registry / @ccpocket/bridge / 1.64.0

@ccpocket/bridge@1.64.0

Bridge server that connects Claude Agent SDK and Codex CLI sessions to mobile devices via WebSocket

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit setup command installs a per-user launchd/systemd service for the Bridge. That service restarts a LAN WebSocket bridge through an unpinned `@latest` npx invocation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `ccpocket-bridge setup` on macOS or Linux.

Impact

A later registry-side change to `@latest` could run under the persisted user service; the running bridge exposes coding-agent capabilities to connected clients.

Mechanism

User-invoked service persistence and remote coding-agent bridge.

Rationale

Source inspection shows explicit, first-party service setup with a real persistence and unpinned-update risk, but no covert install hook, credential harvesting, destructive behavior, or concrete malicious exfiltration chain. Warn rather than block under the lifecycle-control policy.

Evidence

package.jsondist/cli.jsdist/setup-launchd.jsdist/setup-systemd.jsdist/index.jsdist/websocket.jsdist/push-relay.jsdist/firebase-auth.js~/Library/LaunchAgents/com.ccpocket.bridge.plist~/.config/systemd/user/ccpocket-bridge.service/tmp/ccpocket-bridge.log/tmp/ccpocket-bridge.err

Network endpoints3

identitytoolkit.googleapis.comsecuretoken.googleapis.comus-central1-ccpocket-ca33b.cloudfunctions.net/relay

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/cli.js` exposes an explicit `setup` command that installs a user service.
`dist/setup-systemd.js` and `dist/setup-launchd.js` persist a background service and enable autostart.
Persisted services execute `npx --yes @ccpocket/bridge@latest`, creating an unpinned future-code update path.
`dist/index.js` starts a LAN HTTP/WebSocket bridge that can control coding-agent sessions.

Evidence against

`package.json` has only `prepublishOnly`; no install-time lifecycle hook runs for consumers.
Service persistence is reached only through the user-invoked `ccpocket-bridge setup` command.
`dist/websocket.js` checks a configured API-key token and applies configured project-directory restrictions.
Firebase and relay requests support declared push notifications; no source evidence harvests environment secrets or files for exfiltration.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 793 KB of source, external domains: chatgpt.com, console.anthropic.com, docs.anthropic.com, git-scm.com, github.com, identitytoolkit.googleapis.com, nodejs.org, securetoken.googleapis.com, tailscale.com, us-central1-ccpocket-ca33b.cloudfunctions.net, www.apple.com

Source & flagged code

5 flagged

dist/firebase-auth.jsView file

Lines 1-38javascript

1/**

2 * Firebase Anonymous Auth client for Bridge Server.

3 *

4 * Uses the Firebase Auth REST API directly instead of the client SDK

5 * to avoid Node.js compatibility issues with the browser-oriented SDK.

6 *

7 * Each Bridge instance signs in anonymously and obtains:

8 * - A unique UID (used as bridgeId)

9 * - An ID token (used as Bearer token for Cloud Functions)

10 *

11 * Credentials are persisted to ~/.ccpocket/firebase-credentials.json

12 * so that Bridge restarts reuse the same UID instead of creating

13 * a new anonymous account each time.

14 */

15import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

16import { homedir } from "node:os";

17import { dirname, join } from "node:path";

18const FIREBASE_API_KEY = "AIzaSyAptNnokWPqJIgv2Lr3I8ETN6bqZb5BGvc";

High

High Secret

Package contains a high-severity secret pattern.

dist/firebase-auth.jsView on unpkg · L18

High

Secret Pattern

Google API key in dist/firebase-auth.js

dist/firebase-auth.jsView on unpkg · L18

19const SIGN_UP_URL = `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${FIREBASE_API_KEY}`;

20const REFRESH_URL = `https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`;

21const CREDENTIALS_DIR = join(homedir(), ".ccpocket");

22const CREDENTIALS_FILE = join(CREDENTIALS_DIR, "firebase-credentials.json");

23class FirebaseTokenRefreshError extends Error {

24 status;

25 responseText;

26 constructor(status, responseText) {

27 super(`Firebase token refresh failed (${status}): ${responseText}`);

28 this.status = status;

29 this.responseText = responseText;

30 }

31}

32function isRecoverableRefreshError(err) {

33 return err instanceof FirebaseTokenRefreshError && err.status === 400;

34}

35function loadCredentials(credentialsFile) {

36 try {

37 if (!existsSync(credentialsFile))

38 return null;

dist/setup-launchd.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { existsSync, mkdirSync, writeFileSync, unlinkSync } from "node:fs";

3import { homedir } from "node:os";

4import { join } from "node:path";

