registry / Data exfiltration / bridgerator / 1.0.7

bridgerator@1.0.7

Connect ChatGPT to your Windows PC: files, search and terminal through an outbound-only bridge with folder limits. No inbound ports, no admin rights.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The parent package's pinned dependency declares an automatic postinstall tracker that sends a persistent client ID and installation metadata to its vendor's telemetry endpoint. This unconsented installation-time disclosure supports blocking publication.

Static reason

No blocking static signals were detected.

Trigger

Installing bridgerator causes npm to run the dependency's postinstall script.

Impact

The dependency vendor receives a persistent client identifier and installation metadata without an affirmative consent step in the inspected flow.

Mechanism

The tracker reads a client ID from an existing user configuration, builds an installation event, and sends it to the dependency's telemetry service.

Attack narrative

During bridgerator installation, npm runs the pinned desktop commander dependency's postinstall tracker. The tracker reads a persistent client ID from the user's existing configuration, adds it to an installation event with platform and source details, and sends the event to the dependency's telemetry service. No affirmative consent check appears in this path.

AI rationale

Evidence

package.json.lpm-dependency-evidence-47684f52-020a-4f41-ac0f-939b43c5132e/2/npm-linux/package.json.lpm-dependency-evidence-47684f52-020a-4f41-ac0f-939b43c5132e/2/npm-linux/dist/track-installation.js

Network endpoints1

telemetry.desktopcommander.app/mp/collect

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest includes the pinned desktop commander dependency, whose postinstall runs its installation tracker.
The tracker reads an existing client ID from the user's desktop configuration and puts that ID and installation details in a package-installed event.
When executed directly by the postinstall, the tracker sends the event over HTTPS to the dependency's telemetry endpoint.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 26.4 KB of source, external domains: bridgerator.recondeck.com

Source & flagged code

6 flagged

src/notice.mjsView file

Lines 1-23javascript

1// Plan notices from the relay (limit reached, Pro ending/ended) shown as a Windows notification with

2// an "Open account" button. They never go into the ChatGPT chat (app rules: no upgrade links there).

3// The link is fixed here — the relay only says which notice, not where to send the user.

4import { execFile } from 'node:child_process';

High

Child Process

Package source references child process execution.

src/notice.mjsView on unpkg · L3

6export const ACCOUNT_URL = 'https://bridgerator.recondeck.com/app';

7const day = (iso) => String(iso || '').slice(0, 10);

8const xml = (s) => String(s).replace(/[<>&"']/g, (c) => ({ '<': '<', '>': '>', '&': '&', '"':

10// ponytail: English only for now (owner, 20.10); other languages later.

11export function noticeText(n) {

12 const t = {

13 limit: ['Bridgerator: monthly limit reached', `${n.calls} of ${n.limit} tool calls used. ChatGPT can't use this PC until the 1st. Turn on Pro in your account.`],

14 expired: ['Bridgerator Pro has ended', "You're on Free now (10,000 tool calls a month). Renew Pro in your account."],

15 expiring: [`Bridgerator Pro ends on ${day(n.until)}`, 'Pay for 30 more days in your account to keep unlimited calls.'],

16 }[n.kind];

17 return t && { title: t[0], body: t[1], button: 'Open account' };

18}

20export function toastXml({ title, body, button }) {

21 return `<toast activationType="protocol" launch="${ACCOUNT_URL}"><visual><binding template="ToastGeneric"><text>${xml(title)}</text><text>${xml(body)}</text></binding></visual>`

22 + `<actions><action content="${xml(button)}" activationType="protocol" arguments="${ACCOUNT_URL}"/></actions></toast>`;

23}

src/cli.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// bridgerator setup [--token <t> | --pair] [--relay <wss url>] [--allow <dir>]... [--deny <dir>]... → config + autostart + start

3// (no key yet: pairs this PC through the browser — the signed-in owner confirms a code)

4// bridgerator run | status | uninstall

5import fs from 'node:fs';

6import os from 'node:os';

7import path

install.ps1View file

•path = install.ps1 kind = build_helper sizeBytes = 5125 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.ps1View on unpkg

package.jsonView file

Lines 5-45json

5 "license": "MIT",

6 "type": "module",

7 "bin": {

8 "bridgerator": "src/cli.mjs"

9 },

10 "files": [

Source & flagged code

6 flagged · loading source

src/notice.mjsView file

3// The link is fixed here — the relay only says which notice, not where to send the user. L4: import { execFile } from 'node:child_process'; L5:

High

Child Process

Package source references child process execution.

src/notice.mjsView on unpkg · L3

src/cli.mjsView file

•package payload decode/persist/execute = #!/usr/bin/env node\n \n \n \nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { spawn, execfilesync } from 'node:child_process';\nimport { fileurltopath } from 'node:url';\nimport { startdesktopcommander, connect } from './bridge.mjs';\nimport { pair, siteof } from './pair.mjs';\n\nconst default_relay = 'wss://mcp.bridgerator.recondeck.com/link';\nconst task = 'bridgerator';\nconst home = os.homedir();\nconst dir = process.env.bridgerator_home || path

High

Embedded Payload Persistence Activation

Source reads and decodes a package payload, writes it to a hidden executable path, registers persistence, and launches it.

src/cli.mjsView on unpkg

Findings

4 High4 Medium4 Low

HighChild Processsrc/notice.mjs

HighEmbedded Payload Persistence Activationsrc/cli.mjs

HighTrigger Reachable Persistencesrc/cli.mjs

HighSuspicious Lifecycle Evidencepackage.json

MediumEnvironment Vars

MediumInstall Persistencesrc/cli.mjs

MediumShips Build Helperinstall.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to bridgerator@1.0.7.

See all versions of bridgerator for other recorded verdicts.

Avoid installing bridgerator@1.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 18:08:18.975Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other data exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other data exfiltration packages