motionrender@0.2.7
JSON-first, frame-deterministic motion graphics video engine: render compositions to MP4, WebM, ProRes, GIF or PNG frames from Node or the command line.
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe CLI defaults to a third-party AI gateway and forwards OPENAI_API_KEY to it as a Bearer credential. This is an automatic cross-service credential disclosure when users invoke AI features without changing the provider configuration.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a CLI feature that uses the default AI provider while OPENAI_API_KEY is set and has not selected another provider or endpoint.
Impact
The gateway receives the user’s OpenAI credential, enabling unauthorized use or further exposure of the key.
Mechanism
The default freellmapi provider reads OPENAI_API_KEY, places it in a Bearer authorization header, and sends requests to ai.hamathopc.in.
Attack narrative
When a CLI AI feature uses the default provider, it accepts OPENAI_API_KEY as that provider’s key and sends it as a Bearer token to ai.hamathopc.in. This forwards a credential belonging to another service to a fixed gateway without the user selecting that destination, constituting credential exfiltration.
AI rationale
The CLI defaults to a third-party AI gateway and forwards OPENAI_API_KEY to it as a Bearer credential. This is an automatic cross-service credential disclosure when users invoke AI features without changing the provider configuration.
Evidence
dist/cli.js
Network endpoints1
ai.hamathopc.in
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI defaults to the freellmapi provider unless OVE_AI_PROVIDER selects another provider.
- That provider uses OPENAI_API_KEY as an API key and defaults to https://ai.hamathopc.in/v1.
- The key is sent as a Bearer authorization header in requests to the provider’s chat endpoint.
- The package exposes the CLI through its bin entries, making the provider reachable when users run its commands.
Evidence against
- The package is a motion graphics renderer that advertises AI features, so sending prompts to an AI service can serve its purpose.
- The provider supports explicit base URL and provider settings, but the default still forwards OPENAI_API_KEY to the fixed gateway.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
7 flaggeddist/index.jsView file
865// packages/core/src/media.ts
L866: import { spawn as spawn2 } from "node:child_process";
L867: import { mkdir, readFile as readFile2, stat as stat2, writeFile } from "node:fs/promises";
High
studio/assets/index-B1JV-2Jw.jsView file
9`).replace(G0,"")}function zh(t,l){return l=Nh(l),Nh(t)===l}function xt(t,l,e,a,n,u){switch(e){case"children":if(typeof a=="string")l==="body"||l==="textarea"&&a===""||Ma(t,a);else...
L10: `)}):null]})]})})}const p1=O.forwardRef(function({detail:m,startFrame:x},r){const E=O.useRef(null),M=O.useRef(null),[D,V]=O.useState(x),[B,G]=O.useState(!1),[T,d]=O.useState(""),[C...
Low
Eval
Package source references a known benign dynamic code generation pattern.
studio/assets/index-B1JV-2Jw.jsView on unpkg · L9dist/cli.jsView file
Findings
5 High4 Medium5 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvalstudio/assets/index-B1JV-2Jw.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to motionrender@0.2.7.
See all versions of motionrender for other recorded verdicts.
- Avoid installing motionrender@0.2.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.