registry / copilot-api-node20 / 0.42.0

copilot-api-node20@0.42.0

⚠ Under review

Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code! (Node v20+ fork)

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 155 KB of source, external domains: 1.1.1.1, 127.0.0.1, api.exa.ai, api.github.com, api.githubcopilot.com, api.honeycomb.io, api.tavily.com, barazany.dev, claude.com, copilot-api.barazany.dev, github.com, registry.npmjs.org, tailscale.com, www.google.com, www.npmjs.com

Source & flagged code

4 flagged

dist/main.mjsView file

Lines 1-2javascript

1#!/usr/bin/env node

2import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:path";import{SpanKind as l,SpanStatusCode as c,context as u,metrics as p,trace as d}from"@opentelemetry/api";import m from"clipboardy";import{execFile as f,execSync as h}from"node:child_process";import g from"node:process";import{SeverityNumber as _,logs as y}from"@opentelemetry/api-logs";import{OTLPLogExporter as w}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPMetricExporter as k}from"@opentelemetry/exporter- ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.mjsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/main.mjsView on unpkg · L1

Long lines were clipped for display.

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/main.mjs: import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:pat...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main.mjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/main.mjsView file

copilot-api-node20@0.42.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code