registry / Data exfiltration / bridgerator

bridgerator

Connect ChatGPT to your Windows PC: files, search and terminal through an outbound-only bridge with folder limits. No inbound ports, no admin rights.

This report shows the evidence for bridgerator@1.1.0. 2 of 5 known versions are blocked or flagged. The newest version, 1.1.1, is allowed. See all versions.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected dependency manifest and tracker establish automatic install-time disclosure of an identifier and installation context to a third-party publisher without recipient-specific consent. This supports blocking under the installation beacon policy.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing bridgerator through npm, which installs the desktop-commander dependency and runs its postinstall hook.

Impact

Installation metadata and an identifier are disclosed to the dependency publisher during package installation.

Mechanism

The hook reads or generates a client ID, collects installation context, and posts the event to fixed telemetry endpoints without recipient-specific consent.

Attack narrative

Bridgerator depends on desktop-commander, whose npm postinstall runs an installation tracker. It reads an existing client ID or creates one, gathers install-context details, and posts them to the dependency publisher's telemetry endpoints. The inspected tracker has no recipient-specific consent gate, and Bridgerator's separate telemetry opt-out does not control this dependency hook.

AI rationale

Evidence

package.json.lpm-dependency-evidence-bb280e19-288d-4864-ae87-db5dd9e5fd51/2/npm-linux/package.json.lpm-dependency-evidence-bb280e19-288d-4864-ae87-db5dd9e5fd51/2/npm-linux/dist/track-installation.js

Network endpoints2

telemetry.desktopcommander.app/mp/collectdc-telemetry-proxy-83847352264.europe-west1.run.app/mp/collect

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json includes desktop-commander as a runtime dependency; that dependency's postinstall invokes its installation tracker.
The tracker reuses a client ID from the user's home configuration or generates one, and gathers installation context from environment and process data.
The install event payload includes the client ID and serialized installation details, then sends a POST to the dependency publisher's telemetry endpoints.
The tracker is invoked by the dependency's postinstall without a recipient-specific consent check.

Evidence against

Bridgerator's own telemetry module documents an opt-out, but the inspected dependency install tracker does not use that setting.
The dependency tracker reads an existing client ID when available and otherwise creates a random ID; the inspected excerpts do not show collection of passwords or file contents.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Source & flagged code

9 flagged

src/undo.mjsView file

Lines 1-29javascript

1// LOGIC: see critical-logic/bridge.md ("Snapshots and Undo"). Before the AI writes, edits, moves or

2// (through the Recycle Bin path) deletes a file, a copy goes to %LOCALAPPDATA%\Bridgerator\snapshots

3// (inside the always-excluded folder, never sent anywhere). "Undo" puts the old state back — but never

4// over a file someone changed after the AI's action (size / time differ from what the AI left): that

5// file is skipped and reported. Limits: days, total MB, biggest file MB (a bigger file gets no copy:

6// the action is marked "no undo").

7import fs from 'node:fs';

8import path from 'node:path';

9import crypto from 'node:crypto';

10import cp from 'node:child_process';

11import { writeAtomic } from './confirm.mjs';

High

Child Process

Package source references child process execution.

src/undo.mjsView on unpkg · L9

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/undo.mjsView on unpkg · L9

12import { POWERSHELL, psArgs } from './win.mjs';

14export const SNAP_DEFAULTS = { enabled: true, days: 7, maxMb: 500, maxFileMb: 50 };

15const MAX_TREE_FILES = 5000;

16const MB = 1024 * 1024;

18/**

19 * Current state of a path: { kind: 'none' } | { kind: 'file', size, mtimeMs, hash? } | { kind: 'dir' }.

20 * Small files also get a content hash: two writes of the same size within one millisecond look alike otherwise.

21 */

22export function sig(p) {

23 try {

24 const s = fs.lstatSync(p);

25 if (s.isDirectory()) return { kind: 'dir' };

26 const out = { kind: 'file', size: s.size, mtimeMs: Math.round(s.mtimeMs) };

27 if (s.size <= HASH_MAX) { try { out.hash = crypto.createHash('sha1').update(fs.readFileSync(p)).digest('hex'); } catch { /* locked: size + time only */ } }

28 return out;

29 } catch { return { kind: 'none' }; }

src/docs-tool.mjsView file

Lines 1-34javascript

1// LOGIC: see critical-logic/bridge.md ("Extra tools" → create_document). New Word / Excel / PDF files

2// from markdown and tables, without Office or a browser: libraries the bundled engine already ships

3// (markdown-it, jszip, exceljs, pdf-lib; see lib()) + system fonts (pdf-font.mjs). A file is never overwritten:

4// an existing name gets " (2)". Paths go through the same folder rules as file writes (guard).

5import fs from 'node:fs';

6import path from 'node:path';

src/bridge.mjsView file

Lines 1-23javascript

1// Bridgerator bridge: runs on the user's PC.

2// - starts the bundled open-source Desktop Commander MCP server as a child over stdio;

3// - pushes this PC's limits (allowedDirectories, blockedCommands) into it at startup;

4// - opens ONE outbound WebSocket to the relay (no inbound port is opened on this PC);

5// - forwards each relay `call` through the policy (excluded / read-only folders, disabled tools)

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/bridge.mjsView on unpkg · L3

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/bridge.mjsView on unpkg · L3

vendor/webview2/x64/WebView2Loader.dllView file

•path = [redacted].dll kind = native_binary sizeBytes = 194912 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/webview2/x64/WebView2Loader.dllView on unpkg

install.ps1View file

•path = install.ps1 kind = build_helper sizeBytes = 34759 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.ps1View on unpkg

src/ask.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/ask.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

src/undo.mjsView file

9import crypto from 'node:crypto'; L10: import cp from 'node:child_process'; L11: import { writeAtomic } from './confirm.mjs';

High

Child Process

Package source references child process execution.

src/undo.mjsView on unpkg · L9

9import crypto from 'node:crypto'; L10: import cp from 'node:child_process'; L11: import { writeAtomic } from './confirm.mjs'; ... L43: export function procStart(pid) { L44: if (process.platform !== 'win32') return Promise.resolve(null); L45: return new Promise((resolve) => { ... L99: const readMeta = (id) => { L100: const a = JSON.parse(fs.readFileSync(metaFile(id), 'utf8')); L101: if (!a || a.id !== id || !Array.isArray(a.entries)) throw new Error('bad meta');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/undo.mjsView on unpkg · L9

src/docs-tool.mjsView file

14export async function lib(name) { L15: try { return await import(name); } catch (e) { L16: if (e?.code !== 'ERR_MODULE_NOT_FOUND') throw e;

Medium

Findings

3 Critical2 High6 Medium5 Low

CriticalSame File Env Network Executionsrc/bridge.mjs

CriticalDownload Executesrc/bridge.mjs

CriticalTrigger Reachable Dangerous Capabilitysrc/bridge.mjs

HighChild Processsrc/undo.mjs

HighSemantic Analysis Limitedsrc/ask.mjs#virtual:normalized:round1

MediumDynamic Requiresrc/docs-tool.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryvendor/webview2/x64/WebView2Loader.dll

MediumShips Build Helperinstall.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/undo.mjs

Affected versions and remediation

This report applies to bridgerator@1.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing bridgerator@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-21 06:04:02.050Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

1.1.1latestUnknown—AllowUnder ReviewOct 21, 2026, 8:57 AM 1.1.0shownMaliciousData ExfiltrationBlockPublishedOct 21, 2026, 6:00 AM 1.0.8Unknown—AllowUnder ReviewOct 20, 2026, 6:34 PM 1.0.7MaliciousData ExfiltrationBlockPublishedOct 20, 2026, 6:05 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code