registry / @bitkyc08/opencodex / 2.6.20

@bitkyc08/opencodex@2.6.20

Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 160 file(s), 1.94 MB of source, external domains: 127.0.0.1, accounts.google.com, ai-gateway.vercel.sh, aiplatform.googleapis.com, aistudio.google.com, antigravity.google, api.anthropic.com, api.cerebras.ai, api.code.umans.ai, api.deepseek.com, api.fireworks.ai, api.githubcopilot.com, api.groq.com, api.kilo.ai, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.neuralwatt.com, api.openai.com, api.synthetic.new, api.together.xyz, api.venice.ai, api.x.ai, api.xiaomimimo.com, api.z.ai, api2.cursor.sh, app.umans.ai, auth.kimi.com, auth.openai.com, auth.x.ai, build.nvidia.com, chatgpt.com, claude.ai, cloud.cerebras.ai, cloud.gitlab.com, cloudcode-pa.googleapis.com, coding-intl.dashscope.aliyuncs.com, console.bce.baidu.com, console.cloud.google.com, console.groq.com, console.mistral.ai, cursor.com, daily-cloudcode-pa.googleapis.com, dash.cloudflare.com, dashscope.console.aliyun.com, docs.litellm.ai, fireworks.ai, gateway.ai.cloudflare.com

Source & flagged code

4 flagged

src/service.tsView file

Lines 1-27typescript

1/**

2 * `ocx service` — run the proxy as a background service that auto-starts on login and

3 * auto-restarts on crash. macOS → launchd; Windows → Task Scheduler; Linux → systemd user unit.

4 * The service sets OCX_SERVICE=1 so the proxy's shutdown handler does NOT restore native

5 * Codex on a service-managed restart (the restarted instance re-injects); explicit stop/uninstall

6 * restore it via the command.

7 */

8import { execFileSync, execSync } from "node:child_process";

9import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";

10import { homedir } from "node:os";

11import { dirname, join, resolve } from "node:path";

12import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort } from "./config";

13import { loadConfig } from "./config";

14import { restoreNativeCodex } from "./codex-inject";

15import { durableBunPath, durableBunRuntime } from "./bun-runtime";

16import { isProcessAlive, stopProxy } from "./process-control";

17import { serviceApiTokenFilePath } from "./service-secrets";

18import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./win-paths";

20const LABEL = "com.opencodex.proxy";

21const TASK = "opencodex-proxy";

23function cliEntry(): { bun: string; cli: string } {

24 // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than

25 // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a

26 // standalone Bun is later removed. cli.ts sits next to this module.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.tsView on unpkg · L7

27 return { bun: durableBunPath(), cli: join(import.meta.dir, "cli.ts") };

src/oauth/local-token-detect.tsView file

Lines 1-25typescript

1/**

2 * Local token auto-detection — reads an existing Grok CLI credential (~/.grok/auth.json).

3 * Read-only: never writes to external credential stores.

4 * Ported from jawcode packages/ai/src/utils/oauth/local-token-detect.ts (xAI portion).

5 */

6import { execSync } from "node:child_process";

7import { existsSync, readFileSync } from "node:fs";

8import { homedir } from

src/lib/gcp-adc.tsView file

Lines 1-32typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:

5 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT

6 * exchange) or `type: "authorized_user"` (refresh-token exchange).

7 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC; authorized_user flow).

8 * 3. GCE / Cloud Run metadata server.