5import { defaultCodexSharedAppServerUrl, readCodexSharedAppServerUrl, } from "./codex-app-server-config.js";

dist/websocket.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ccpocket/bridge@1.63.6 matchedIdentity = npm:QGNjcG9ja2V0L2JyaWRnZQ:1.63.6 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/websocket.jsView on unpkg

dist/doctor.jsView file

Lines 268-308javascript

268 // Extract the Tailscale IP (first IPv4 in output)

269 const ipMatch = out.match(/(\d+\.\d+\.\d+\.\d+)/);

270 const ip = ipMatch ? ipMatch[1]

Source & flagged code

5 flagged · loading source

dist/firebase-auth.jsView file

18patternName = google_api_key severity = high line = 18 matchedText = const FI...vc";

High

High Secret

Package contains a high-severity secret pattern.

dist/firebase-auth.jsView on unpkg · L18

18patternName = google_api_key severity = high line = 18 matchedText = const FI...vc";

High

Secret Pattern

Google API key in dist/firebase-auth.js

dist/firebase-auth.jsView on unpkg · L18

dist/setup-launchd.jsView file

1import { execSync } from "node:child_process"; L2: import { existsSync, mkdirSync, writeFileSync, unlinkSync } from "node:fs"; ... L8: function getPlistPath() { L9: const dir = join(homedir(), "Library", "LaunchAgents"); L10: if (!existsSync(dir)) ... L17: try { L18: execSync(`launchctl stop "${PLIST_LABEL}"`, { stdio: "ignore" }); L19: } ... L30: export function setupLaunchd(opts) { L31: const port = parseBridgePort(opts.port ?? process.env.BRIDGE_PORT); L32: const host = opts.host ?? process.env.BRIDGE_HOST ?? "0.0.0.0";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup-launchd.jsView on unpkg · L1

dist/websocket.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/websocket.jsView on unpkg

dist/doctor.jsView file

288patternName = google_api_key severity = high line = 288 matchedText = const FI...vc";

High

Secret Pattern

Google API key in dist/doctor.js

dist/doctor.jsView on unpkg · L288

Findings

4 High3 Medium5 Low

HighHigh Secretdist/firebase-auth.js

HighPrevious Version Dangerous Deltadist/websocket.js

HighSecret Patterndist/firebase-auth.js

HighSecret Patterndist/doctor.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/setup-launchd.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/firebase-auth.jsView file

Lines 1-38javascript

1/**

2 * Firebase Anonymous Auth client for Bridge Server.

3 *

4 * Uses the Firebase Auth REST API directly instead of the client SDK

5 * to avoid Node.js compatibility issues with the browser-oriented SDK.

6 *

7 * Each Bridge instance signs in anonymously and obtains:

8 * - A unique UID (used as bridgeId)

9 * - An ID token (used as Bearer token for Cloud Functions)

10 *

11 * Credentials are persisted to ~/.ccpocket/firebase-credentials.json

12 * so that Bridge restarts reuse the same UID instead of creating

13 * a new anonymous account each time.

14 */

15import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

16import { homedir } from "node:os";

17import { dirname, join } from "node:path";

18const FIREBASE_API_KEY = "AIzaSyAptNnokWPqJIgv2Lr3I8ETN6bqZb5BGvc";

High

High Secret

Package contains a high-severity secret pattern.

dist/firebase-auth.jsView on unpkg · L18

High

Secret Pattern

Google API key in dist/firebase-auth.js

dist/firebase-auth.jsView on unpkg · L18

19const SIGN_UP_URL = `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${FIREBASE_API_KEY}`;

20const REFRESH_URL = `https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`;

21const CREDENTIALS_DIR = join(homedir(), ".ccpocket");

22const CREDENTIALS_FILE = join(CREDENTIALS_DIR, "firebase-credentials.json");

23class FirebaseTokenRefreshError extends Error {

24 status;

25 responseText;

26 constructor(status, responseText) {

27 super(`Firebase token refresh failed (${status}): ${responseText}`);

28 this.status = status;

29 this.responseText = responseText;

30 }

31}

32function isRecoverableRefreshError(err) {

33 return err instanceof FirebaseTokenRefreshError && err.status === 400;

34}

35function loadCredentials(credentialsFile) {

36 try {

37 if (!existsSync(credentialsFile))

38 return null;

dist/setup-launchd.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { existsSync, mkdirSync, writeFileSync, unlinkSync } from "node:fs";

3import { homedir } from "node:os";

4import { join } from "node:path";

5import { defaultCodexSharedAppServerUrl, readCodexSharedAppServerUrl, } from "./codex-app-server-config.js";

dist/websocket.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/websocket.jsView on unpkg

dist/doctor.jsView file

Lines 268-308javascript

268 // Extract the Tailscale IP (first IPv4 in output)

269 const ipMatch = out.match(/(\d+\.\d+\.\d+\.\d+)/);

270 const ip = ipMatch ? ipMatch[1]