registry / @agentvault/openai-bridge / 0.1.6
@agentvault/openai-bridge@0.1.6
AgentVault OpenAI Codex bridge for encrypted owner messages and rooms
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found a prepublish-only build hook, an explicitly invoked device login using isolated credential storage, and ordinary WebSocket implementation code. The scanner’s command-execution and credential-redirection labels are not supported by the inspected behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when invoked; login requires the user to select the login command.
Impact
No concrete malicious effect was established.
Mechanism
The bridge starts Codex with a separate credential directory. The inspected runtime hint sets WebSocket protocol and origin headers.
AI rationale
Source inspection found a prepublish-only build hook, an explicitly invoked device login using isolated credential storage, and ordinary WebSocket implementation code. The scanner’s command-execution and credential-redirection labels are not supported by the inspected behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares only a prepublishOnly build lifecycle script and depends on ws.
- The bridge gives Codex a separate HOME, CODEX_HOME, and temporary directory.
- Login is an explicit CLI command using device authentication and file-based credential storage.
- The inspected ws package exposes its normal Node, browser, and ESM entrypoints; its runtime hint handles WebSocket protocol and origin headers.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/index.js
Source & flagged code
9 flaggeddist/index.jsView file
102753await init_bridge();
L102754: import { spawn as spawn2 } from "node:child_process";
L102755: import { realpathSync } from "node:fs";
...
L102765: checkBinary: checkVersion,
L102766: output: (text) => process.stdout.write(text + "\n"),
L102767: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L102768: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L102753102753Trigger-reachable chain: manifest.main -> dist/index.js
L102753: await init_bridge();
L102754: import { spawn as spawn2 } from "node:child_process";
L102755: import { realpathSync } from "node:fs";
...
L102765: checkBinary: checkVersion,
L102766: output: (text) => process.stdout.write(text + "\n"),
L102767: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L102768: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L102753Findings
2 Critical6 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @agentvault/openai-bridge@0.1.6.
See all versions of @agentvault/openai-bridge for other recorded verdicts.
- Review the evidence and your use of @agentvault/openai-bridge@0.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.