9 *

10 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)

11 * before expiry. Concurrent callers waiting on a refresh share one in-flight promise.

src/cli.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bitkyc08/opencodex@2.6.18 matchedIdentity = npm:QGJpdGt5YzA4L29wZW5jb2RleA:2.6.18 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg

Source & flagged code

4 flagged · loading source

src/service.tsView file

7*/ L8: import { execFileSync, execSync } from "node:child_process"; L9: import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"; ... L24: // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than L25: // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a L26: // standalone Bun is later removed. cli.ts sits next to this module. ... L30: function plistPath(): string { L31: return join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`); L32: } ... L65: function currentCodexHome(): string { L66: const raw = process.env.CODEX_HOME?.trim(); L67: return raw ? resolve(expandUserPath(raw)) : join(homedir(), ".codex");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.tsView on unpkg · L7

src/oauth/local-token-detect.tsView file

5*/ L6: import { execSync } from "node:child_process"; L7: import { existsSync, readFileSync } from "node:fs"; ... L11: L12: const XAI_AUTH_KEY_PREFIX = "https://auth.x.ai::"; L13: const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials"; ... L15: export function detectGrokCliToken(): OAuthCredentials | null { L16: const authPath = join(homedir(), ".grok", "auth.json"); L17: if (!existsSync(authPath)) return null; ... L19: try { L20: const raw = JSON.parse(readFileSync(authPath, "utf8")) as Record<string, Record<string, unknown>>; L21:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/oauth/local-token-detect.tsView on unpkg · L5

src/lib/gcp-adc.tsView file

12* L13: * Security: never logs the access token, private key, or refresh token. L14: */ ... L23: L24: const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token"; L25: const METADATA_TOKEN_URL = "http://metadata.google.[redacted]-accounts/default/token"; L26: const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"; ... L40: client_email: string; L41: private_key: string; L42: private_key_id?: string; ... L63: function getRefreshSkewMs(): number { L64: const raw = Number(process.env.GOOGLE_VERTEX_REFRESH_SKEW_MS);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/lib/gcp-adc.tsView on unpkg · L12

src/cli.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg

Findings

3 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitysrc/oauth/local-token-detect.ts

HighCloud Metadata Accesssrc/lib/gcp-adc.ts

HighPrevious Version Dangerous Deltasrc/cli.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/service.ts

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/service.tsView file

Lines 1-27typescript

1/**

2 * `ocx service` — run the proxy as a background service that auto-starts on login and

3 * auto-restarts on crash. macOS → launchd; Windows → Task Scheduler; Linux → systemd user unit.

4 * The service sets OCX_SERVICE=1 so the proxy's shutdown handler does NOT restore native

5 * Codex on a service-managed restart (the restarted instance re-injects); explicit stop/uninstall

6 * restore it via the command.

7 */

8import { execFileSync, execSync } from "node:child_process";

9import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";

10import { homedir } from "node:os";

11import { dirname, join, resolve } from "node:path";

12import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort } from "./config";

13import { loadConfig } from "./config";

14import { restoreNativeCodex } from "./codex-inject";

15import { durableBunPath, durableBunRuntime } from "./bun-runtime";

16import { isProcessAlive, stopProxy } from "./process-control";

17import { serviceApiTokenFilePath } from "./service-secrets";

18import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./win-paths";

20const LABEL = "com.opencodex.proxy";

21const TASK = "opencodex-proxy";

23function cliEntry(): { bun: string; cli: string } {

24 // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than

25 // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a

26 // standalone Bun is later removed. cli.ts sits next to this module.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.tsView on unpkg · L7

27 return { bun: durableBunPath(), cli: join(import.meta.dir, "cli.ts") };

src/oauth/local-token-detect.tsView file

Lines 1-25typescript

1/**

2 * Local token auto-detection — reads an existing Grok CLI credential (~/.grok/auth.json).

3 * Read-only: never writes to external credential stores.

4 * Ported from jawcode packages/ai/src/utils/oauth/local-token-detect.ts (xAI portion).

5 */

6import { execSync } from "node:child_process";

7import { existsSync, readFileSync } from "node:fs";

8import { homedir } from

src/lib/gcp-adc.tsView file

Lines 1-32typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:

5 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT

6 * exchange) or `type: "authorized_user"` (refresh-token exchange).

7 * 2. `~/.config/gcloud/application_default_credentials.json` (user ADC; authorized_user flow).

8 * 3. GCE / Cloud Run metadata server.

9 *

10 * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)

11 * before expiry. Concurrent callers waiting on a refresh share one in-flight promise.

src/cli.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg