsView file

Lines 12-52javascript

12`),a+=Xr.util.encode64(e.body,t.maxline||64)+`\r

13`,a+="-----END "+e.type+`-----\r

14`,a};xi.decode=function(e){for(var t=[],a=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s

app/node_modules/minimizer-webpack-plugin/dist/minify.jsView file

Lines 467-496javascript

467 warnings,

468 errors,

469 extractedComments

470 };

471}

472

473/**

474 * @param {string} options options

475 * @returns

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

app/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.jsView file

Lines 1-21javascript

1/*

2 MIT License http://www.opensource.org/licenses/mit-license.php

3 Author Tobias Koppers @sokra

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

app/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.jsView on unpkg · L1

4*/

6"use strict";

8const vm

app/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

39}; L40: var __privateIn = (member, obj) => { L41: if (Object(obj) !== obj) ... L71: L72: // ../../node_modules/.pnpm/undici@6.21.0/node_modules/undici/lib/core/symbols.js L73: var require_symbols = __commonJS({ ... L98: kBodyUsed: Symbol("used"), L99: kBody: Symbol("abstracted request body"), L100: kRunning: Symbol("running"), ... L564: } L565: const code = this.code = key.charCodeAt(index); L566: if (code > 127) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

app/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

src/cli/tray/autostart.jsView file

3Trigger-reachable persistence chain: scripts.dev -> cli.js -> src/cli/tray/autostart.js L3: const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/cli/tray/autostart.jsView on unpkg · L3

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

cli.jsView file

783console.log(`🔔 PolyRouter is running in tray (PID: ${process.pid})`); L784: console.log(` Server: http://${displayHost}:${port}`); L785: console.log(`\n💡 You can close this terminal. Right-click tray icon to quit.\n`); ... L793: L794: const bgProcess = spawn(process.execPath, ["--dns-result-order=ipv4first", __filename, "--tray", "--skip-update", "-p", port.toString()], { L795: detached: true, ... L797: windowsHide: true, L798: env: { ...process.env } L799: });

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

cli.jsView on unpkg · L783

2L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const net = require("net"); ... L36: start() { L37: if (process.stdout.isTTY) { L38: process.stdout.write(`\r${frames[0]} ${currentText}`); L39: interval = setInterval(() => { ... L64: L65: const pkg = require("./package.json");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

cli.jsView on unpkg · L2

2Trigger-reachable chain: scripts.dev -> cli.js L2: L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const net = require("net"); ... L36: start() { L37: if (process.stdout.isTTY) { L38: process.stdout.write(`\r${frames[0]} ${currentText}`); L39: interval = setInterval(() => { ... L64: L65: const pkg = require("./package.json");

Critical

Trigger Reachable Dangerous Capability

app/src/realtime/runtime.jsView file

1import { WebSocketServer, WebSocket } from "ws"; L2: import RealtimeUpstream from "./upstream.js"; ... L19: const internalHost = getInternalAuthHost(host); L20: const response = await fetch(`http://${internalHost}:${process.env.PORT || 20128}/api/realtime/authorize`, { L21: method: "POST", ... L32: }, L33: body: JSON.stringify({ L34: model: url.searchParams.get("model"), ... L40: }); L41: const payload = await response.json().catch(() => ({})); L42: if (!response.ok || !payload.accessToken) throw new Error(payload.error || "Realtime authentication failed.");

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

app/src/realtime/runtime.jsView on unpkg · L1

app/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View file

50const _picocolors = require("../../lib/picocolors"); L51: const _child_process = /*#__PURE__*/ _interop_require_default._(require("child_process")); L52: const _fs = /*#__PURE__*/ _interop_require_default._(require("fs")); ... L177: // Explicit config always wins L178: if (process.env.REACT_EDITOR) { L179: return _shellquote.default.parse(process.env.REACT_EDITOR); ... L184: try { L185: if (process.platform === "darwin") { L186: const output = _child_process.default.execSync("ps x").toString(); ... L259: // L260: // https://developer.apple.[redacted]ASLR_classes.html#//apple_ref/doc/uid/TP40000983-CH1g-BBCIAHJF:~:... L261: return input.replaceAll(/[\\"]/g, (original)=>`\\${original}`);\n}\nfunction launchEditor(fileName, line1, column1) {\n if (!_fs.default.existsSync(fileName)) {\

