registry / Credential exfiltration / motionrender
motionrender
JSON-first, frame-deterministic motion graphics video engine: render compositions to MP4, WebM, ProRes, GIF or PNG frames from Node or the command line.
This report shows the evidence for motionrender@0.2.9. 2 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe CLI defaults to a third-party AI gateway and uses `OPENAI_API_KEY` as that gateway’s bearer credential. This is automatic for the default provider path and constitutes credential exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes an AI feature through the CLI without selecting another provider or overriding its URL.
Impact
The gateway receives the user's OpenAI credential and the submitted AI messages.
Mechanism
The default provider accepts `OPENAI_API_KEY` as its key, defaults to `https://ai.hamathopc.in/v1`, and sends bearer-authenticated chat requests there.
Attack narrative
When an AI CLI feature uses the default provider, it can take `OPENAI_API_KEY` from the environment and send it as a bearer token to `ai.hamathopc.in`, along with the chat messages. The package does not default to OpenAI’s service for that provider. This exposes another service’s credential to an unrelated host.
AI rationale
The CLI defaults to a third-party AI gateway and uses `OPENAI_API_KEY` as that gateway’s bearer credential. This is automatic for the default provider path and constitutes credential exfiltration.
Evidence
dist/cli.js
Network endpoints1
ai.hamathopc.in
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI selects `freellmapi` by default unless another provider is configured.
- The provider falls back to `OPENAI_API_KEY` and defaults to `https://ai.hamathopc.in/v1`.
- Chat requests send the selected provider’s bearer credential and message body to its `/chat/completions` endpoint.
- The executable CLI is exposed as `motionrender`, `mr` and `ove`.
Evidence against
- The manifest declares no lifecycle scripts.
- The package describes itself as a motion graphics and video rendering tool, which can legitimately use AI providers when requested.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
865// packages/core/src/media.ts
L866: import { spawn as spawn2 } from "node:child_process";
L867: import { mkdir, readFile as readFile2, stat as stat2, writeFile } from "node:fs/promises";
High
studio/assets/index-B1JV-2Jw.jsView file
9`).replace(G0,"")}function zh(t,l){return l=Nh(l),Nh(t)===l}function xt(t,l,e,a,n,u){switch(e){case"children":if(typeof a=="string")l==="body"||l==="textarea"&&a===""||Ma(t,a);else...
L10: `)}):null]})]})})}const p1=O.forwardRef(function({detail:m,startFrame:x},r){const E=O.useRef(null),M=O.useRef(null),[D,V]=O.useState(x),[B,G]=O.useState(!1),[T,d]=O.useState(""),[C...
Low
Eval
Package source references a known benign dynamic code generation pattern.
studio/assets/index-B1JV-2Jw.jsView on unpkg · L9dist/cli.jsView file
1399getFfprobePath = () => {
L1400: if (process.env.OVE_FFPROBE_PATH) return process.env.OVE_FFPROBE_PATH;
L1401: if (existsSync(localFfprobePath)) return localFfprobePath;
...
L1405: RELEASE_TAG = "b6.1.1";
L1406: BASE_URL = `https://github.com/eugeneware/ffmpeg-static/releases/download/${RELEASE_TAG}`;
L1407: ensureFfmpegPromise = null;
...
L1411: // packages/ffmpeg/src/index.ts
L1412: import { spawn } from "node:child_process";
L1413: import { once } from "node:events";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L1399•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
return import("node:fs/promises").then((fs) => fs.writeFile(listFile, list)).then(() => run(["-y", "-f", "concat", "-safe", "0", "-i", listFile, ...audioCodec ? audioMixArgs(audio,...
import { mkdir, readFile as readFile2, stat as stat2, writeFile } from "node:fs/promises";
await writeFile(file2, JSON.stringify(measured));
import { mkdir as mkdir2, readdir as readdir2, rename, rm as rm2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
await writeFile2(join5(scratch, complete), "");
import { readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
await writeFile3(output2, await renderFram
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg268try {
L269: list = JSON.parse(list);
L270: } catch {
...
L878: });
L879: sceneSchema = z3.object({ grade: gradeSchema.optional().describe("Colour grading for the whole scene (fixed layers excluded)."), id: z3.string().min(1), name: z3.string().min(1), s...
L880: assetSchema = z3.object({ id: z3.string().min(1), type: z3.enum(["image", "video", "audio", "font", "svg", "captions", "lottie"]), src: z3.string().min(1), family: z3.string().min(...
...
L1219: cacheKinds = ["media", "video", "sfx"];
L1220: cacheRoot = () => process.env.OVE_CACHE_DIR ?? join(tmpdir(), "ove-video-cache");
L1221: cacheDir = (kind) => join(cacheRoot(), kind);
...
L1278: import { existsSync, mkdirSync, chmodSync, createWriteStream, unlinkSync, renameSync } from "node:fs";
L1279: import { spawnSync } from "node:c
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L268268Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L268: try {
L269: list = JSON.parse(list);
L270: } catch {
...
L878: });
L879: sceneSchema = z3.object({ grade: gradeSchema.optional().describe("Colour grading for the whole scene (fixed layers excluded)."), id: z3.string().min(1), name: z3.string().min(1), s...
L880: assetSchema = z3.object({ id: z3.string().min(1), type: z3.enum(["image", "video", "audio", "font", "svg", "captions", "lottie"]), src: z3.string().min(1), family: z3.string().min(...
...
L1219: cacheKinds = ["media", "video", "sfx"];
L1220: cacheRoot = () => process.env.OVE_CACHE_DIR ?? join(tmpdir(), "ove-video-cache");
L1221: cacheDir = (kind) => join(cacheRoot(), kind);
...
L1278: import { exist
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli.jsView on unpkg · L2681486const list = segments.map((s) => `file '${s.replace(/\\/g, "/").replace(/'/g, "'\\''")}'`).join("\n");
L1487: return import("node:fs/promises").then((fs) => fs.writeFile(listFile, list)).then(() => run(["-y", "-f", "concat", "-safe", "0", "-i", listFile, ...audioCodec ? audioMixArgs(audio,...
L1488: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli.jsView on unpkg · L1486Findings
5 High4 Medium5 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvalstudio/assets/index-B1JV-2Jw.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to motionrender@0.2.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing motionrender@0.2.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.