registry / @agentvault/openai-bridge / 0.1.14
@agentvault/openai-bridge@0.1.14
AgentVault OpenAI Codex bridge for encrypted owner messages and rooms
AI Security Review
scanned 18h ago · by lpm-firewall-aiThe flagged subprocess and network activity supports the package's documented Codex-to-AgentVault bridge. The manifest has no install, preinstall, or postinstall hook, and review found no unrelated credential redirection or command-output exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI performs its bridge and account operations when the user runs a command such as login or run.
Impact
Expected bridge behavior; no malicious credential forwarding, command-output exfiltration, or install-time activity was found.
Mechanism
It invokes the local Codex CLI in a dedicated environment and communicates with the configured AgentVault API over HTTPS.
AI rationale
The flagged subprocess and network activity supports the package's documented Codex-to-AgentVault bridge. The manifest has no install, preinstall, or postinstall hook, and review found no unrelated credential redirection or command-output exfiltration.
Network endpoints1
api.agentvault.chat
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/index.js as the CLI and declares only a prepublishOnly build lifecycle script.
- The package describes its purpose as connecting a local Codex login to encrypted AgentVault owner messages and rooms.
- The Codex invocation uses a dedicated environment and read-only sandbox.
- The default API host is api.agentvault.chat; an override must be HTTPS and cannot include credentials, a query, or a fragment.
Evidence against
- The package starts a local Codex subprocess and makes network requests, but these support its documented bridge function.
- The CLI's main routine runs when the entrypoint is invoked; no install-time network or credential collection was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/index.jsView file
104560await init_bridge();
L104561: import { spawn as spawn2 } from "node:child_process";
L104562: import { realpathSync } from "node:fs";
...
L104572: checkBinary: checkVersion,
L104573: output: (text) => process.stdout.write(text + "\n"),
L104574: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L104575: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L104560104560Trigger-reachable chain: manifest.main -> dist/index.js
L104560: await init_bridge();
L104561: import { spawn as spawn2 } from "node:child_process";
L104562: import { realpathSync } from "node:fs";
...
L104572: checkBinary: checkVersion,
L104573: output: (text) => process.stdout.write(text + "\n"),
L104574: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L104575: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L104560Findings
2 Critical6 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @agentvault/openai-bridge@0.1.14.
See all versions of @agentvault/openai-bridge for other recorded verdicts.
- Review the evidence and your use of @agentvault/openai-bridge@0.1.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.