Source repositories
Runtime: github.com/gostartkit/tcptun-go. Website: github.com/sskycn/tcptun.
tcptunSecurity & trust
Inspect, pin, fail closed.
tcptun is open for inspection: runtime source, release tags, npm package layout, and an installer you can read before executing. This page documents supply chain and security properties without marketing claims.
Supply chain
Where binaries come from.
Release process
CLI binaries ship inside the public npm package [email protected]. Tagged releases: GitHub Releases.
Build identity
Runtime builds expose version identity (for example CoreVersion / build metadata on supported bridges). Prefer matching versions on both tunnel ends for mux and resume.
Package layout
Individual files: https://cdn.jsdelivr.net/npm/[email protected]/dist/tcptun-<platform>-<arch>. Tarball: https://registry.npmjs.org/tcptun/-/tcptun-0.5.0.tgz.
Installation safety
Do not pipe untrusted scripts blindly.
The one-liner is convenient. Safer flow: download, inspect, then run. Or install via npm without shell piping. curl -fsSL https://tcptun.com/install.sh | sh
recommended install flow
# 1) Download installer for inspection
curl -fsSL https://tcptun.com/install.sh -o install-tcptun.sh
# 2) Read it
less install-tcptun.sh
# 3) Run only if you accept the script
sh install-tcptun.sh
# Prefer pinning a version
TCPTUN_VERSION=0.5.0 sh install-tcptun.sh
# Or install from npm without curl|sh
npm install -g [email protected]- Pinned:
curl -fsSL https://tcptun.com/install.sh | TCPTUN_VERSION=0.5.0 sh - npm:
npm install -g [email protected] - Raw installer: https://tcptun.com/install.sh
Runtime properties
Security-relevant defaults.
Strict configuration validation
Unknown fields are rejected. Tags, references, auth, transport, and security combinations are checked before listeners open.
Fail closed
Invalid topology does not partially start. DNS and routing refuse hidden unsafe fallbacks when validation fails.
Bounded resources
Mux pools, resume buffers, and packet paths use explicit budgets for predictable long-running services.
No credential logging by default
Operators control log level; browser tools generate keys locally and do not upload material to this site.