registry / Credential exfiltration / @ouro.bot/cli
@ouro.bot/cli
If you're a future agent reading this, welcome home. This repo is the harness that gives you your body, your senses, your record, your habits, and your ability to think and connect with people. The goal of these docs is not just to be correct, but to leav
This report shows the evidence for @ouro.bot/cli@0.1.0-alpha.870. 1 of 145 known versions is blocked or flagged. The newest version, 0.1.0-alpha.938, is allowed. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe runtime auth path transfers provider credentials into a remote vault whose default recipient is selected by the package, without recipient-specific confirmation. Although this storage feature is package-aligned and user-invoked, the source establishes the credential transfer and default destination.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI authentication command for an agent with a configured vault.
Impact
Provider credentials leave the local machine and are stored at the default remote vault service without confirmation of that recipient.
Mechanism
The flow collects provider credentials, serializes them into a vault item, and writes the item through the Bitwarden CLI using the resolved vault server.
Attack narrative
When a user authenticates an agent, the CLI can read an existing Codex access token or prompt for a provider key, then stores the credential in a Bitwarden vault. The vault server defaults to vault.ouro.bot when no server is configured, and the inspected flow does not request recipient-specific approval before writing the provider credential there.
AI rationale
The runtime auth path transfers provider credentials into a remote vault whose default recipient is selected by the package, without recipient-specific confirmation. Although this storage feature is package-aligned and user-invoked, the source establishes the credential transfer and default destination.
Evidence
dist/heart/auth/auth-flow.jsdist/heart/daemon/cli-exec.jsdist/heart/identity.jsdist/heart/provider-credentials.jsdist/repertoire/credential-access.jsdist/repertoire/bitwarden-store.js
Network endpoints1
vault.ouro.bot
Decision evidence
public snapshotAI called this Malicious at 84.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes CLI entry points that run the Ouro command handler.
- Authentication reads an existing Codex token or prompts for a provider API key.
- The CLI routes authentication commands to the runtime auth flow, which stores the collected credentials.
- The vault server defaults to vault.ouro.bot, and the credential store passes provider credentials to the Bitwarden CLI for a remote vault write.
Evidence against
- The remote vault is part of the package’s credential-management feature, and users invoke the authentication command; the inspected write path does not show recipient-specific confirmation for sending provider credentials to the default server.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flagged · loading sourcedist/heart/daemon/cli-exec.jsView file
7429if (platform === "wsl") {
L7430: const winProfile = (0, child_process_1.execFileSync)("cmd.exe", ["/C", "echo", "%USERPROFILE%"], { stdio: "pipe" }).toString().trim();
L7431: const windowsHome = (0, child_process_1.execFileSync)("wslpath", ["-u", winProfile], { stdio: "pipe" }).toString().trim();
High
3739patternName = generic_password
severity = medium
line = 3739
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/heart/daemon/cli-exec.jsView on unpkg · L3739dist/heart/auth/auth-flow.jsView file
42exports.runRuntimeAuthFlow = runRuntimeAuthFlow;
L43: const child_process_1 = require("child_process");
L44: const fs = __importStar(require("fs"));
High
Findings
1 Critical8 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/heart/daemon/cli-defaults.js
HighChild Processdist/heart/auth/auth-flow.js
HighShelldist/heart/daemon/cli-exec.js
HighSame File Env Network Executiondist/heart/auth/auth-flow.js
HighCredential Redirect Persistencedist/heart/auth/auth-flow.js
HighCross File Remote Execution Contextdeploy/unraid/sanctuary-butler-upgrade.mjs
HighTrigger Reachable Persistencedist/heart/versioning/ouro-path-installer.js
HighRuntime Package Installdist/heart/versioning/ouro-version-manager.js
HighSemantic Analysis Limiteddist/heart/auth/auth-flow.js#virtual:normalized:round1
MediumSecret Patterndist/heart/daemon/cli-exec.js
Affected versions and remediation
This report applies to @ouro.bot/cli@0.1.0-alpha.870.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ouro.bot/cli@0.1.0-alpha.870. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.