registry / bridgerator / 1.0.0

bridgerator@1.0.0

Connect your Windows PC to ChatGPT: files, search and terminal through an outbound-only bridge. Bundles Desktop Commander and adds folder exclusions.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Source inspection found no install lifecycle hook. The persistence and relay connection are activated by an explicit setup command that requires a device key and match the package's bridge functionality.

Static reason

No blocking static signals were detected.

Trigger

The user runs bridgerator setup with a device key.

Impact

The configured relay can invoke the exposed computer tools while the bridge is running; this is the package's stated function, not an independently established attack.

Mechanism

Setup stores configuration, registers a per-user logon task, and starts a bridge that sends the key to the configured relay.

AI rationale

Evidence

package.jsonsrc/cli.mjssrc/bridge.mjssrc/policy.mjs

Network endpoints1

wss://mcp.bridgerator.recondeck.com/link

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines only start and test scripts, with no install lifecycle hook.
src/cli.mjs requires the explicit setup command and a device key before configuration.
Setup creates the per-user scheduled task and starts the bridge; this persistence follows the user-invoked setup path.
src/bridge.mjs connects to the configured relay and sends the device key to register the bridge.
src/policy.mjs hides tools that could change the bridge limits or expose engine telemetry.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 20.1 KB of source, external domains: bridgerator.recondeck.com, mcp.bridgerator.recondeck.com

Source & flagged code

6 flagged

src/cli.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// bridgerator setup --token <t> [--relay <wss url>] [--allow <dir>]... [--deny <dir>]... → config + autostart + start

3// bridgerator run | status | uninstall

4import fs from 'node:fs';

5import os from 'node:os';

6import path from 'node:path';

7import { spawn, execFileSync } from 'node:child_process';

8import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

src/cli.mjsView on unpkg · L6

9import { startDesktopCommander, connect } from './bridge.mjs';

11const DEFAULT_RELAY = 'wss://mcp.bridgerator.recondeck.com/link';

12const TASK = 'Bridgerator';

13const home = os.homedir();

14const DIR = process.env.BRIDGERATOR_HOME || path.join(process.env.APPDATA || path.join(home, '.config'), 'Bridgerator');

15const CONFIG = path.join(DIR, 'config.json');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/cli.mjsView on unpkg · L6

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli.mjsView on unpkg · L6

16const LOG = path.join(DIR, 'bridge.log');

17const SELF = fileURLToPath(import.meta.url);

19function parse(argv) {

20 const o = { _: [] };

21 for (let i = 0; i < argv.length; i++) {

22 const a = argv[i];

23 if (!a.startsWith('--')) { o._.push(a); continue; }

24 const k = a.slice(2), v = argv[i + 1];

25 if (v === undefined || v.startsWith('--')) { o[k] = true; continue; }

26 i++;

•package payload decode/persist/execute = #!/usr/bin/env node\n \n \nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { spawn, execfilesync } from 'node:child_process';\nimport { fileurltopath } from 'node:url';\nimport { startdesktopcommander, connect } from './bridge.mjs';\n\nconst default_relay = 'wss://mcp.bridgerator.recondeck.com/link';\nconst task = 'bridgerator';\nconst home = os.homedir();\nconst dir = process.env.bridgerator_home || path.join(process.env.appdata || path.join(home, '.config'), 'bridgerator');\nconst config = path.join(dir, 'config.json');\nconst log = path.join(dir, '

High

Embedded Payload Persistence Activation

Source reads and decodes a package payload, writes it to a hidden executable path, registers persistence, and launches it.

src/cli.mjsView on unpkg

install.ps1View file

•path = install.ps1 kind = build_helper sizeBytes = 4511 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.ps1View on unpkg

package.jsonView file

Lines 1-34json

2 "name": "bridgerator",

3 "version": "1.0.0",

4 "description": "Connect your Windows PC to ChatGPT: files, search and terminal through an outbound-only bridge. Bundles Desktop Commander and adds folder exclusions.",

5 "license": "MIT",

Source & flagged code

6 flagged · loading source

src/cli.mjsView file

6import path from 'node:path'; L7: import { spawn, execFileSync } from 'node:child_process'; L8: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

src/cli.mjsView on unpkg · L6

High

Embedded Payload Persistence Activation

Source reads and decodes a package payload, writes it to a hidden executable path, registers persistence, and launches it.

src/cli.mjsView on unpkg

6Trigger-reachable persistence chain: scripts.start -> src/cli.mjs L6: import path from 'node:path'; L7: import { spawn, execFileSync } from 'node:child_process'; L8: import { fileURLToPath } from 'node:url'; ... L12: const TASK = 'Bridgerator'; L13: const home = os.homedir(); L14: const DIR = process.env.BRIDGERATOR_HOME || path.join(process.env.APPDATA || path.join(home, '.config'), 'Bridgerator'); L15: const CONFIG = path.join(DIR, 'config.json'); ... L32: function readConfig() { L33: try { return JSON.parse(fs.readFileSync(CONFIG, 'utf8')); } catch { return null; } L34: } ... L46: function installAutostart() { L47: if (process.platform !== 'win32') return 'autostart: not Windows — start `bridgerator run` yourself';

Findings

3 High4 Medium5 Low

HighChild Processsrc/cli.mjs

HighEmbedded Payload Persistence Activationsrc/cli.mjs

HighTrigger Reachable Persistencesrc/cli.mjs

MediumEnvironment Vars

MediumInstall Persistencesrc/cli.mjs

MediumShips Build Helperinstall.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to bridgerator@1.0.0.

See all versions of bridgerator for other recorded verdicts.

Review the evidence and your use of bridgerator@1.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 18:09:01.927Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code