Loading npm security reports…

@bitkyc08/opencodex@2.7.22: Suspicious npm security report (Warn) | LPM Firewall

registry / @bitkyc08/opencodex / 2.7.22

@bitkyc08/opencodex@2.7.22

Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 213 file(s), 2.90 MB of source, external domains: 127.0.0.1, accounts.google.com, ai-gateway.vercel.sh, aiplatform.googleapis.com, aistudio.google.com, antigravity.google, api.anthropic.com, api.cerebras.ai, api.code.umans.ai, api.deepseek.com, api.fireworks.ai, api.githubcopilot.com, api.groq.com, api.kilo.ai, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.neuralwatt.com, api.openai.com, api.synthetic.new, api.together.xyz, api.venice.ai, api.x.ai, api.xiaomimimo.com, api.z.ai, api2.cursor.sh, app.umans.ai, auth.kimi.com, auth.openai.com, auth.x.ai, build.nvidia.com, chatgpt.com, claude.ai, cli-chat-proxy.grok.com, cloud.cerebras.ai, cloud.gitlab.com, cloudcode-pa.googleapis.com, coding-intl.dashscope.aliyuncs.com, console.anthropic.com, console.bce.baidu.com, console.cloud.google.com, console.groq.com, console.mistral.ai, cursor.com, daily-cloudcode-pa.googleapis.com, dash.cloudflare.com, dashscope.console.aliyun.com, docs.litellm.ai

Source & flagged code

3 flagged

src/server/system-env.tsView file

Lines 1-21typescript

1import { execSync } from "node:child_process";

2import { readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";

3import { join } from "node:path";

4import { getConfigDir } from "../config";

5import { resolveAutoContext, type AutoContextMode } from "../claude/context-windows";

6import type { OcxConfig } from "../types";

8// ---------------------------------------------------------------------------

9// Shell-hook env file: written on inject, sourced by the shell hook in .zshrc.

10// This works for ALL new shells immediately, unlike launchctl setenv which only

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/server/system-env.tsView on unpkg · L1

11// reaches processes launched directly by launchd (not Terminal.app children).

12// ---------------------------------------------------------------------------

14export function getShellEnvFilePath(): string {

15 return join(getConfigDir(), "claude-env.sh");

16}

18function shellValue(value: string): string {

19 return `'${value.replaceAll("'", `'\\''`)}'`;

20}

src/lib/gcp-adc.tsView file

Lines 1-33typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:

5 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT

6 * exchange) or `type: "authorized_user"` (refresh-token exchange).

7 * 2. gcloud user ADC (`CLOUDSDK_CONFIG`, else `%APPDATA%\gcloud` on Windows, else

8 * `~/.config/gcloud`) `application_default_credentials.json` (authorized_user flow).

9 * 3. GCE / Cloud Run metadata server.

10 *

src/cli/index.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bitkyc08/opencodex@2.7.19 matchedIdentity = npm:QGJpdGt5YzA4L29wZW5jb2RleA:2.7.19 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/index.tsView on unpkg

Source & flagged code

3 flagged · loading source

src/server/system-env.tsView file

1import { execSync } from "node:child_process"; L2: import { readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs"; ... L8: // --------------------------------------------------------------------------- L9: // Shell-hook env file: written on inject, sourced by the shell hook in .zshrc. L10: // This works for ALL new shells immediately, unlike launchctl setenv which only ... L24: `# Generated by opencodex — do not edit manually`, L25: `export ANTHROPIC_BASE_URL=${shellValue(`http://127.0.0.1:${port}`)}`, L26: `export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=${shellValue("1")}`, ... L74: export function installShellHook(): { installed: boolean; reason?: string } { L75: if (process.platform !== "darwin") return { installed: false, reason: "not macOS" }; L76: const home = process.env.HOME; L77: if (!home) return { installed: false, reason: "no HOME" };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/server/system-env.tsView on unpkg · L1

src/lib/gcp-adc.tsView file

13* L14: * Security: never logs the access token, private key, or refresh token. L15: */ ... L24: L25: const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token"; L26: const METADATA_TOKEN_URL = "http://metadata.google.[redacted]-accounts/default/token"; L27: const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"; ... L41: client_email: string; L42: private_key: string; L43: private_key_id?: string; ... L64: function getRefreshSkewMs(): number { L65: const raw = Number(process.env.GOOGLE_VERTEX_REFRESH_SKEW_MS);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/lib/gcp-adc.tsView on unpkg · L13

src/cli/index.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/index.tsView on unpkg

Source & flagged code

3 flagged

src/server/system-env.tsView file

Lines 1-21typescript

1import { execSync } from "node:child_process";

2import { readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";

3import { join } from "node:path";

4import { getConfigDir } from "../config";

5import { resolveAutoContext, type AutoContextMode } from "../claude/context-windows";

6import type { OcxConfig } from "../types";

8// ---------------------------------------------------------------------------

9// Shell-hook env file: written on inject, sourced by the shell hook in .zshrc.

10// This works for ALL new shells immediately, unlike launchctl setenv which only

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/server/system-env.tsView on unpkg · L1

11// reaches processes launched directly by launchd (not Terminal.app children).

12// ---------------------------------------------------------------------------

14export function getShellEnvFilePath(): string {

15 return join(getConfigDir(), "claude-env.sh");

16}

18function shellValue(value: string): string {

19 return `'${value.replaceAll("'", `'\\''`)}'`;

20}

src/lib/gcp-adc.tsView file

Lines 1-33typescript

1/**

2 * Application Default Credentials (ADC) resolution for Vertex AI.

3 *

4 * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:

5 * 1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT

6 * exchange) or `type: "authorized_user"` (refresh-token exchange).

7 * 2. gcloud user ADC (`CLOUDSDK_CONFIG`, else `%APPDATA%\gcloud` on Windows, else

8 * `~/.config/gcloud`) `application_default_credentials.json` (authorized_user flow).

9 * 3. GCE / Cloud Run metadata server.

10 *

src/cli/index.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/index.tsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code