zevairouter@1.0.90: Suspicious npm security report (Warn)

Loading npm security reports…

zevairouter@1.0.90: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`package.json` runs `cli/hooks/postinstall.js` on install.
`cli/hooks/postinstall.js` silently provisions runtime dependencies and browser tooling.
`cli/hooks/sqliteRuntime.js` runs nested `npm install` in `~/.zevai/runtime`.
`cli/hooks/playwrightRuntime.js` installs Playwright and invokes its Chromium installer.
`src/app/api/cli-tools/cline-settings/route.js` writes supplied gateway keys into Cline settings.
`src/app/api/cli-tools/openclaw-settings/route.js` writes Zevai provider settings into `~/.openclaw`.

Evidence against

Postinstall source only targets the package-owned `~/.zevai/runtime` directory.
No inspected lifecycle code writes Cline, OpenClaw, Claude, Cursor, or Codex configuration.
`src/proxy.js` protects non-public `/api/*` routes with dashboard or CLI-token authentication.
Cline/OpenClaw mutations require explicit authenticated POST requests with supplied values.
`src/app/api/cli-tools/cowork-settings/route.js` immediately disables POST with HTTP 403.
No confirmed credential exfiltration, remote payload execution, or destructive lifecycle behavior in inspected files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 755 file(s), 5.07 MB of source, external domains: 127.0.0.1, 5sim.net, abc-tunnel.us, accounts.google.com, accounts.x.ai, agent.api5.cursor.sh, agentn.api5.cursor.sh, agentrouter.org, ai-gateway.vercel.sh, ai.enally.in, ai.google.dev, aiplatform.googleapis.com, aistudio.google.com, antigravity.google, api-dashboard.search.brave.com, api-inference.huggingface.co, api.ai21.com, api.aimlapi.com, api.anthropic.com, api.assemblyai.com, api.bfl.ai, api.blackbox.ai, api.bytez.com, api.cartesia.ai, api.cast.ai, api.cerebras.ai, api.cline.bot, api.cloudflare.com, api.cohere.ai, api.commandcode.ai, api.deepgram.com, api.deepinfra.com, api.deepseek.com, api.deno.com, api.dev.runwayml.com, api.elevenlabs.io, api.exa.ai, api.example.com, api.fal.ai, api.featherless.ai, api.firecrawl.dev, api.fireworks.ai, api.freetheai.xyz, api.github.com, api.githubcopilot.com, api.groq.com, api.hyperbolic.xyz, api.inference.net, api.inworld.ai, api.jina.ai

Source & flagged code

19 flagged

package.jsonView file

Lines 14-54json

14 "assets/",

15 "images/",

16 "open-sse/",

17 "next.config.mjs",

18 "postcss.config.mjs",

19 "jsconfig.json",

20 "start.sh",

21 "package.json",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "scripts": {

27 "dev": "next dev --webpack --port 1997",

28 "build": "next build --webpack",

29 "start": "node ./scripts/start-standalone.mjs",

30 "dev:bun": "bun --bun next dev --webpack --port 1997",

31 "build:bun": "bun --bun next build --webpack",

32 "start:bun": "bun ./.next/standalone/server.js",

33 "prepack": "node cli/scripts/build-cli.js",

34 "postinstall": "node cli/hooks/postinstall.js || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "@dnd-kit/core": "^6.3.1",

