registry / @1presence/bridge / 0.66.0

@1presence/bridge@0.66.0

Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a user-invoked CLI bridge that connects local Claude Code to 1Presence services, with package-aligned network and local setup behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs npx @1presence/bridge or the 1presence-bridge bin.

Impact

Handles user chat/tool transcripts and bearer tokens for the intended bridge service; no evidence of covert exfiltration, install-time persistence, or foreign agent control mutation.

Mechanism

CLI bridge with auth, WebSocket relay, Claude Agent SDK MCP configuration, and runtime self-update check

Rationale

The suspicious primitives are consistent with the declared bridge CLI: runtime WebSocket/API calls, explicit local Claude Code invocation, token refresh, and constrained MCP setup. There is no install-time execution beyond tsc prepare, no broad AI-agent control-surface mutation, and no source evidence of credential harvesting or covert exfiltration.

Evidence

package.jsondist/index.jsdist/auth.jsdist/update.jsdist/claude.jsdist/claudeAuth.jsdist/outbox.jsdist/sessionPath.jsREADME.md~/.1presence/auth.json~/.1presence/outbox/*.json/tmp/agent-<uid>.md/tmp/mcp-<uid>.json/tmp/1presence-bridge/CLAUDE.md~/.claude/projects/<session>/*

Network endpoints4

api.1presence.comwss://api.1presence.com/bridgesecuretoken.googleapis.com/v1/tokenregistry.npmjs.org/@1presence/bridge/latest

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/update.js runtime check fetches npm latest and spawns npx for @1presence/bridge@latest.
dist/index.js writes per-user temp system prompt and MCP config containing a bearer token.
dist/claude.js creates a local MCP read_session_file tool, confined by dist/sessionPath.js.

Evidence against

package.json has no preinstall/install/postinstall; prepare is only tsc.
Network use is package-aligned bridge traffic to api.1presence.com, Firebase token refresh, and npm self-update check.
dist/claude.js disables built-in tools, uses strictMcpConfig, allowlists 1Presence/local MCP tools, and strips ANTHROPIC_API_KEY.
dist/auth.js browser auth uses localhost nonce and origin-scoped CORS; Firebase API key is commented as public web key.
dist/outbox.js spools only bridge turn records under ~/.1presence/outbox with mode 0600 for retry.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 135 KB of source, external domains: api.1presence.com, registry.npmjs.org, securetoken.googleapis.com

Source & flagged code

5 flagged

dist/auth.jsView file

Lines 166-206javascript

166 });

167 });

168 server.listen(0, '127.0.0.1', () => {

169 const { port } = server.address();

170 const authUrl = `${pwaUrl.replace(/\/$/, '')}/cli-auth?port=${port}&nonce=${encodeURIComponent(nonce)}`;

171 console.log('\nOpening browser for sign-in…');

172 console.log(`If the browser doesn't open, visit:\n ${authUrl}\n`);

173 openBrowser(authUrl);

174 });

175 setTimeout(() => {

176 if (resolved)

177 return;

178 resolved = true;

179 server.close();

180 reject(new Error('Sign-in timed out after 5 minutes. Please try again.'));

181 }, 5 * 60 * 1000);

182 });

183}

184// ─── Token refresh ────────────────────────────────────────────────────────────

185// Firebase web API key — public, safe to embed

186const FIREBASE_API_KEY = 'AIzaSyAz16A3eRIMhdLGF9ptsVsWZx9LjKeZwi8';

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L186

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L186

187async function refreshIdToken(refreshToken) {

188 const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`, {

189 method: 'POST',

190 headers: { 'Content-Type': 'application/json' },

191 body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshToken }),

192 });

193 if (!res.ok)

194 throw new Error(`Token refresh failed: ${res.status}`);

195 const data = await res.json();

196 if (!data.id_token)

197 throw new Error('Token refresh returned no id_token');

198 return data.id_token;

199}

200/** Headroom below which ensureFreshToken mints a new ID token at turn start.

201 * Firebase ID tokens live 60 min; the token is baked into the MCP SSE config

202 * header at spawn (writeMcpConfig) and reused by that connection for the whole

203 * turn — it can't be re-tokened mid-turn without reconnecting the MCP server.

