creditgauge: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

creditgauge: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

query_plugins/opencode/auth.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = creditgauge@1.1.7 matchedIdentity = npm:Y3JlZGl0Z2F1Z2U:1.1.7 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

query_plugins/opencode/auth.cjsView on unpkg

31const readline = require("readline"); L32: const { execSync } = require("child_process"); L33: const { homedir } = require("os");

High

Child Process

Package source references child process execution.

query_plugins/opencode/auth.cjsView on unpkg · L31

31const readline = require("readline"); L32: const { execSync } = require("child_process"); L33: const { homedir } = require("os"); ... L47: L48: const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); L49: return new Promise((resolve, reject) => { ... L95: /** opencode.ai 工作区 URL 模板 */ L96: const WORKSPACE_URL_TPL = "https://opencode.ai/workspace/%s/go"; L97: ... L99: function creditgaugeDir() { L100: const home = homedir(); L101: if (!home) {

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

query_plugins/opencode/auth.cjsView on unpkg · L31

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: nction creditgaugedir() { const home = homedir(); if (!home) { console.error("错误: 无法确定用户主目录"); process.exit(1); } return path.join(home, ".claude", "plugins", "creditgauge"); } const creditgauge_dir = creditgaugedir(); const config_path = path.join(creditgauge_dir, "config.json"); const credentials_dir = path.join(creditgauge_dir, "credentials", "opencode"); const nav_timeout = 60000; const action_timeout = 30000; function loadconfig() { if (!fs.existssync(config_path)) { consol

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

query_plugins/opencode/auth.cjsView on unpkg

61console.log(" → 正在安装 playwright..."); L62: execSync("npm install playwright --no-save", { stdio: "inherit" }); L63: console.log(" → 正在安装 Chromium 浏览器...");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

query_plugins/opencode/auth.cjsView on unpkg · L61

28L29: const fs = require("fs"); L30: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

query_plugins/opencode/auth.cjsView on unpkg · L28

bin/cli.jsView file

70// Git Bash's /usr/bin (where dirname, readlink, etc. live) is NOT on L71: // the cmd.exe PATH. Prepend it so spawned bash finds its own tools. L72: const gitUsrBin = dirname(GIT_BASH_PATH);

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L70

scripts/migrate-state.shView file

•path = scripts/migrate-state.sh kind = build_helper sizeBytes = 4875 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/migrate-state.shView on unpkg

Source & flagged code

8 flagged

query_plugins/opencode/auth.cjsView file

Lines 8-81javascript

8 * 2. 获取 workspace ID (从 AUTHENTICATION_KEY 或交互式输入)

9 * 3. 打开浏览器完成 GitHub OAuth 登录

10 * 4. 保存 session-cookies 供 fetchAccountCredit 使用

11 *

12 * Cookie 保存位置:

13 * ~/.claude/plugins/creditgauge/credentials/opencode/<workspaceId>.session-cookies.json

14 *

15 * 用法:

16 * node auth.js # 交互式，按需输入 workspace ID

17 * node auth.js --workspace-id wrk_01KX2... # 直接指定

18 * node auth.js --mode github-auto # 自动 GitHub OAuth（需设密码）

19 *

20 * 依赖:

21 * Playwright + Chromium 浏览器 — 运行时会自动检测并提示安装。

22 */

23

24// =========================================================================

25// 依赖 — 保持 CommonJS 以兼容 raw node 调用

26// playwright 为动态加载，未安装时自动提示

27// =========================================================================

28

29const fs = require("fs");

30const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

query_plugins/opencode/auth.cjsView on unpkg · L28

31const readline = require("readline");

32const { execSync } = require("child_process");

33const { homedir } = require("os");

High

Child Process

Package source references child process execution.

query_plugins/opencode/auth.cjsView on unpkg · L31

34

35// =========================================================================

36// Playwright 动态加载 + 自动安装

37// =========================================================================

38

39function ensurePlaywright() {

40 try {

41 return require("playwright");

42 } catch (_) {

43 console.log("");

44 console.log("需要安装 Playwright + Chromium 浏览器才能运行认证。");

45 console.log("是否自动安装? (约 300MB 下载)");

46 console.log("");

47

48 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

49 return new Promise((resolve, reject) => {

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

query_plugins/opencode/auth.cjsView on unpkg · L31

50 rl.question("确认安装? [Y/n] ", (input) => {

51 rl.close();

52 const trimmed = input.trim().toLowerCase();

53 if (trimmed === "n" || trimmed === "no") {

54 console.log("已取消。");

55 console.log("你也可以手动安装:");

56 console.log(" npm install playwright");

57 console.log(" npx playwright install chromium");

58 process.exit(0);

59 }

60

61 console.log(" → 正在安装 playwright...");

62 execSync("npm install playwright --no-save", { stdio: "inherit" });

63 console.log(" → 正在安装 Chromium 浏览器...");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

query_plugins/opencode/auth.cjsView on unpkg · L61

64 execSync("npx playwright install chromium", { stdio: "inherit" });

65 console.log(" ✓ 安装完成\n");

66

67 resolve(require("playwright"));

68 });

69 });

70 }

71}

72

73// =========================================================================

74// Chromium 可执行文件检测 (安装后提醒)

75// =========================================================================

76

77function checkChromiumInstalled(pw) {

78 try {

79 const execPath = pw.chromium.executablePath();

80 if (!execPath || !fs.existsSync(execPath)) {

81 console.log(" ⚠ Chromium 浏览器未安装，正在安装...");

•matchType = previous_version_dangerous_delta matchedPackage = creditgauge@1.1.7 matchedIdentity = npm:Y3JlZGl0Z2F1Z2U:1.1.7 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

query_plugins/opencode/auth.cjsView on unpkg

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: nction creditgaugedir() { const home = homedir(); if (!home) { console.error("错误: 无法确定用户主目录"); process.exit(1); } return path.join(home, ".claude", "plugins", "creditgauge"); } const creditgauge_dir = creditgaugedir(); const config_path = path.join(creditgauge_dir, "config.json"); const credentials_dir = path.join(creditgauge_dir, "credentials", "opencode"); const nav_timeout = 60000; const action_timeout = 30000; function loadconfig() { if (!fs.existssync(config_path)) { consol

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

query_plugins/opencode/auth.cjsView on unpkg

bin/cli.jsView file

Lines 50-90javascript

50// ---------------------------------------------------------------------------

51// Platform helpers

52// ---------------------------------------------------------------------------

53

54// ---------------------------------------------------------------------------

55// Bash resolution (Windows: prefer Git Bash over WSL bash)

56// ---------------------------------------------------------------------------

57

58const GIT_BASH_PATH =

59 process.platform

scripts/migrate-state.shView file

•path = scripts/migrate-state.sh kind = build_helper sizeBytes = 4875 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/migrate-state.shView on unpkg