ai-node-relay @0.0.1

Summary

Package ships a heavily obfuscated main bundle (dist/index.js, javascript-obfuscator string-array rotation and control-flow flattening) whose top-level main() boots a Fastify relay server on require()/start. Remote endpoints are derived from operator-supplied GATEWAY_URL / REDIS_URL / NODE_TOKEN env vars or config; no hardcoded exfiltration endpoint, install-time fetch+execute, credential scraping, or installer-secret reads were observed in the deobfuscated code. package.json scripts.start and scripts.dev hardcode the author's own gateway token (NODE_TOKEN=nt_6b136c93...) which only authenticates to the author's gateway per the README — author-side credential leak, not installer harm. Concerns warranting human review: (a) main entry self-executes a server and binds a port on require(), atypical for a library main; (b) the shipped bundle is obfuscated, reducing reviewability of a network-facing relay; (c) the author has leaked their own gateway token in shipped scripts. None of these constitute a supply-chain attack against installers, but the combination warrants reviewer judgment before recommending the package.

Source: amazon-inspector (d52a729e61a47daa4fce45f76a2b6a3900b6664fdc599035b6cb1be327420e52)