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

app/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View on unpkg · L50

app/node_modules/playwright-core/lib/coreBundle.jsView file

21933"use strict"; L21934: source5 = '\nvar __commonJS = obj => {\n let required = false;\n let result;\n return function __require() {\n if (!required) {\n required = true;\n let fn;\n ... L21935: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

app/node_modules/playwright-core/lib/coreBundle.jsView on unpkg · L21933

app/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={582:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

app/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView file

•path = app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.node kind = binary_string_ioc sizeBytes = 11022768 magicHex = [redacted] matchedPrintableString = x.crates.io-6f17d22bba15001f/proxy-protocol-0.5.0/src/version1.rscryptoproviderkx_groupssignature_verification_algorithmssecure_randomkey_providerillegaladdressfamilymissingaddressinvalidaddressinvalidportillegalheaderendingstdiodestinationhttps://ngrok.com/docs/errors "0", "1", "2", or "3"0, 1, or 2struct authrespstruct authrespextrastruct bindrespextrastruct starttunnelwithlabelrespstruct unbindrespstruct proxyheaderevent /[redacted].crates.io-6f17d2

Critical

Binary String Ioc

Native or WebAssembly artifact printable strings contain known collector or webhook infrastructure.

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView on unpkg

•path = app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.node kind = native_binary sizeBytes = 11022768 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView on unpkg

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4795 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/public/downloads/polyrouter-connector.zipView file

•path = app/public/downloads/polyrouter-connector.zip kind = high_entropy_blob sizeBytes = 41038 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = compressed_blob sizeBytes = 41038 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = nested_archive_needs_inspection sizeBytes = 41038 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

app/public/downloads/polyrouter-connector.zipView on unpkg

app/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 54

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View on unpkg

app/node_modules/@next/env/dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/node_modules/@next/env/dist/index.jsView on unpkg

app/.next-cli-build/server/chunks/7688.jsView file

197patternName = generic_password severity = medium line = 197

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/server/chunks/7688.js

app/.next-cli-build/server/chunks/7688.jsView on unpkg · L197

app/.next-cli-build/server/chunks/6770.jsView file

215patternName = generic_password severity = medium line = 215

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/server/chunks/6770.js

app/.next-cli-build/server/chunks/6770.jsView on unpkg · L215

app/.next-cli-build/static/chunks/3771-3644573d812f5988.jsView file

9patternName = generic_password severity = medium line = 9

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/static/chunks/3771-3644573d812f5988.js

app/.next-cli-build/static/chunks/3771-3644573d812f5988.jsView on unpkg · L9

app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.jsView file

6patternName = generic_password severity = medium line = 6

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.js

app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.jsView on unpkg · L6

Source & flagged code

33 flagged · loading source

package.jsonView file

•scripts.postinstall = node hooks/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node hooks/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/.next-cli-build/server/instrumentation.jsView file

8patternName = generic_password severity = medium line = 8

Medium

Secret Pattern

Package contains a possible secret pattern.

app/.next-cli-build/server/instrumentation.jsView on unpkg · L8

app/src/mitm/server.jsView file

32`)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Po(e){let t=42949672... L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolU... L34: $proc = Start-Process powershell -ArgumentList @(

High

Child Process

Package source references child process execution.

app/src/mitm/server.jsView on unpkg · L32

High

Shell

Package source references shell execution.

app/src/mitm/server.jsView on unpkg · L32

24Private-MAC: `+B.digest().toHex()+`\r L25: `,s};ma.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return vr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};ma.private... L26: `);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ea(`[SSE in] ${y.slice(0,200... ... L32: `)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Po(e){let t=42949672... L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolU.

app/node_modules/minimizer-webpack-plugin/dist/minify.jsView file

487// eslint-disable-next-line no-new-func L488: new Function("exports", "require", "module", "__filename", "__dirname", `'use strict'\nreturn ${options}` L489: // eslint-disable-next-line n/exports-style

High

Eval

Package source references dynamic code evaluation.

app/node_modules/minimizer-webpack-plugin/dist/minify.jsView on unpkg · L487

app/server.jsView file

1const path = require('path') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

app/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.jsView file

1/* L2: MIT License http://www.opensource.org/licenses/mit-license.php L3: Author Tobias Koppers @sokra

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

app/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.jsView on unpkg · L1

app/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

app/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

src/cli/tray/autostart.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/cli/tray/autostart.jsView on unpkg · L3

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

cli.jsView on unpkg · L783

Critical

Download Execute

Source downloads or fetches remote code and executes it.