38 "@dnd-kit/modifiers": "^9.0.0",

39 "@dnd-kit/sortable": "^10.0.0",

40 "@dnd-kit/utilities": "^3.2.2",

41 "@monaco-editor/react": "^4.7.0",

42 "@xterm/addon-fit": "^0.11.0",

43 "@xterm/addon-web-links": "^0.12.0",

44 "@xterm/xterm": "^6.0.0",

45 "@xyflow/react": "^12.10.1",

46 "bcryptjs": "^3.0.3",

47 "confbox": "^0.2.4",

48 "express": "^5.2.1",

49 "fs": "^0.0.1-security",

50 "http-proxy-middleware": "^3.0.5",

51 "jose": "^6.1.3",

52 "marked": "^18.0.1",

53 "material-symbols": "^0.45.1",

54 "monaco-editor": "^0.55.1",

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

cli/app/.next-cli-build/server/chunks/2540.jsView file

Lines 1-1javascript

1"use strict";exports.id=2540,exports.ids=[2540],exports.modules={37221:(a,b,c)=>{let

open-sse/handlers/ttsProviders/localDevice.jsView file

Lines 1-55javascript

1// Local device TTS — macOS `say` + Windows SAPI + ffmpeg

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L1

4import { mkdtemp, readFile, rm } from

open-sse/translator/index.jsView file

Lines 12-52javascript

13// Track initialization state

14let initialized = false;

16// Register translator

17export function register(from, to, requestFn, responseFn

src/mitm/cert/install.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const crypto = require("crypto");

3const { exec } = require

cli/src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require

cli/app/src/mitm/server.jsView file

24Private-MAC: `+B.digest().toHex()+`\r L25: `,s};ma.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return vr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};ma.private... L26: `);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ea(`[SSE in] ${y.slice(0,200... ... L32: `)}catch{}}var od=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function ko(e){let t=42949672... L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function fd(e){let t=e.toolU.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/app/src/mitm/server.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = zevairouter@1.0.81 matchedIdentity = npm:emV2YWlyb3V0ZXI:1.0.81 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/cli.jsView on unpkg

2L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const os = require("os"); ... L16: start() { L17: if (process.stdout.isTTY) { L18: process.stdout.write(`\r${frames[0]} ${currentText}`); L19: interval = setInterval(() => { ... L44: L45: // Prefer root package.json (published name zevairouter) so CLI -v matches dashboard.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/cli.jsView on unpkg · L2

2Cross-file remote execution chain: cli/cli.js spawns cli/app/src/mitm/server.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const os = require("os"); ... L16: start() { L17: if (process.stdout.isTTY) { L18: process.stdout.write(`\r${frames[0]} ${currentText}`); L19: interval = setInterval(() => { ... L44: L45: // Prefer root package.json (published name zevairouter) so CLI -v matches dashboard.

cli/app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/app/src/lib/updater/updater.jsView on unpkg · L1

cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/ter…View file

•path = [redacted].py kind = build_helper sizeBytes = 4604 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View file

•path = cli/app/.next-cli-[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 25844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View on unpkg

cli/app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in cli/app/.next-cli-build/server/chunks/8971.js

cli/app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli/hooks/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

•scripts.postinstall = node cli/hooks/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/app/.next-cli-build/server/chunks/2540.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

cli/app/.next-cli-build/server/chunks/2540.jsView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in cli/app/.next-cli-build/server/chunks/2540.js

cli/app/.next-cli-build/server/chunks/2540.jsView on unpkg · L1

open-sse/handlers/ttsProviders/localDevice.jsView file

1// Local device TTS — macOS `say` + Windows SAPI + ffmpeg L2: import { execFile } from "node:child_process"; L3: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L1

35const { stdout } = await execFileAsync( L36: "powershell.exe", L37: ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", script],

High

Shell

Package source references shell execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L35

open-sse/translator/index.jsView file

32// Request translators - sync require pattern for bundler L33: require("./request/claude-to-openai.js"); L34: require("./request/openai-to-claude.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

open-sse/translator/index.jsView on unpkg · L32

src/mitm/cert/install.jsView file

2const crypto = require("crypto"); L3: const { exec } = require("child_process"); L4: const { execWithPassword, isSudoAvailable } = require("../dns/dnsConfig.js"); ... L7: L8: const IS_WIN = process.platform === "win32"; L9: const IS_MAC = process.platform === "darwin"; ... L31: // Also remove historical CA names during uninstall/reinstall L32: const LEGACY_ROOT_CA_CN = "ZevaiRouter MITM Root CA".replace("ZevaiRouter", String.fromCharCode(57) + "Router"); L33: ... L54: // Verify exact cert bytes match — same CN with different fingerprint = stale cert L55: exec(`security find-certificate -a -c "${ROOT_CA_CN}" -Z /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (error, stdout) => { L56: if (error || !stdout) return resolve(false);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/mitm/cert/install.jsView on unpkg · L2

