registry / zevairouter / 1.0.29

zevairouter@1.0.29

ZevaiRouter - AI Router with provider automation, multi-account workflows, and quota tracking

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The confirmed risk is install-time dependency/browser installation into a user runtime directory, plus user-invoked CLI tool configuration writes. No source-grounded malicious exfiltration, destructive behavior, or unconsented AI-agent control hijack was confirmed.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall; later zevai CLI/dashboard actions can invoke updater or CLI tool setup

Impact

Unexpected install-time network/package-manager activity and native/browser payload download; user-invoked config changes route local AI tools through ZevaiRouter

Mechanism

install hook installs runtime dependencies and Playwright Chromium; runtime UI can update package and write local tool configs

Attack narrative

On installation, postinstall warms runtime components by installing better-sqlite3, systray2, playwright, and Chromium into ~/.zevai/runtime. At runtime, the router can check npm for updates, run npm i -g, proxy AI-provider traffic, and, when a user selects setup actions, write Claude/Codex configuration files to point at the local router. This is risky install-hook behavior but aligns with the package’s router/desktop automation functionality.

Rationale

Static inspection confirms install-time network/package-manager activity and runtime config-writing capability, but not credential theft, hidden exfiltration, destructive behavior, or unconsented AI-agent control-surface mutation. Treat as warning-worthy install-hook abuse rather than malicious.

Evidence

package.jsoncli/hooks/postinstall.jscli/hooks/sqliteRuntime.jscli/hooks/trayRuntime.jscli/hooks/playwrightRuntime.jscli/cli.jssrc/lib/updater/updater.jssrc/app/api/cli-tools/codex-settings/route.jssrc/app/api/cli-tools/claude-settings/route.jsopen-sse/translator/index.js

Network endpoints1

registry.npmjs.org/zevairouter/latest

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs postinstall: node cli/hooks/postinstall.js || exit 0
cli/hooks/postinstall.js calls ensureSqliteRuntime, ensureTrayRuntime, and ensurePlaywrightRuntime at install time
cli/hooks/sqliteRuntime.js runs npm install better-sqlite3@12.6.2 into ~/.zevai/runtime
cli/hooks/trayRuntime.js installs systray2@2.1.4 and removes legacy systray from runtime dirs
cli/hooks/playwrightRuntime.js installs playwright and runs playwright install chromium
src/app/api/cli-tools/codex-settings/route.js can write ~/.codex/config.toml and auth.json when invoked

Evidence against

No install-time credential harvesting or exfiltration found in inspected hooks
Runtime npm installs target named dependencies matching package features: SQLite, tray, Playwright automation
Network use is mostly package-aligned router/updater/provider traffic
Codex and Claude config writes are behind explicit API/menu actions, not lifecycle execution
No prompt/reviewer manipulation strings found in source search
Scanner secret hit in bundled chunk is jose library code, not an embedded credential

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 668 file(s), 4.41 MB of source, external domains: 127.0.0.1, abc-tunnel.us, accounts.google.com, agent.api5.cursor.sh, agentn.api5.cursor.sh, agentrouter.org, ai-gateway.vercel.sh, ai.enally.in, ai.google.dev, aiplatform.googleapis.com, aistudio.google.com, antigravity.google, api-dashboard.search.brave.com, api-inference.huggingface.co, api.ai21.com, api.aimlapi.com, api.anthropic.com, api.assemblyai.com, api.bfl.ai, api.blackbox.ai, api.bytez.com, api.cartesia.ai, api.cerebras.ai, api.cline.bot, api.cloudflare.com, api.cohere.ai, api.commandcode.ai, api.deepgram.com, api.deepinfra.com, api.deepseek.com, api.deno.com, api.dev.runwayml.com, api.elevenlabs.io, api.exa.ai, api.example.com, api.fal.ai, api.firecrawl.dev, api.fireworks.ai, api.freetheai.xyz, api.github.com, api.githubcopilot.com, api.groq.com, api.hyperbolic.xyz, api.inference.net, api.inworld.ai, api.jina.ai, api.kilo.ai, api.kimi.com, api.kluster.ai, api.lepton.ai

Source & flagged code

18 flagged

package.jsonView file

Lines 14-54json

14 "assets/",

15 "images/",

16 "open-sse/",

17 "next.config.mjs",

18 "postcss.config.mjs",

19 "jsconfig.json",

20 "start.sh",

21 "package.json",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "scripts": {

27 "dev": "next dev --webpack --port 1997",

28 "build": "next build --webpack",

29 "start": "node ./scripts/start-standalone.mjs",

30 "dev:bun": "bun --bun next dev --webpack --port 1997",

31 "build:bun": "bun --bun next build --webpack",

32 "start:bun": "bun ./.next/standalone/server.js",

33 "prepack": "node cli/scripts/build-cli.js",

34 "postinstall": "node cli/hooks/postinstall.js || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "@dnd-kit/core": "^6.3.1",

