Loading npm security reports…

@tapi-dev/sdk@0.1.46: Malicious npm security report (Block) | LPM Firewall

registry / @tapi-dev/sdk / 0.1.46

@tapi-dev/sdk@0.1.46

Official JavaScript and TypeScript client for TAPI developer APIs.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Explicit tapi login and tapi studio dev commands collect and reuse Google and Firebase credentials through remote services. The login flow directs users to a GitLab-hosted page and passes its returned tokens into the CLI.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs tapi login or tapi studio dev.

Impact

An attacker-controlled authentication page or downstream service could obtain reusable user credentials and access authenticated project resources.

Mechanism

Remote authentication token capture, token persistence, and token forwarding to a Vite subprocess.

Attack narrative

The package exposes a CLI that starts a localhost callback listener, opens a GitLab-hosted authentication page, and accepts Google tokens supplied to that listener. It exchanges and persists Firebase credentials. Its studio command later refreshes those credentials and supplies an ID token to a Vite process while using a Railway endpoint by default. This credential-bearing flow is not required for SDK imports and is activated only by explicit CLI commands, but the third-party authentication page and opaque default service make it a concrete credential-exfiltration risk.

Rationale

The source establishes a credential collection and forwarding chain involving a GitLab-hosted login page and opaque default service endpoints. Lack of install hooks reduces automatic impact but does not remove the explicit-command credential theft risk.

Evidence

dist/cli.jsdist/studio-dev.js~/.local/share/tapi/auth.json

Network endpoints4

rsarlong-1f92fd.gitlab.io

Source & flagged code

12 flagged · loading source

dist/studio-dev.jsView file

1import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L19: const phases = [{ message: "SDK development launch requested" }]; L20: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L21: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L34: const env = { L35: ...process.env, L36: TAPI_BASE_URL: options.apiBaseUrl, ... L53: phases.push({ message: "Vite UI is ready", detail: `127.0.0.1:${uiPort}` }); L54: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L55: const url = `http://127.0.0.1:${uiPort}/?tapp=${encodeURIComponent(tappId)}&tapiDevLaunch=${launchTrace}`;

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/studio-dev.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/studio-dev.js L1: import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L19: const phases = [{ message: "SDK development launch requested" }]; L20: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L21: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L34: const env = { L35: ...process.env, L36: TAPI_BASE_URL: options.apiBaseUrl, ... L53: phases.push({ message: "Vite UI is ready", detail: `127.0.0.1:${uiPort}` }); L54: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L55: const url = `http://127.0.0.1:${uiPort}/?tapp=${encodeURIComponent(tapp

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/studio-dev.jsView on unpkg · L1

8patternName = google_api_key severity = high line = 8

High

High Secret

Package contains a high-severity secret pattern.

dist/studio-dev.jsView on unpkg · L8

1import { spawn } from "node:child_process"; L2: import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/studio-dev.jsView on unpkg · L1

234if (process.platform === "win32") { L235: return spawn(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `npm.cmd run dev -- --host 127.0.0.1 --port ${port} --strictPort`], { L236: cwd: uiRoot,

High

Shell

Package source references shell execution.

dist/studio-dev.jsView on unpkg · L234

1import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L19: const phases = [{ message: "SDK development launch requested" }]; L20: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L21: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L34: const env = { L35: ...process.env, L36: TAPI_BASE_URL: options.apiBaseUrl, ... L53: phases.push({ message: "Vite UI is ready", detail: `127.0.0.1:${uiPort}` }); L54: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L55: const url = `http://127.0.0.1:${uiPort}/?tapp=${encodeURIComponent(tappId)}&tapiDevLaunch=${launchTrace}`;

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/studio-dev.jsView on unpkg · L1

1import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L19: const phases = [{ message: "SDK development launch requested" }]; L20: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L21: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L34: const env = { L35: ...process.env, L36: TAPI_BASE_URL: options.apiBaseUrl, ... L53: phases.push({ message: "Vite UI is ready", detail: `127.0.0.1:${uiPort}` }); L54: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L55: const url = `http://127.0.0.1:${uiPort}/?tapp=${encodeURIComponent(tappId)}&tapiDevLaunch=${launchTrace}`;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/studio-dev.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.js -> dist/studio-dev.js L1: import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L19: const phases = [{ message: "SDK development launch requested" }]; L20: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L21: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L34: const env = { L35: ...process.env, L36: TAPI_BASE_URL: options.apiBaseUrl, ... L53: phases.push({ message: "Vite UI is ready", detail: `127.0.0.1:${uiPort}` }); L54: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L55: const url = `http://127.0.0.1:${uiPort}/?tapp=$

