registry / @1presence/bridge / 0.67.0

@1presence/bridge@0.67.0

Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-run bridge CLI that connects to 1Presence, drives local Claude Code, and stores transient local setup/spool files with restricted permissions.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs 1presence-bridge / npx @1presence/bridge

Impact

User conversations and tool outputs are relayed to the authenticated 1Presence service as described by the package purpose.

Mechanism

local Claude Code bridge with WebSocket gateway, MCP config, and turn spooling

Rationale

The suspicious primitives are aligned with a user-invoked local bridge for 1Presence and Claude Code, with no install-time hooks or unconsented global agent-control mutation. The auto-update npx path and local MCP file reader are notable risk areas, but source inspection shows package-scoped update behavior and session-confined reads rather than a concrete malicious chain.

Evidence

package.jsondist/index.jsdist/auth.jsdist/claude.jsdist/claudeAuth.jsdist/update.jsdist/outbox.jsdist/sessionPath.jsREADME.md/tmp/agent-${uid}.md/tmp/mcp-${uid}.json/tmp/1presence-bridge/CLAUDE.md~/.1presence/outbox/${conversationId}.json~/.1presence/auth.json

Network endpoints4

api.1presence.comwss://api.1presence.com/bridgesecuretoken.googleapis.com/v1/token?key=<firebase-api-key>registry.npmjs.org/@1presence/bridge/latest

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/update.js checks npm registry on CLI startup and spawns npx for newer @1presence/bridge.
dist/index.js writes token-bearing MCP config and fetched system prompt to /tmp with 0600 permissions.
dist/claude.js creates a local MCP read_session_file tool, but confines reads to current Claude session path.

Evidence against

package.json has no preinstall/install/postinstall; prepare/prepack only run tsc.
dist/auth.js browser auth uses localhost nonce/CORS and keeps tokens in memory; legacy ~/.1presence/auth.json is removed.
dist/claude.js disables built-in tools, uses strict MCP config, and allowlists only 1Presence/local MCP tools.
Network endpoints are package-aligned: 1Presence gateway, Firebase token refresh, npm registry update check.
Child process usage is explicit CLI functionality: opens browser, probes/logs into claude, and invokes Claude Agent SDK.
No credential harvesting, broad filesystem traversal, persistence, destructive behavior, or install-time AI-agent mutation found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 135 KB of source, external domains: api.1presence.com, registry.npmjs.org, securetoken.googleapis.com

Source & flagged code

4 flagged

dist/auth.jsView file

Lines 166-206javascript

166 });

167 });

168 server.listen(0, '127.0.0.1', () => {

169 const { port } = server.address();

170 const authUrl = `${pwaUrl.replace(/\/$/, '')}/cli-auth?port=${port}&nonce=${encodeURIComponent(nonce)}`;

171 console.log('\nOpening browser for sign-in…');

172 console.log(`If the browser doesn't open, visit:\n ${authUrl}\n`);

173 openBrowser(authUrl);

174 });

175 setTimeout(() => {

176 if (resolved)

177 return;

178 resolved = true;

179 server.close();

180 reject(new Error('Sign-in timed out after 5 minutes. Please try again.'));

181 }, 5 * 60 * 1000);

182 });

183}

184// ─── Token refresh ────────────────────────────────────────────────────────────

185// Firebase web API key — public, safe to embed

186const FIREBASE_API_KEY = 'AIzaSyAz16A3eRIMhdLGF9ptsVsWZx9LjKeZwi8';

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L186

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L186

187async function refreshIdToken(refreshToken) {

188 const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`, {

189 method: 'POST',

190 headers: { 'Content-Type': 'application/json' },

191 body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshToken }),

192 });

193 if (!res.ok)

194 throw new Error(`Token refresh failed: ${res.status}`);

195 const data = await res.json();

196 if (!data.id_token)

197 throw new Error('Token refresh returned no id_token');

198 return data.id_token;

199}

200/** Headroom below which ensureFreshToken mints a new ID token at turn start.

201 * Firebase ID tokens live 60 min; the token is baked into the MCP SSE config

202 * header at spawn (writeMcpConfig) and reused by that connection for the whole

203 * turn — it can't be re-tokened mid-turn without reconnecting the MCP server.