38 "@dnd-kit/modifiers": "^9.0.0",

39 "@dnd-kit/sortable": "^10.0.0",

40 "@dnd-kit/utilities": "^3.2.2",

41 "@monaco-editor/react": "^4.7.0",

42 "@xyflow/react": "^12.10.1",

43 "bcryptjs": "^3.0.3",

44 "confbox": "^0.2.4",

45 "express": "^5.2.1",

46 "fs": "^0.0.1-security",

47 "http-proxy-middleware": "^3.0.5",

48 "jose": "^6.1.3",

49 "marked": "^18.0.1",

50 "material-symbols": "^0.45.1",

51 "monaco-editor": "^0.55.1",

52 "next": "^16.1.6",

53 "node-forge": "^1.3.3",

54 "node-machine-id": "^1.1.12",

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

cli/app/.next-cli-build/server/chunks/42.jsView file

Lines 1-1javascript

1"use strict";exports.id=42,exports.ids=[42],exports.modules={37221:(a,b,c)=>{let d;c.d(b,{RD:()=>p});var e=c(99129

open-sse/handlers/ttsProviders/localDevice.jsView file

Lines 1-55javascript

1// Local device TTS — macOS `say` + Windows SAPI + ffmpeg

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L1

4import { mkdtemp, readFile, rm } from "node:fs/promises";

5import { tmpdir }

open-sse/translator/index.jsView file

Lines 12-52javascript

13// Track initialization state

14let initialized = false;

16// Register translator

17export function register(from, to, requestFn, responseFn) {

18 const key

src/mitm/cert/install.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const crypto = require("crypto");

3const { exec } = require("child_process");

4const { execWithPassword, isSudoAvailable

cli/src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require("os");

4const { execSync } =

cli/app/src/mitm/server.jsView file

24Private-MAC: `+B.digest().toHex()+`\r L25: `,s};ma.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return vr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};ma.private... L26: `);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ea(`[SSE in] ${y.slice(0,200... ... L32: `)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function ko(e){let t=42949672... L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolU... L34: $proc = Start-Process powershell -ArgumentList @(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/app/src/mitm/server.jsView on unpkg · L24

cli/cli.jsView file

2Cross-file remote execution chain: cli/cli.js spawns cli/app/src/mitm/server.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const os = require("os"); ... L16: start() { L17: if (process.stdout.isTTY) { L18: process.stdout.write(`\r${frames[0]} ${currentText}`); L19: interval = setInterval(() => { ... L44: L45: const pkg = require("./package.json");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli/cli.jsView on unpkg · L2

cli/app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/app/src/lib/updater/updater.jsView on unpkg · L1

cli/src/cli/tray/tray.ps1View file

•path = cli/src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/src/cli/tray/tray.ps1View on unpkg

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View file

•path = cli/app/.next-cli-[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 25844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View on unpkg

cli/app/cli/hooks/sqliteRuntime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = zevairouter@1.0.28 matchedIdentity = npm:emV2YWlyb3V0ZXI:1.0.28 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

cli/app/cli/hooks/sqliteRuntime.jsView on unpkg

cli/app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in cli/app/.next-cli-build/server/chunks/8971.js

cli/app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli/hooks/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

•scripts.postinstall = node cli/hooks/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/app/.next-cli-build/server/chunks/42.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

cli/app/.next-cli-build/server/chunks/42.jsView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in cli/app/.next-cli-build/server/chunks/42.js

cli/app/.next-cli-build/server/chunks/42.jsView on unpkg · L1

open-sse/handlers/ttsProviders/localDevice.jsView file

1// Local device TTS — macOS `say` + Windows SAPI + ffmpeg L2: import { execFile } from "node:child_process"; L3: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L1

35const { stdout } = await execFileAsync( L36: "powershell.exe", L37: ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", script],

High

Shell

Package source references shell execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L35

open-sse/translator/index.jsView file

32// Request translators - sync require pattern for bundler L33: require("./request/claude-to-openai.js"); L34: require("./request/openai-to-claude.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

open-sse/translator/index.jsView on unpkg · L32

src/mitm/cert/install.jsView file

2const crypto = require("crypto"); L3: const { exec } = require("child_process"); L4: const { execWithPassword, isSudoAvailable } = require("../dns/dnsConfig.js"); ... L7: L8: const IS_WIN = process.platform === "win32"; L9: const IS_MAC = process.platform === "darwin"; ... L34: const pem = fs.readFileSync(certPath, "utf-8"); L35: const der = Buffer.from(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, ""), "base64"); L36: return crypto.createHash("sha1").update(der).digest("hex").toUpperCase().match(/.{2}/g).join(":"); ... L52: // Verify exact cert bytes match — same CN with different fingerprint = stale cert L53: exec(`security find-certificate -a -c "${ROOT_CA_CN}" -Z /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (error, stdout) => { L54: if (error || !stdout) return resolve(false);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/mitm/cert/install.jsView on unpkg · L2

cli/src/cli/tray/autostart.jsView file

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/cli/tray/autostart.jsView on unpkg · L3

cli/app/src/mitm/server.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/app/src/mitm/server.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/app/src/mitm/server.jsView on unpkg · L24

cli/cli.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli/cli.jsView on unpkg · L2

cli/app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/app/src/lib/updater/updater.jsView on unpkg · L1

cli/src/cli/tray/tray.ps1View file

•path = cli/src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/src/cli/tray/tray.ps1View on unpkg

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View file

•path = cli/app/.next-cli-[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 25844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View on unpkg

cli/app/cli/hooks/sqliteRuntime.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

cli/app/cli/hooks/sqliteRuntime.jsView on unpkg

cli/app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in cli/app/.next-cli-build/server/chunks/8971.js

cli/app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Findings

4 Critical9 High7 Medium6 Low

CriticalCritical Secretcli/app/.next-cli-build/server/chunks/42.js

CriticalPrevious Version Dangerous Deltacli/app/cli/hooks/sqliteRuntime.js

CriticalSecret Patterncli/app/.next-cli-build/server/chunks/42.js

CriticalSecret Patterncli/app/.next-cli-build/server/chunks/8971.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processopen-sse/handlers/ttsProviders/localDevice.js

HighShellopen-sse/handlers/ttsProviders/localDevice.js

HighSame File Env Network Executioncli/app/src/mitm/server.js

HighCommand Output Exfiltrationcli/app/src/mitm/server.js

HighCross File Remote Execution Contextcli/cli.js

HighRuntime Package Installcli/app/src/lib/updater/updater.js

HighShips High Entropy Blobcli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2

HighNode Builtin Dependency Squatpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireopen-sse/translator/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencecli/src/cli/tray/autostart.js

MediumShips Build Helpercli/src/cli/tray/tray.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/mitm/cert/install.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

18 flagged

package.jsonView file

Lines 14-54json

14 "assets/",

15 "images/",

16 "open-sse/",

17 "next.config.mjs",

18 "postcss.config.mjs",

19 "jsconfig.json",

20 "start.sh",

21 "package.json",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "scripts": {

27 "dev": "next dev --webpack --port 1997",

28 "build": "next build --webpack",

29 "start": "node ./scripts/start-standalone.mjs",

30 "dev:bun": "bun --bun next dev --webpack --port 1997",

31 "build:bun": "bun --bun next build --webpack",

32 "start:bun": "bun ./.next/standalone/server.js",

33 "prepack": "node cli/scripts/build-cli.js",

34 "postinstall": "node cli/hooks/postinstall.js || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "@dnd-kit/core": "^6.3.1",

38 "@dnd-kit/modifiers": "^9.0.0",

39 "@dnd-kit/sortable": "^10.0.0",

40 "@dnd-kit/utilities": "^3.2.2",

41 "@monaco-editor/react": "^4.7.0",

42 "@xyflow/react": "^12.10.1",

43 "bcryptjs": "^3.0.3",

44 "confbox": "^0.2.4",

45 "express": "^5.2.1",

46 "fs": "^0.0.1-security",

47 "http-proxy-middleware": "^3.0.5",

48 "jose": "^6.1.3",

49 "marked": "^18.0.1",

50 "material-symbols": "^0.45.1",

51 "monaco-editor": "^0.55.1",

52 "next": "^16.1.6",

53 "node-forge": "^1.3.3",

54 "node-machine-id": "^1.1.12",

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

cli/app/.next-cli-build/server/chunks/42.jsView file

Lines 1-1javascript

1"use strict";exports.id=42,exports.ids=[42],exports.modules={37221:(a,b,c)=>{let d;c.d(b,{RD:()=>p});var e=c(99129

open-sse/handlers/ttsProviders/localDevice.jsView file

Lines 1-55javascript

1// Local device TTS — macOS `say` + Windows SAPI + ffmpeg

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L1

4import { mkdtemp, readFile, rm } from "node:fs/promises";

5import { tmpdir }

open-sse/translator/index.jsView file

Lines 12-52javascript

13// Track initialization state

14let initialized = false;

16// Register translator

17export function register(from, to, requestFn, responseFn) {

18 const key

src/mitm/cert/install.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const crypto = require("crypto");

3const { exec } = require("child_process");

4const { execWithPassword, isSudoAvailable

cli/src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require("os");

4const { execSync } =

cli/app/src/mitm/server.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/app/src/mitm/server.jsView on unpkg · L24

cli/cli.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli/cli.jsView on unpkg · L2

cli/app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/app/src/lib/updater/updater.jsView on unpkg · L1

cli/src/cli/tray/tray.ps1View file

•path = cli/src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/src/cli/tray/tray.ps1View on unpkg

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View file

•path = cli/app/.next-cli-[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 25844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View on unpkg

cli/app/cli/hooks/sqliteRuntime.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

cli/app/cli/hooks/sqliteRuntime.jsView on unpkg

cli/app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in cli/app/.next-cli-build/server/chunks/8971.js

cli/app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1