registry / @nick3/copilot-api / 1.13.14

@nick3/copilot-api@1.13.14

OpenAI and Anthropic-compatible gateway for GitHub Copilot or Codex or third-party providers.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed credential exfiltration, remote payload execution, or AI-agent control-surface mutation was found. The sole lifecycle concern is a non-CI prepare hook that may install a project Git hook.

Static reason

No blocking static signals were detected.

Trigger

Installing or developing the package in a non-CI Git checkout where npm runs prepare.

Impact

May alter the checkout's Git hook behavior; no broader persistence or data transfer is evidenced.

Mechanism

prepare invokes simple-git-hooks to configure a pre-commit lint command

Rationale

Source implements a user-invoked Copilot/Codex gateway and stores its own credentials locally. Per policy, the prepare-only Git-hook setup warrants a warning despite no concrete malware behavior.

Evidence

package.jsondist/start-BlPuD0Ea.jsdist/paths-Bpsb62LK.jsdist/poll-access-token-DK-igxvv.jsdist/token-B7ph9sEd.jsdist/main.js

Network endpoints3

auth.openai.com/oauth/tokenchatgpt.com/backend-apiapi.anthropic.com/v1/messages/count_tokens

@nick3/copilot-api@1.13.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code