registry / @agentvault/openai-bridge / 0.1.8
@agentvault/openai-bridge@0.1.8
AgentVault OpenAI Codex bridge for encrypted owner messages and rooms
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection did not confirm the scanner’s command-output exfiltration claim: the CLI helper discards child output, and no unrelated credential destination was established. The manifest has no install hook, and the inspected ws dependency excerpts show ordinary runtime setup.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI helper runs as part of an explicit CLI command; package installation only invokes the prepublishOnly build hook when publishing.
Impact
No malicious data transfer, credential theft, or unauthorized account action was established.
Mechanism
The helper launches a selected local command, caps its output, discards it, and returns an exit code. The inspected WebSocket dependency code handles ordinary protocol setup.
AI rationale
Source inspection did not confirm the scanner’s command-output exfiltration claim: the CLI helper discards child output, and no unrelated credential destination was established. The manifest has no install hook, and the inspected ws dependency excerpts show ordinary runtime setup.
Evidence
package.jsondist/index.js.lpm-dependency-evidence-025d1e72-23c4-447c-9366-1d73d895f0d7/0/npm-linux/package.json.lpm-dependency-evidence-025d1e72-23c4-447c-9366-1d73d895f0d7/0/npm-linux/wrapper.mjs.lpm-dependency-evidence-025d1e72-23c4-447c-9366-1d73d895f0d7/0/npm-linux/browser.js.lpm-dependency-evidence-025d1e72-23c4-447c-9366-1d73d895f0d7/0/npm-linux/index.js.lpm-dependency-evidence-025d1e72-23c4-447c-9366-1d73d895f0d7/0/npm-linux/lib/websocket.js
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the CLI and defines only a prepublishOnly build hook; it has no install-time hook.
- The CLI runs when invoked as the entrypoint, and its local command helper discards command output and returns only an exit code.
- The bundled ws runtime excerpt handles WebSocket protocol and origin headers; the dependency manifest identifies ws 8.22.0.
- The ws package imports its standard runtime modules, and its browser entry explicitly rejects browser use.
Evidence against
- The scanner’s command-output exfiltration claim is not supported by the inspected CLI helper: it discards output and shows no network transfer.
- The inspected bundle uses AgentVault’s configured API endpoint for its bridge functionality; no unrelated credential recipient was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggeddist/index.jsView file
103538await init_bridge();
L103539: import { spawn as spawn2 } from "node:child_process";
L103540: import { realpathSync } from "node:fs";
...
L103550: checkBinary: checkVersion,
L103551: output: (text) => process.stdout.write(text + "\n"),
L103552: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L103553: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L103538103538Trigger-reachable chain: manifest.main -> dist/index.js
L103538: await init_bridge();
L103539: import { spawn as spawn2 } from "node:child_process";
L103540: import { realpathSync } from "node:fs";
...
L103550: checkBinary: checkVersion,
L103551: output: (text) => process.stdout.write(text + "\n"),
L103552: command: (binary, args2, options = {}) => new Promise((resolve4, reject) => {
L103553: const child = spawn2(binary, args2, { env: options.env ?? { PATH: "/usr/bin:/bin", HOME: process.env.HOME, XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS: p...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L103538Findings
2 Critical6 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @agentvault/openai-bridge@0.1.8.
See all versions of @agentvault/openai-bridge for other recorded verdicts.
- Review the evidence and your use of @agentvault/openai-bridge@0.1.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.