cli/src/cli/tray/autostart.jsView file

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/cli/tray/autostart.jsView on unpkg · L3

cli/app/src/mitm/server.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/app/src/mitm/server.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/cli.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/cli.jsView on unpkg · L2

cli/app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/app/src/lib/updater/updater.jsView on unpkg · L1

•path = [redacted].py kind = build_helper sizeBytes = 4604 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View file

•path = cli/app/.next-cli-[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 25844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View on unpkg

cli/app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in cli/app/.next-cli-build/server/chunks/8971.js

cli/app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

19 flagged

package.jsonView file

Lines 14-54json

14 "assets/",

15 "images/",

16 "open-sse/",

17 "next.config.mjs",

18 "postcss.config.mjs",

19 "jsconfig.json",

20 "start.sh",

21 "package.json",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "scripts": {

27 "dev": "next dev --webpack --port 1997",

28 "build": "next build --webpack",

29 "start": "node ./scripts/start-standalone.mjs",

30 "dev:bun": "bun --bun next dev --webpack --port 1997",

31 "build:bun": "bun --bun next build --webpack",

32 "start:bun": "bun ./.next/standalone/server.js",

33 "prepack": "node cli/scripts/build-cli.js",

34 "postinstall": "node cli/hooks/postinstall.js || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "@dnd-kit/core": "^6.3.1",

38 "@dnd-kit/modifiers": "^9.0.0",

39 "@dnd-kit/sortable": "^10.0.0",

40 "@dnd-kit/utilities": "^3.2.2",

41 "@monaco-editor/react": "^4.7.0",

42 "@xterm/addon-fit": "^0.11.0",

43 "@xterm/addon-web-links": "^0.12.0",

44 "@xterm/xterm": "^6.0.0",

45 "@xyflow/react": "^12.10.1",

46 "bcryptjs": "^3.0.3",

47 "confbox": "^0.2.4",

48 "express": "^5.2.1",

49 "fs": "^0.0.1-security",

50 "http-proxy-middleware": "^3.0.5",

51 "jose": "^6.1.3",

52 "marked": "^18.0.1",

53 "material-symbols": "^0.45.1",

54 "monaco-editor": "^0.55.1",

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

cli/app/.next-cli-build/server/chunks/2540.jsView file

Lines 1-1javascript

1"use strict";exports.id=2540,exports.ids=[2540],exports.modules={37221:(a,b,c)=>{let

open-sse/handlers/ttsProviders/localDevice.jsView file

Lines 1-55javascript

1// Local device TTS — macOS `say` + Windows SAPI + ffmpeg

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

open-sse/handlers/ttsProviders/localDevice.jsView on unpkg · L1

4import { mkdtemp, readFile, rm } from

open-sse/translator/index.jsView file

Lines 12-52javascript

13// Track initialization state

14let initialized = false;

16// Register translator

17export function register(from, to, requestFn, responseFn

src/mitm/cert/install.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const crypto = require("crypto");

3const { exec } = require

cli/src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require

cli/app/src/mitm/server.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/app/src/mitm/server.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/cli.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/cli.jsView on unpkg · L2

cli/app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/app/src/lib/updater/updater.jsView on unpkg · L1

•path = [redacted].py kind = build_helper sizeBytes = 4604 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View file

•path = cli/app/.next-cli-[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 25844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View on unpkg

cli/app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in cli/app/.next-cli-build/server/chunks/8971.js

cli/app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

zevairouter@1.0.90

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code