@anthonyhaussman/opencode-agy-auth@1.3.5
[](https://www.npmjs.com/package/@anthonyhaussman/opencode-agy-auth) [](https://www.npmjs.com/
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe scanner's process-execution and remote-agent-bridge signals are consistent with opening the user's OAuth browser and routing the plugin's Google model requests. The inspected manifest has no install lifecycle hook, and the reviewed runtime paths did not establish credential disclosure to an unrelated recipient or another concrete attack.
Decision evidence
public snapshot- package.json points to dist/index.js as its runtime entrypoint; its listed scripts show no install lifecycle hook.
- OAuth authorization codes are exchanged with Google's token endpoint, and the Antigravity API defaults to Google's Cloud Code endpoint.
- The flagged child process launches the platform's browser with a URL; it does not execute a package-supplied shell command.
- The runtime interceptor targets Google Generative Language or Cloud Code requests, and the added quota tools retrieve authenticated quota information.
Source & flagged code
4 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L118Findings
Affected versions and remediation
This report applies to @anthonyhaussman/opencode-agy-auth@1.3.5.
See all versions of @anthonyhaussman/opencode-agy-auth for other recorded verdicts.
- Review the evidence and your use of @anthonyhaussman/opencode-agy-auth@1.3.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.