cli.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

app/src/realtime/runtime.jsView file

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

app/src/realtime/runtime.jsView on unpkg · L1

app/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

app/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View on unpkg · L50

app/node_modules/playwright-core/lib/coreBundle.jsView file

21933"use strict"; L21934: source5 = '\nvar __commonJS = obj => {\n let required = false;\n let result;\n return function __require() {\n if (!required) {\n required = true;\n let fn;\n ... L21935: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

app/node_modules/playwright-core/lib/coreBundle.jsView on unpkg · L21933

app/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={582:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

app/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView file

Critical

Binary String Ioc

Native or WebAssembly artifact printable strings contain known collector or webhook infrastructure.

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView on unpkg

•path = app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.node kind = native_binary sizeBytes = 11022768 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView on unpkg

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4795 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/public/downloads/polyrouter-connector.zipView file

•path = app/public/downloads/polyrouter-connector.zip kind = high_entropy_blob sizeBytes = 41038 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = compressed_blob sizeBytes = 41038 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = nested_archive_needs_inspection sizeBytes = 41038 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

app/public/downloads/polyrouter-connector.zipView on unpkg

app/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 54

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View on unpkg

app/node_modules/@next/env/dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/node_modules/@next/env/dist/index.jsView on unpkg

app/.next-cli-build/server/chunks/7688.jsView file

197patternName = generic_password severity = medium line = 197

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/server/chunks/7688.js

app/.next-cli-build/server/chunks/7688.jsView on unpkg · L197

app/.next-cli-build/server/chunks/6770.jsView file

215patternName = generic_password severity = medium line = 215

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/server/chunks/6770.js

app/.next-cli-build/server/chunks/6770.jsView on unpkg · L215

app/.next-cli-build/static/chunks/3771-3644573d812f5988.jsView file

9patternName = generic_password severity = medium line = 9

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/static/chunks/3771-3644573d812f5988.js

app/.next-cli-build/static/chunks/3771-3644573d812f5988.jsView on unpkg · L9

app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.jsView file

6patternName = generic_password severity = medium line = 6

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.js

app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.jsView on unpkg · L6

Findings

5 Critical14 High15 Medium7 Low

CriticalSame File Env Network Executioncli.js

CriticalDownload Executecli.js

CriticalRemote Response Code Executionapp/node_modules/next/dist/compiled/jest-worker/threadChild.js

CriticalTrigger Reachable Dangerous Capabilitycli.js

CriticalBinary String Iocapp/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.node

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processapp/src/mitm/server.js

HighShellapp/src/mitm/server.js

HighEvalapp/node_modules/minimizer-webpack-plugin/dist/minify.js

HighCredential Exfiltrationapp/src/realtime/runtime.js

HighCommand Output Exfiltrationapp/src/mitm/server.js

HighSandbox Evasion Gated Capabilityapp/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1

HighObfuscated Payload Loaderapp/node_modules/playwright-core/lib/coreBundle.js

HighCross File Remote Execution Contextcli.js

HighTrigger Reachable Persistencesrc/cli/tray/autostart.js

HighRuntime Package Installapp/src/lib/updater/updater.js

HighShips High Entropy Blobapp/public/downloads/polyrouter-connector.zip

HighSemantic Analysis Limitedapp/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1

HighKnown Malware Source Similarityapp/node_modules/@next/env/dist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patternapp/.next-cli-build/server/instrumentation.js

MediumDynamic Requireapp/server.js

MediumUnsafe Vm Contextapp/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/cli/tray/autostart.js

MediumShips Native Binaryapp/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.node

MediumShips Build Helpersrc/cli/tray/tray.ps1

MediumShips Compressed Blobapp/public/downloads/polyrouter-connector.zip

MediumStructural Risk Force Deep Review

MediumSecret Patternapp/.next-cli-build/server/chunks/7688.js

MediumSecret Patternapp/.next-cli-build/server/chunks/6770.js

MediumSecret Patternapp/.next-cli-build/static/chunks/3771-3644573d812f5988.js

MediumSecret Patternapp/.next-cli-build/static/chunks/main-d6eb74e339715f4d.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptoapp/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionapp/public/downloads/polyrouter-connector.zip

Source & flagged code

33 flagged

package.jsonView file

Lines 1-41json

2 "name": "polyrouter",

3 "version": "1.0.35",

4 "description": "Local AI gateway and OpenAI-compatible API router for AI coding tools and 60+ providers",

