registry / codex-multi-auth / 2.5.0

codex-multi-auth@2.5.0

Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 305 file(s), 2.35 MB of source, external domains: 127.0.0.1, api.github.com, api.openai.com, auth.openai.com, chatgpt.com, codex-multi-auth.local, github.com, json-schema.org, raw.githubusercontent.com, registry.npmjs.org, www.apple.com

Source & flagged code

4 flagged

package.jsonView file

Lines 93-133json

93 "test:ui": "vitest --ui",

94 "test:model-matrix": "node scripts/test-model-matrix.js",

95 "test:model-matrix:smoke": "node scripts/test-model-matrix.js --smoke",

96 "test:model-matrix:report": "node scripts/test-model-matrix.js --smoke --report-json=.tmp/model-matrix-report.json",

97 "clean:repo": "node scripts/repo-hygiene.js clean --mode aggressive",

98 "clean:repo:check": "node scripts/repo-hygiene.js check",

99 "pack:check": "npm run build && node scripts/check-pack-budget.mjs",

100 "bench:edit-formats": "node scripts/benchmark-edit-formats.mjs --preset=codex-core",

101 "bench:edit-formats:smoke": "node scripts/benchmark-edit-formats.mjs --smoke --preset=codex-core",

102 "bench:edit-formats:render": "node scripts/benchmark-render-dashboard.mjs",

103 "bench:runtime-path": "npm run build && node scripts/benchmark-runtime-path.mjs",

104 "bench:runtime-path:quick": "node scripts/benchmark-runtime-path.mjs",

105 "test:coverage": "vitest run --coverage --maxWorkers=1",

106 "coverage": "npm run build && vitest run --coverage --maxWorkers=1",

107 "audit:prod": "npm audit --omit=dev --audit-level=high",

108 "audit:all": "npm audit --audit-level=high",

109 "audit:dev:allowlist": "node scripts/audit-dev-allowlist.js",

110 "audit:ci": "npm run audit:prod && npm run audit:dev:allowlist",

111 "vendor:verify": "node scripts/verify-vendor-provenance.mjs",

112 "vendor:update-manifest": "node scripts/update-vendor-provenance.mjs",

113 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L113

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L113

114 "prepublishOnly": "npm run build",

115 "prepare": "husky"

116 },

117 "bin": {

118 "mcodex": "scripts/mcodex.js",

119 "codex-multi-auth-codex": "scripts/codex.js",

120 "codex-multi-auth-app-launcher": "scripts/codex-app-launcher.js",

121 "codex-multi-auth": "scripts/codex-multi-auth.js"

122 },

123 "files": [

124 ".codex-plugin/plugin.json",

125 "dist/",

126 "assets/",

127 "config/",

128 "scripts/codex.js",

129 "scripts/codex-app-launcher.js",

130 "scripts/codex-app-router.js",

131 "scripts/codex-bin-resolver.js",

132 "scripts/codex-multi-auth.js",

133 "scripts/codex-routing.js",

dist/lib/codex-manager/commands/uninstall.jsView file

Lines 62-102javascript

62 for (const arg of args) {

63 if (arg === "--help" || arg === "-h") {

64 return { ok: false, reason: "help" };

65 }

dist/lib/tools/hashline-tools.jsView file

Lines 46-86javascript

46function clipLine(text) {

47 if (text.length <= LINE_PREVIEW_LIMIT)

48 return text;

49 return `${text.slice(0, LINE_PREVIEW_LIMIT - 3)

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib/codex-manager/commands/uninstall.jsView file

82async function loadDefaultLauncher() { L83: const launcherModule = await import(new URL("../../../../scripts/codex-app-launcher.js", import.meta.url).href); L84: if (typeof launcherModule.installCodexAppLauncher !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/codex-manager/commands/uninstall.jsView on unpkg · L82

dist/lib/tools/hashline-tools.jsView file

66} L67: const baseDir = context.directory || process.cwd(); L68: return normalize(isAbsolute(trimmed) ? trimmed : resolve(baseDir, trimmed)); ... L82: always: [absolutePath], L83: metadata: { path: absolutePath }, L84: });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/tools/hashline-tools.jsView on unpkg · L66

Findings

1 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/lib/codex-manager/commands/uninstall.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/lib/tools/hashline-tools.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings