registry / blogger-publisher / 1.3.2

blogger-publisher@1.3.2

A powerful CLI to automate your Blogger publishing using Markdown, Multi-CDN, and AI Agents.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A user-invoked publish operation can use OAuth credentials shipped by the package rather than user-supplied credentials. It sends selected Markdown and local images to the Blogger/Drive account bound to the embedded refresh token.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running `blogger-publisher publish` without overriding the bundled configuration.

Impact

User content and images can be uploaded to a third-party account; Drive uploads are made public.

Mechanism

Packaged OAuth credential injection into publishing and image-upload flows.

Attack narrative

The package ships an OAuth refresh token and default blog configuration, then loads them implicitly through `dotenv`. When a user runs the documented publishing flow without replacing configuration, local Markdown and referenced images are sent using the embedded account; the Drive uploader also grants public read access to uploaded images.

Rationale

Bundled operational OAuth credentials create a concrete, implicit data-routing path from user files to a third-party account. The absence of install hooks does not mitigate this user-triggered exfiltration behavior.

Evidence

.envlib/config.jslib/auth.jslib/publisher.jslib/uploaders/drive.jspackage.json

Network endpoints2

blogger-publisher@1.3.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code