registry / Credential exfiltration / @milpa/comal
@milpa/comal
Comal: governed operations, execution receipts, and programming assistance in any language
This report shows the evidence for @milpa/comal@0.2.2. 2 of 11 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package defaults OpenAI connections to llama.local while forwarding OPENAI_API_KEY as a bearer token without checking the destination. This is credential disclosure to a host outside the credential's service; the flagged bidi characters are part of a sanitizer and do not change that finding.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A non-demo CLI connection uses the OpenAI provider with OPENAI_API_KEY set and no endpoint override.
Impact
The key may be disclosed to a host outside the OpenAI service it belongs to.
Mechanism
The package defaults the endpoint to llama.local and attaches the environment key as a bearer token without verifying that the destination is OpenAI or a user-selected endpoint.
Attack narrative
When the CLI connects with the OpenAI provider, it can inherit OPENAI_API_KEY while using the package's default endpoint at llama.local. The provider sends the key in a bearer authorization header, with no destination check tying the key to OpenAI or requiring the user to select that endpoint. This exposes an OpenAI credential to a different host during ordinary runtime use.
AI rationale
The package defaults OpenAI connections to llama.local while forwarding OPENAI_API_KEY as a bearer token without checking the destination. This is credential disclosure to a host outside the credential's service; the flagged bidi characters are part of a sanitizer and do not change that finding.
Evidence
src/openai-provider.mjssrc/cli.mjs
Network endpoints1
llama.local:11438/
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- OpenAI settings default to http://llama.local:11438/ when no endpoint override is set.
- The settings copy OPENAI_API_KEY into the provider configuration.
- The OpenAI provider sends its configured key in an Authorization: Bearer header.
- The CLI connects using its selected settings when running outside demo mode.
- The bidi characters flagged in bound.mjs are removed by a sanitizer.
Evidence against
- The credential is sent during runtime model use, not by an install hook.
- The package is an OpenAI-compatible client, and its endpoint can be overridden through configuration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggednode_modules/ajv/dist/compile/jtd/serialize.jsView file
49sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`;
L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode);
L51: const serialize = makeSerialize(this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/ajv/dist/compile/jtd/serialize.jsView on unpkg · L49node_modules/ajv/dist/vocabularies/dynamic/recursiveAnchor.jsView file
2Object.defineProperty(exports, "__esModule", { value: true });
L3: const dynamicAnchor_1 = require("./dynamicAnchor");
L4: const util_1 = require("../../compile/util");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
node_modules/ajv/dist/vocabularies/dynamic/recursiveAnchor.jsView on unpkg · L2Findings
2 Critical1 High6 Medium5 Low
CriticalTrojan Source Unicodesrc/plugins/open-relay/bound.mjs
CriticalTrigger Reachable Dangerous Capabilitysrc/plugin-notices.mjs
HighSemantic Analysis Limitednode_modules/ajv/dist/runtime/parseJson.js#virtual:normalized:round1
MediumDynamic Requirenode_modules/ajv/dist/vocabularies/dynamic/recursiveAnchor.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulenode_modules/@jitl/quickjs-wasmfile-debug-asyncify/dist/emscripten-module.wasm
MediumShips Build Helpersrc/windows-private.ps1
MediumStructural Risk Force Deep Review
LowEvalnode_modules/ajv/dist/compile/jtd/serialize.js
LowFilesystem
Low
Affected versions and remediation
This report applies to @milpa/comal@0.2.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @milpa/comal@0.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.