204 * So a turn must START with enough headroom to outlive itself. At 10 min a turn

205 * that began with ~12 min of life and ran 17 min lost its MCP OAuth AND its

206 * save-turn token mid-flight ("MCP OAuth not configured" + save-turn 401 — see

dist/claudeAuth.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { createInterface } from 'node:readline';

High

Child Process

Package source references child process execution.

dist/claudeAuth.jsView on unpkg · L1

3/**

4 * Parse the stdout of `claude auth status --json`. Extracts the first JSON object

5 * (defensive against any banner/log noise around it). Returns null when there is

6 * no parseable object or no boolean `loggedIn` field — i.e. an output shape we

7 * don't recognise, which the caller treats as "unknown, don't block".

dist/update.jsView file

Lines 1-38javascript

1import { spawn } from 'child_process';

2import { createRequire } from 'module';

3// ESM JSON imports need version-sensitive import assertions; createRequire reads

4// the manifest synchronously on every Node 18+ without that fragility.

5const { version } = createRequire(import.meta.url)('../package.json');

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @1presence/bridge@0.65.0 matchedIdentity = npm:QDFwcmVzZW5jZS9icmlkZ2U:0.65.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/auth.jsView file

186patternName = google_api_key severity = high line = 186 matchedText = const FI...i8';

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L186

186patternName = google_api_key severity = high line = 186 matchedText = const FI...i8';

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L186

dist/claudeAuth.jsView file

1import { spawn } from 'node:child_process'; L2: import { createInterface } from 'node:readline';

High

Child Process

Package source references child process execution.

dist/claudeAuth.jsView on unpkg · L1

dist/update.jsView file

18try { L19: const res = await fetch('https://registry.npmjs.org/@1presence/bridge/latest', { L20: signal: AbortSignal.timeout(3000), ... L28: console.log(`Updating to v${latest}…\n`); L29: const child = spawn('npx', ['--yes', `@1presence/bridge@${latest}`], { L30: stdio: 'inherit', L31: env: process.env, L32: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/update.jsView on unpkg · L18

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

6 High2 Medium5 Low

HighHigh Secretdist/auth.js

HighChild Processdist/claudeAuth.js

HighShell

HighSame File Env Network Executiondist/update.js

HighPrevious Version Dangerous Deltadist/index.js

HighSecret Patterndist/auth.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/auth.jsView file

Lines 166-206javascript

166 });

167 });

168 server.listen(0, '127.0.0.1', () => {

169 const { port } = server.address();

170 const authUrl = `${pwaUrl.replace(/\/$/, '')}/cli-auth?port=${port}&nonce=${encodeURIComponent(nonce)}`;

171 console.log('\nOpening browser for sign-in…');

172 console.log(`If the browser doesn't open, visit:\n ${authUrl}\n`);

173 openBrowser(authUrl);

174 });

175 setTimeout(() => {

176 if (resolved)

177 return;

178 resolved = true;

179 server.close();

180 reject(new Error('Sign-in timed out after 5 minutes. Please try again.'));

181 }, 5 * 60 * 1000);

182 });

183}

185// Firebase web API key — public, safe to embed

186const FIREBASE_API_KEY = 'AIzaSyAz16A3eRIMhdLGF9ptsVsWZx9LjKeZwi8';

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L186

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L186

187async function refreshIdToken(refreshToken) {

188 const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`, {

189 method: 'POST',

190 headers: { 'Content-Type': 'application/json' },

191 body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshToken }),

192 });

193 if (!res.ok)

194 throw new Error(`Token refresh failed: ${res.status}`);

195 const data = await res.json();

196 if (!data.id_token)

197 throw new Error('Token refresh returned no id_token');

198 return data.id_token;

199}

200/** Headroom below which ensureFreshToken mints a new ID token at turn start.

201 * Firebase ID tokens live 60 min; the token is baked into the MCP SSE config

202 * header at spawn (writeMcpConfig) and reused by that connection for the whole

203 * turn — it can't be re-tokened mid-turn without reconnecting the MCP server.

204 * So a turn must START with enough headroom to outlive itself. At 10 min a turn

205 * that began with ~12 min of life and ran 17 min lost its MCP OAuth AND its

206 * save-turn token mid-flight ("MCP OAuth not configured" + save-turn 401 — see

dist/claudeAuth.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { createInterface } from 'node:readline';

High

Child Process

Package source references child process execution.

dist/claudeAuth.jsView on unpkg · L1

3/**

4 * Parse the stdout of `claude auth status --json`. Extracts the first JSON object

5 * (defensive against any banner/log noise around it). Returns null when there is

6 * no parseable object or no boolean `loggedIn` field — i.e. an output shape we

7 * don't recognise, which the caller treats as "unknown, don't block".

dist/update.jsView file

Lines 1-38javascript

1import { spawn } from 'child_process';

2import { createRequire } from 'module';

3// ESM JSON imports need version-sensitive import assertions; createRequire reads

4// the manifest synchronously on every Node 18+ without that fragility.

5const { version } = createRequire(import.meta.url)('../package.json');

dist/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg