registry / @nick3/copilot-api / 1.13.15

@nick3/copilot-api@1.13.15

OpenAI and Anthropic-compatible gateway for GitHub Copilot or Codex or third-party providers.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installation outside CI can install a repository pre-commit hook. Runtime is an explicit CLI gateway that stores its own credentials/config and proxies user-requested API traffic; no confirmed malicious attack surface was found.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm prepare outside CI; later, a user git commit triggers the installed hook.

Impact

The hook can run lint-staged on future commits; runtime sends authorized gateway requests to configured providers.

Mechanism

prepare-time VCS hook setup; explicit API proxy and OAuth flows.

Rationale

Source inspection found package-aligned OAuth, token storage, and gateway networking, but package.json installs a pre-commit hook through prepare. Per policy, prepare-only VCS hook setup warrants a warning rather than a block.

Evidence

package.jsondist/main.jsdist/start-CRDwm07S.jsdist/poll-access-token-DK-igxvv.jsdist/token-BcnEydwW.jsdist/paths-Bpsb62LK.jsdist/config-BI9fN-jo.js

Network endpoints5

api.github.comapi.githubcopilot.comauth.openai.com/oauth/authorizeauth.openai.com/oauth/token/auth

@nick3/copilot-api@1.13.15

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code