registry / Credential exfiltration / open-auther

open-auther

Professional-grade authentication and model routing library

This report shows the evidence for open-auther@1.1.5. 2 of 16 known versions are blocked or flagged. The newest version, 1.4.2, is allowed. See all versions.

AI Security Review

scanned 20h ago · by lpm-firewall-ai

The active diagnostic handler forwards stored ChatGPT credentials to a distinct platform API endpoint without recipient-specific consent. This is concrete credential disclosure and warrants blocking publication.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A request to the diagnostic GET endpoint while credentials are stored.

Impact

The platform API receives stored session credentials that belong to the ChatGPT service.

Mechanism

The handler loops through stored credentials and places each access token in the Authorization header of a POST to the platform chat completions API.

Attack narrative

When the diagnostic endpoint is requested, the handler sends each stored access token to the OpenAI platform chat completions endpoint, then separately tests the ChatGPT Codex endpoint. The platform API request is a distinct destination from the ChatGPT service associated with those stored credentials. The package’s published CLI points to this handler.

AI rationale

Evidence

dist/cli.js

Network endpoints2

api.openai.com/v1/chat/completionschatgpt.com/backend-api/codex/responses

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The published CLI entry points to dist/cli.js, where an HTTP GET handler for /diag-test iterates over every stored credential.
That handler sends each stored access token in an Authorization header to api.openai.com, using a chat completion request.
The same diagnostic also sends the token to chatgpt.com; the platform API request sends it to a different endpoint from the stored ChatGPT credentials’ intended service.

Evidence against

The diagnostic route is explicitly named and sends a fixed test prompt; the source does not show a package-controlled recipient or token persistence in this handler.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 16 file(s), 1.00 MB of source, external domains: 127.0.0.1, accounts.google.com, aistudio.google.com, api.groq.com, api.openai.com, auth.openai.com, chat.deepseek.com, chat.qwen.ai, chatgpt.com, cloudcode-pa.googleapis.com, daily-cloudcode-pa.googleapis.com, gemini.google.com, generativelanguage.googleapis.com, github.com, oauth2.googleapis.com, openrouter.ai, platform.openai.com, registry.npmjs.org, www.googleapis.com, www.kimi.com, www.npmjs.com

Source & flagged code

6 flagged

dist/chunk-BMCZL7TG.mjsView file

Lines 1857-1897javascript

1857 registerSecret(tokens.id_token);

1858 const claims = decodeIdToken(tokens.id_token ?? tokens.access_token);

1859 if (!claims?.accountId) {

1860 throw new Error(

1861 "could not read chatgpt_account_id from the returned id_token; refusing to add a credential that cannot be deduplicated"

1862 );

1863 }

1864 log3.info("login_complete", { plan: claims.planType });

1865 return {

1866 accountId: claims.accountId,

1867 email: claims.email,

1868 planType: claims.planType,

1869 accessToken: tokens.access_token,

1870 refreshToken: tokens.refresh_token ?? null,

1871 idToken: tokens.id_token ?? null,

1872 accessExpiresAt: typeof tokens.expires_in === "number" ? now() + tokens.expires_in : claims.exp ?? null

1873 };

1874 })();

1875 return { authorizeUrl, completed };

1876}

1877function openBrowser(url) {

1878 void import("child_process").then(({ spawn }) => {

1879 try {

High

Child Process

Package source references child process execution.

dist/chunk-BMCZL7TG.mjsView on unpkg · L1877

1880 const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : [

1881 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

1882 } catch {

1883 }

1884 });

1885}

1886

1887// src/core/auth-adapters.ts

1888var AuthAdapterRegistry = class {

1889 adapters = /* @__PURE__ */ new Map();

1890 constructor(adapters = []) {

1891 for (const adapter of adapters) this.register(adapter);

1892 }

1893 register(adapter) {

1894 const id = adapter.id.trim();

1895 if (!id) throw new Error("Auth adapter id cannot be empty.");

1896 if (this.adapters.has(id)) throw new Error(`Auth adapter "${id}" is already registered.`);

1897 this.adapters.set(id, { ...adapter, id });

dist/cli.mjsView file

Lines 4950-4990javascript

4950 message: newer ? `New update available: v${latestVersion} (installed: v${currentVersion}).` : `You are up to date on v${currentVersion}.`

4951 };

4952 } catch {

4953 return {

dist/cli.jsView file

Lines 9412-9452javascript

9412 const s = this.sessions.get(id);

9413 if (!s) return null;

9414 return {

9415 state: s.state,

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

6 flagged · loading source

dist/chunk-BMCZL7TG.mjsView file

1877function openBrowser(url) { L1878: void import("child_process").then(({ spawn }) => { L1879: try {

High

Child Process

Package source references child process execution.

dist/chunk-BMCZL7TG.mjsView on unpkg · L1877

dist/cli.mjsView file

4970child = needsShell ? ( L4971: // One string, no args array: pairing an args array with `shell: true` L4972: // raises DEP0190. Nothing here needs escaping — every argument is a

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L4970

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import { createInterface } from "readline/promises"; authorization: `Bearer ${token}` authorization: `Bearer ${token}` return cfg.upstreamBaseUrl.includes("api.openai.com") || !cfg.upstreamBaseUrl.includes("chatgpt.com") && !cfg.upstreamBaseUrl.includes("codex"); const base = cfg.upstreamBaseUrl.replace(/\/+$/, ""); return `${cfg.codexBaseUrl.replace(/\/+$/, "")}/responses`; message: `Credential ${credential.id} is marked "${credential.providerType}" but holds an OAuth token, not an API key. It was almost certainly added through the ChatGPT login flow ... const targetBase = (credential.baseUrl || (credential.providerType

Findings

1 Critical5 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/chunk-BMCZL7TG.mjs

HighShelldist/cli.mjs

HighCredential Redirect Persistencedist/cli.mjs

HighRuntime Package Installdist/cli.js

HighSemantic Analysis Limitedpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to open-auther@1.1.5.

The versions list below shows the verdict for each recorded version.

Avoid installing open-auther@1.1.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 05:05:14.154Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

16 known versions

1.4.2latestClean—AllowPublishedOct 8, 2026, 5:56 PM 1.4.1Clean—AllowPublishedOct 8, 2026, 5:13 PM 1.4.0Clean—AllowPublishedOct 8, 2026, 11:12 AM 1.2.2SuspiciousCredential ExfiltrationWarnPublishedSep 28, 2026, 8:03 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code