204 * So a turn must START with enough headroom to outlive itself. At 10 min a turn

205 * that began with ~12 min of life and ran 17 min lost its MCP OAuth AND its

206 * save-turn token mid-flight ("MCP OAuth not configured" + save-turn 401 — see

dist/claudeAuth.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { createInterface } from 'node:readline';

High

Child Process

Package source references child process execution.

dist/claudeAuth.jsView on unpkg · L1

3/**

4 * Parse the stdout of `claude auth status --json`. Extracts the first JSON object

5 * (defensive against any banner/log noise around it). Returns null when there is

6 * no parseable object or no boolean `loggedIn` field — i.e. an output shape we

7 * don't recognise, which the caller treats as "unknown, don't block".

dist/update.jsView file

Lines 1-38javascript

1import { spawn } from 'child_process';

2import { createRequire } from 'module';

3// ESM JSON imports need version-sensitive import assertions; createRequire reads

4// the manifest synchronously on every Node 18+ without that fragility.

5const { version } = createRequire(import.meta.url)('../package.json');

Source & flagged code

4 flagged · loading source

dist/auth.jsView file

186patternName = google_api_key severity = high line = 186 matchedText = const FI...i8';

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L186

186patternName = google_api_key severity = high line = 186 matchedText = const FI...i8';

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L186

dist/claudeAuth.jsView file

1import { spawn } from 'node:child_process'; L2: import { createInterface } from 'node:readline';

High

Child Process

Package source references child process execution.

dist/claudeAuth.jsView on unpkg · L1

dist/update.jsView file

18try { L19: const res = await fetch('https://registry.npmjs.org/@1presence/bridge/latest', { L20: signal: AbortSignal.timeout(3000), ... L28: console.log(`Updating to v${latest}…\n`); L29: const child = spawn('npx', ['--yes', `@1presence/bridge@${latest}`], { L30: stdio: 'inherit', L31: env: process.env, L32: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/update.jsView on unpkg · L18

Findings

5 High2 Medium5 Low

HighHigh Secretdist/auth.js

HighChild Processdist/claudeAuth.js

HighShell

HighSame File Env Network Executiondist/update.js

HighSecret Patterndist/auth.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/auth.jsView file

Lines 166-206javascript

166 });

167 });

168 server.listen(0, '127.0.0.1', () => {

169 const { port } = server.address();

170 const authUrl = `${pwaUrl.replace(/\/$/, '')}/cli-auth?port=${port}&nonce=${encodeURIComponent(nonce)}`;

171 console.log('\nOpening browser for sign-in…');

172 console.log(`If the browser doesn't open, visit:\n ${authUrl}\n`);

173 openBrowser(authUrl);

174 });

175 setTimeout(() => {

176 if (resolved)

177 return;

178 resolved = true;

179 server.close();

180 reject(new Error('Sign-in timed out after 5 minutes. Please try again.'));

181 }, 5 * 60 * 1000);

182 });

183}

185// Firebase web API key — public, safe to embed

186const FIREBASE_API_KEY = 'AIzaSyAz16A3eRIMhdLGF9ptsVsWZx9LjKeZwi8';

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L186

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L186

187async function refreshIdToken(refreshToken) {

188 const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`, {

189 method: 'POST',

190 headers: { 'Content-Type': 'application/json' },

191 body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshToken }),

192 });

193 if (!res.ok)

194 throw new Error(`Token refresh failed: ${res.status}`);

195 const data = await res.json();

196 if (!data.id_token)

197 throw new Error('Token refresh returned no id_token');

198 return data.id_token;

199}

200/** Headroom below which ensureFreshToken mints a new ID token at turn start.

201 * Firebase ID tokens live 60 min; the token is baked into the MCP SSE config

202 * header at spawn (writeMcpConfig) and reused by that connection for the whole

203 * turn — it can't be re-tokened mid-turn without reconnecting the MCP server.

204 * So a turn must START with enough headroom to outlive itself. At 10 min a turn

205 * that began with ~12 min of life and ran 17 min lost its MCP OAuth AND its

206 * save-turn token mid-flight ("MCP OAuth not configured" + save-turn 401 — see

dist/claudeAuth.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { createInterface } from 'node:readline';

High

Child Process

Package source references child process execution.

dist/claudeAuth.jsView on unpkg · L1

3/**

4 * Parse the stdout of `claude auth status --json`. Extracts the first JSON object

5 * (defensive against any banner/log noise around it). Returns null when there is

6 * no parseable object or no boolean `loggedIn` field — i.e. an output shape we

7 * don't recognise, which the caller treats as "unknown, don't block".

dist/update.jsView file

Lines 1-38javascript

1import { spawn } from 'child_process';

2import { createRequire } from 'module';

3// ESM JSON imports need version-sensitive import assertions; createRequire reads

4// the manifest synchronously on every Node 18+ without that fragility.

5const { version } = createRequire(import.meta.url)('../package.json');