registry / codex-multi-auth / 2.6.1

codex-multi-auth@2.6.1

Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 307 file(s), 2.36 MB of source, external domains: 127.0.0.1, api.github.com, api.openai.com, auth.openai.com, chatgpt.com, codex-multi-auth.local, github.com, json-schema.org, raw.githubusercontent.com, registry.npmjs.org, www.apple.com

Source & flagged code

5 flagged

package.jsonView file

Lines 93-133json

93 "test:ui": "vitest --ui",

94 "test:model-matrix": "node scripts/test-model-matrix.js",

95 "test:model-matrix:smoke": "node scripts/test-model-matrix.js --smoke",

96 "test:model-matrix:report": "node scripts/test-model-matrix.js --smoke --report-json=.tmp/model-matrix-report.json",

97 "clean:repo": "node scripts/repo-hygiene.js clean --mode aggressive"

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib/codex-manager/commands/uninstall.jsView file

82async function loadDefaultLauncher() { L83: const launcherModule = await import(new URL("../../../../scripts/codex-app-launcher.js", import.meta.url).href); L84: if (typeof launcherModule.installCodexAppLauncher !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/codex-manager/commands/uninstall.jsView on unpkg · L82

dist/lib/tools/hashline-tools.jsView file

66} L67: const baseDir = context.directory || process.cwd(); L68: return normalize(isAbsolute(trimmed) ? trimmed : resolve(baseDir, trimmed)); ... L82: always: [absolutePath], L83: metadata: { path: absolutePath }, L84: });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/tools/hashline-tools.jsView on unpkg · L66

scripts/codex.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codex-multi-auth@2.5.0 matchedIdentity = npm:Y29kZXgtbXVsdGktYXV0aA:2.5.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/codex.jsView on unpkg

Findings

2 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltascripts/codex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/lib/codex-manager/commands/uninstall.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/lib/tools/hashline-tools.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/lib/codex-manager/commands/uninstall.jsView file

Lines 62-102javascript

62 for (const arg of args) {

63 if (arg === "--help" || arg === "-h") {

64 return { ok: false, reason: "help" };

65 }

66 if (arg === "--dry-run") {

67 options.dryRun = true;

68 continue;

69 }

70 if (arg === "--json" || arg === "-j") {

71 options.json = true;

72 continue;

73 }

74 if (arg === "--clear-accounts") {

75 options.clearAccounts = true;

76 continue;

77 }

78 return { ok: false, reason: "error", message: `Unknown option: ${arg}` };

79 }

80 return { ok: true, options };

81}

82async function loadDefaultLauncher() {

83 const launcherModule = await import(new URL("../../../../scripts/codex-app-launcher.js", import.meta.url).href);

84 if (typeof launcherModule.installCodexAppLauncher !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/codex-manager/commands/uninstall.jsView on unpkg · L82

85 throw new Error("codex-app-launcher.js does not export installCodexAppLauncher");

86 }

87 return launcherModule.installCodexAppLauncher;

88}

89export async function runUninstallCommand(args, deps = {}) {

90 const parsed = parseUninstallArgs(args);

91 if (!parsed.ok) {

92 if (parsed.reason === "help") {

93 printUninstallUsage();

94 return 0;

95 }

96 console.error(`codex-multi-auth uninstall: ${parsed.message}`);

97 console.error('Run "codex-multi-auth uninstall --help" for usage.');

98 return 1;

99 }

100 const { dryRun, json, clearAccounts } = parsed.options;

101 const log = deps.log ?? ((msg) => console.error(`codex-multi-auth: ${msg}`));

102 const paths = deps.paths ?? resolveUninstallPaths();

dist/lib/tools/hashline-tools.jsView file

Lines 46-86javascript

46function clipLine(text) {

47 if (text.length <= LINE_PREVIEW_LIMIT)

48 return text;

49 return `${text.slice(0, LINE_PREVIEW_LIMIT - 3)}...`;

50}

51function findUnresolvedLegacyPlaceholder(value) {

52 const match = LEGACY_TEMPLATE_PLACEHOLDER_REGEX.exec(value);

53 return match?.[0] ?? null;

54}

55function parseOperation(value) {

56 const normalized = (value ?? "replace").trim().toLowerCase();

57 if (HASHLINE_OPERATIONS.has(normalized)) {

58 return normalized;

59 }

60 return null;

61}

62function resolveToolPath(pathValue, context) {

63 const trimmed = pathValue.trim();

64 if (!trimmed) {

65 throw new Error("path is required");

66 }

67 const baseDir = context.directory || process.cwd();

68 return normalize(isAbsolute(trimmed) ? trimmed : resolve(baseDir, trimmed));

69}

70function toDisplayPath(absolutePath, context) {

71 const root = context.worktree || context.directory || process.cwd();

72 const rel = relative(root, absolutePath);

73 if (!rel || rel.startsWith("..")) {

74 return absolutePath;

75 }

76 return rel.replace(/\\/g, "/");

77}

78async function askFilePermission(context, permission, absolutePath) {

79 await context.ask({

80 permission,

81 patterns: [absolutePath],

82 always: [absolutePath],

83 metadata: { path: absolutePath },

84 });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/tools/hashline-tools.jsView on unpkg · L66

85}

86function resolveHashlineRef(lines, ref, label) {