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/studio-dev.jsView on unpkg · L1

8patternName = google_api_key severity = high line = 8

High

Secret Pattern

Google API key in dist/studio-dev.js

dist/studio-dev.jsView on unpkg · L8

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises"; import { emitKeypressEvents } from "node:readline"; raw.apiBaseUrl = requireOptionValue(args, ++index, arg); raw.apiBaseUrl = arg.slice("--api-base-url=".length); raw.apiBaseUrl = arg.slice("--server=".length); const apiBaseUrl = normalizeHttpUrl(raw.apiBaseUrl const downloadsBaseUrl = normalizeHttpUrl(envString("TAPI_DOWNLOADS_BASE_URL") ?? DEFAULT_DOWNLOADS_BASE_URL, "TAPI_DOWNLOADS_BASE_URL"); : `${downloadsBaseUrl.replace(/\/+$/, "")}/studio/channels/${channel}/latest.json`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L25

dist/runner-dev.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tapi-dev/sdk@0.1.45 matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.1.45 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runner-dev.jsView on unpkg

Source & flagged code

12 flagged

dist/studio-dev.jsView file

Lines 1-28javascript

1import { spawn } from "node:child_process";

2import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/studio-dev.jsView on unpkg · L1

3import { existsSync, readFileSync } from "node:fs";

4import { mkdir, writeFile } from "node:fs/promises";

5import { homedir } from "node:os";

6import { dirname, join, resolve } from "node:path";

7const DEFAULT_API_BASE_URL = "https://determined-motivation-production.up.railway.app";

8const DEFAULT_FIREBASE_API_KEY = "AIzaSyCDZR8lWyVQcWYfFdNZa4vuL4IWEC0h6gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/studio-dev.jsView on unpkg · L8

9const READY_TIMEOUT_MS = 120_000;

10export async function openStudioDev(args) {

11 if (args.includes("--help") || args.includes("-h")) {

12 printStudioDevHelp();

13 return 0;

14 }

15 const children = [];

16 let stopping = false;

17 try {

18 const options = parseDevOptions(args);

19 const phases = [{ message: "SDK development launch requested" }];

20 const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd());

21 const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser");

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/studio-dev.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/studio-dev.jsView on unpkg · L1

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/studio-dev.jsView on unpkg · L1

High

22 const auth = await refreshAuthRecord();

23 const tappId = options.tappId || readLastSelectedTapp();

24 if (!tappId) {

25 throw new Error("A Tapp is required. Use `tapi studio dev --tapp <id>`. ");

26 }

27 phases.push({ message: "Authenticated with Tapi", detail: auth.uid });

28 phases.push({ message: "Selected Tapp", detail: tappId });

Lines 214-254javascript

214 if (status.state === "online" && capacityId)

215 return { ...status, capacityId };

216 if (status.state === "error")

217 throw new Error

8patternName = google_api_key severity = high line = 8

High

Secret Pattern

Google API key in dist/studio-dev.js

dist/studio-dev.jsView on unpkg · L8

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises"; import { emitKeypressEvents } from "node:readline"; raw.apiBaseUrl = requireOptionValue(args, ++index, arg); raw.apiBaseUrl = arg.slice("--api-base-url=".length); raw.apiBaseUrl = arg.slice("--server=".length); const apiBaseUrl = normalizeHttpUrl(raw.apiBaseUrl const downloadsBaseUrl = normalizeHttpUrl(envString("TAPI_DOWNLOADS_BASE_URL") ?? DEFAULT_DOWNLOADS_BASE_URL, "TAPI_DOWNLOADS_BASE_URL"); : `${downloadsBaseUrl.replace(/\/+$/, "")}/studio/channels/${channel}/latest.json`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L25

dist/runner-dev.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tapi-dev/sdk@0.1.45 matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.1.45 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runner-dev.jsView on unpkg