Node9 Proxy

Detected

• Talks to external services8 places

  Makes outbound requests. The hosts are listed so you can see where data goes.

  api.github.com, api.mycompany.com, api.node9.ai, api.scorecard.dev, api.stripe.com

• Reads environment variables in bulk2 places

  Copies or enumerates the whole environment, which can include keys meant for other tools.

• Sends conversation content outward4 places

  Logs or forwards prompts, messages or tool results to a service outside your machine.

• Loads code at runtime2 places

  Uses eval, dynamic imports or encoded payloads, which static review cannot fully follow.

• Reads or writes other agents' configuration1 places

  Touches folders such as ~/.claude, ~/.codex or ~/.cursor, which hold settings and sometimes keys.

• Accesses credential files64 places

  References SSH keys, cloud credential files or token stores.

• Reads local configuration files50 places

  Loads a .env, .npmrc or config file. Normal for a server that needs an API key.

• Uses elevated privileges15 places

  sudo, the Docker socket or a privileged container appear in shipped code.

• Installs itself to run later3 places

  Writes startup entries, cron jobs or state files that outlive the session.

• Contains instructions aimed at AI agents10 places

  Text in code or agent-facing files that steers a model. Worth reading before you trust it.

• Passes model output on without checks3 places

  Model output reaches HTML, SQL or a shell without validation.

• Fetches user-supplied URLs2 places

  Requests arbitrary URLs, including internal addresses, based on input.

• Runs unpinned packages at runtime26 places

  Executes npx or uvx without a version, so a compromised upstream release would run.

Not detected: runs shell commands, matches a known malicious pattern.

Dependencies with known advisories

None found in the lockfiles and manifests checked against OSV.dev.

Left out of the profile

99 pattern matches in documentation, configuration or CI files were recorded but are not part of the profile, because they do not run when the server does. The owner dashboard lists them.