registry / Credential exfiltration / open-auther / 1.1.1

open-auther@1.1.1

Professional-grade authentication and model routing library

AI Security Review

scanned 21h ago · by lpm-firewall-ai

The admin diagnostic sends stored ChatGPT OAuth tokens to a fixed platform API endpoint without recipient-specific consent, despite source explicitly distinguishing that endpoint from the intended OAuth destination. This is concrete credential disclosure and warrants blocking publication.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A request to the mounted /admin/diag-test route.

Impact

ChatGPT OAuth credentials are disclosed to an endpoint the package itself says is not intended to receive them.

Mechanism

The handler iterates over stored credentials and puts each access token in a bearer authorization header for a request to api.openai.com, then also tests the ChatGPT Codex endpoint.

Attack narrative

A request to /admin/diag-test causes the package to send every stored credential's access token to api.openai.com. The handler then separately sends the token to the ChatGPT Codex endpoint. The package configuration distinguishes platform API credentials from ChatGPT OAuth credentials and states that OAuth tokens should not be sent to api.openai.com.

AI rationale

Evidence

dist/cli.mjs

Network endpoints2

api.openai.com/v1/chat/completionschatgpt.com/backend-api/codex/responses

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The mounted admin diagnostics route loops over stored credentials and sends each access token as a bearer token to the fixed OpenAI platform API endpoint.
The same diagnostic also sends the token to the ChatGPT Codex endpoint, and package configuration distinguishes ChatGPT OAuth tokens from platform API credentials.
The package source explicitly states that ChatGPT OAuth tokens should not be sent to api.openai.com.

Evidence against

The transfer requires a request to the diagnostics route; no install-time lifecycle hook triggers it.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 16 file(s), 981 KB of source, external domains: 127.0.0.1, aistudio.google.com, api.groq.com, api.openai.com, auth.openai.com, chat.deepseek.com, chat.qwen.ai, chatgpt.com, cloudcode-pa.googleapis.com, daily-cloudcode-pa.googleapis.com, gemini.google.com, generativelanguage.googleapis.com, github.com, oauth2.googleapis.com, openrouter.ai, platform.openai.com, registry.npmjs.org, www.googleapis.com, www.kimi.com, www.npmjs.com

Source & flagged code

6 flagged

dist/chunk-FJALHLBA.mjsView file

Lines 1828-1868javascript

1828 registerSecret(tokens.id_token);

1829 const claims = decodeIdToken(tokens.id_token ?? tokens.access_token);

1830 if (!claims?.accountId) {

1831 throw new Error(

1832 "could not read chatgpt_account_id from the returned id_token; refusing to add a credential that cannot be deduplicated"

1833 );

1834 }

1835 log3.info("login_complete", { plan: claims.planType });

1836 return {

1837 accountId: claims.accountId,

1838 email: claims.email,

1839 planType: claims.planType,

1840 accessToken: tokens.access_token,

1841 refreshToken: tokens.refresh_token ?? null,

1842 idToken: tokens.id_token ?? null,

1843 accessExpiresAt: typeof tokens.expires_in === "number" ? now() + tokens.expires_in : claims.exp ?? null

1844 };

1845 })();

1846 return { authorizeUrl, completed };

1847}

1848function openBrowser(url) {

1849 void import("child_process").then(({ spawn }) => {

1850 try {

High

Child Process

Package source references child process execution.

dist/chunk-FJALHLBA.mjsView on unpkg · L1848

1851 const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : [

1852 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

1853 } catch {

1854 }

1855 });

1856}

1857

1858// src/core/auth-adapters.ts

1859var AuthAdapterRegistry = class {

1860 adapters = /* @__PURE__ */ new Map();

1861 constructor(adapters = []) {

1862 for (const adapter of adapters) this.register(adapter);

1863 }

1864 register(adapter) {

1865 const id = adapter.id.trim();

1866 if (!id) throw new Error("Auth adapter id cannot be empty.");

1867 if (this.adapters.has(id)) throw new Error(`Auth adapter "${id}" is already registered.`);

1868 this.adapters.set(id, { ...adapter, id });

dist/cli.jsView file

Lines 8854-8894javascript

8854 const s = this.sessions.get(id);

8855 if (!s) return null;

8856 return {

8857 state: s.state,

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import { createInterface } from "readline/promises"; authorization: `Bearer ${token}` authorization: `Bearer ${token}` return cfg.upstreamBaseUrl.includes("api.openai.com") || !cfg.upstreamBaseUrl.includes("chatgpt.com") && !cfg.upstreamBaseUrl.includes("codex"); const base = cfg.upstreamBaseUrl.replace(/\/+$/, ""); return `${cfg.codexBaseUrl.replace(/\/+$/, "")}/responses`; message: `Credential ${credential.id} is marked "${credential.providerType}" but holds an OAuth token, not an API key. It was almost certainly added through the ChatGPT login flow ... const targetBase = (credential.baseUrl || (credential.providerType

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

6 flagged · loading source

dist/chunk-FJALHLBA.mjsView file

1848function openBrowser(url) { L1849: void import("child_process").then(({ spawn }) => { L1850: try {

High

Child Process

Package source references child process execution.

dist/chunk-FJALHLBA.mjsView on unpkg · L1848

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = open-auther@1.0.4 matchedIdentity = npm:b3Blbi1hdXRoZXI:1.0.4 similarity = 0.438 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

8968child = needsShell ? ( L8969: // One string, no args array: pairing an args array with `shell: true` L8970: // raises DEP0190. Nothing here needs escaping — every argument is a

High

Shell

Package source references shell execution.

Findings

1 Critical5 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/chunk-FJALHLBA.mjs

HighShelldist/cli.js

HighCredential Redirect Persistencedist/cli.mjs

HighRuntime Package Installdist/cli.js

HighSemantic Analysis Limitedpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to open-auther@1.1.1.

See all versions of open-auther for other recorded verdicts.

Avoid installing open-auther@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 05:04:51.742Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code