5 "bin": {

6 "polyrouter": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepublishOnly": "npm run build"

23 },

24 "dependencies": {

25 "enquirer": "^2.4.1",

26 "node-forge": "^1.3.3",

27 "node-machine-id": "^1.1.12",

28 "react": "19.2.1",

29 "react-dom": "19.2.1"

30 },

33 "engines": {

34 "node": ">=18.0.0"

35 },

36 "keywords": [

37 "polyrouter",

38 "ai gateway",

39 "ai router",

40 "openai compatible",

41 "openai api",

app/.next-cli-build/server/instrumentation.jsView file

8patternName = generic_password severity = medium line = 8

Medium

Secret Pattern

Package contains a possible secret pattern.

app/.next-cli-build/server/instrumentation.jsView on unpkg · L8

app/src/mitm/server.jsView file

Lines 12-52javascript

12`),a+=Xr.util.encode64(e.body,t.maxline||64)+`\r

13`,a+="-----END "+e.type+`-----\r

14`,a};xi.decode=function(e){for(var t=[],a=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s

app/node_modules/minimizer-webpack-plugin/dist/minify.jsView file

Lines 467-496javascript

467 warnings,

468 errors,

469 extractedComments

470 };

471}

472

473/**

474 * @param {string} options options

475 * @returns

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

app/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.jsView file

Lines 1-21javascript

1/*

2 MIT License http://www.opensource.org/licenses/mit-license.php

3 Author Tobias Koppers @sokra

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

app/node_modules/webpack/lib/javascript/JavascriptModulesPlugin.jsView on unpkg · L1

4*/

6"use strict";

8const vm

app/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

app/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

src/cli/tray/autostart.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/cli/tray/autostart.jsView on unpkg · L3

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

cli.jsView on unpkg · L783

Critical

Download Execute

Source downloads or fetches remote code and executes it.

cli.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

app/src/realtime/runtime.jsView file

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

app/src/realtime/runtime.jsView on unpkg · L1

app/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

app/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View on unpkg · L50

app/node_modules/playwright-core/lib/coreBundle.jsView file

21933"use strict"; L21934: source5 = '\nvar __commonJS = obj => {\n let required = false;\n let result;\n return function __require() {\n if (!required) {\n required = true;\n let fn;\n ... L21935: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

app/node_modules/playwright-core/lib/coreBundle.jsView on unpkg · L21933

app/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={582:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

app/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView file

Critical

Binary String Ioc

Native or WebAssembly artifact printable strings contain known collector or webhook infrastructure.

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView on unpkg

•path = app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.node kind = native_binary sizeBytes = 11022768 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

app/node_modules/@ngrok/ngrok-linux-x64-gnu/ngrok.linux-x64-gnu.nodeView on unpkg

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4795 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/public/downloads/polyrouter-connector.zipView file

•path = app/public/downloads/polyrouter-connector.zip kind = high_entropy_blob sizeBytes = 41038 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = compressed_blob sizeBytes = 41038 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

app/public/downloads/polyrouter-connector.zipView on unpkg

•path = app/public/downloads/polyrouter-connector.zip kind = nested_archive_needs_inspection sizeBytes = 41038 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

app/public/downloads/polyrouter-connector.zipView on unpkg

app/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 54

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View on unpkg

app/node_modules/@next/env/dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/node_modules/@next/env/dist/index.jsView on unpkg

app/.next-cli-build/server/chunks/7688.jsView file

197patternName = generic_password severity = medium line = 197

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/server/chunks/7688.js

app/.next-cli-build/server/chunks/7688.jsView on unpkg · L197

app/.next-cli-build/server/chunks/6770.jsView file

215patternName = generic_password severity = medium line = 215

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/server/chunks/6770.js

app/.next-cli-build/server/chunks/6770.jsView on unpkg · L215

app/.next-cli-build/static/chunks/3771-3644573d812f5988.jsView file

9patternName = generic_password severity = medium line = 9

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/static/chunks/3771-3644573d812f5988.js

app/.next-cli-build/static/chunks/3771-3644573d812f5988.jsView on unpkg · L9

app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.jsView file

6patternName = generic_password severity = medium line = 6

Medium

Secret Pattern

Hardcoded password in app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.js

app/.next-cli-build/static/chunks/main-d6eb74e339715f4d.jsView on unpkg · L6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code