open-auther@1.2.0

Professional-grade authentication and model routing library

AI Security Review

scanned 23h ago · by lpm-firewall-ai

Source inspection found no malicious behavior. The scanner’s runtime installation signal maps to explicit update or uninstall commands, and the credential flows reviewed target their configured or intended provider endpoints.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

No malicious trigger was found; provider requests follow CLI or gateway use.

Impact

No unrelated credential disclosure, unrequested account action, or install-time mutation was established.

Mechanism

The reviewed credential flows target the configured authentication or provider endpoint, with defaults matching the intended service.

AI rationale

Network endpoints3

auth.openai.comchatgpt.com/backend-api/codexapi.openai.com

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package exposes its runtime entrypoints through dist files; its only publish lifecycle script builds and verifies the package.
OAuth uses the configured issuer, which defaults to OpenAI, and Codex credentials are sent to the ChatGPT Codex API.
Credential transport and callers resolve to provider operations such as model discovery, refresh, and requested chat traffic; no unrelated recipient or automatic account action was identified.
Adding a custom provider requires a supplied base URL and API key, and endpoint detection sends the key to that base URL.
The npm update and uninstall subprocesses are reached through explicit CLI commands.
The inspected runtime dependencies are the Hono server adapter and Hono framework; their prepared manifests and selected source entrypoints were inspected.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

6 flagged

dist/chunk-6CR3K3FL.mjsView file

Lines 1857-1897javascript

1857 registerSecret(tokens.id_token);

1858 const claims = decodeIdToken(tokens.id_token ?? tokens.access_token);

1859 if (!claims?.accountId) {

1860 throw new Error(

1861 "could not read chatgpt_account_id from the returned id_token; refusing to add a credential that cannot be deduplicated"

1862 );

1863 }

1864 log3.info("login_complete", { plan: claims.planType });

1865 return {

1866 accountId: claims.accountId,

1867 email: claims.email,

1868 planType: claims.planType,

1869 accessToken: tokens.access_token,

1870 refreshToken: tokens.refresh_token ?? null,

1871 idToken: tokens.id_token ?? null,

1872 accessExpiresAt: typeof tokens.expires_in === "number" ? now() + tokens.expires_in : claims.exp ?? null

1873 };

1874 })();

1875 return { authorizeUrl, completed };

1876}

1877function openBrowser(url) {

1878 void import("child_process").then(({ spawn }) => {

1879 try {

High

Child Process

Package source references child process execution.

dist/chunk-6CR3K3FL.mjsView on unpkg · L1877

1880 const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : [

1881 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

1882 } catch {

1883 }

1884 });

1885}

1886

1887// src/core/auth-adapters.ts

1888var AuthAdapterRegistry = class {

1889 adapters = /* @__PURE__ */ new Map();

1890 constructor(adapters = []) {

1891 for (const adapter of adapters) this.register(adapter);

1892 }

1893 register(adapter) {

1894 const id = adapter.id.trim();

1895 if (!id) throw new Error("Auth adapter id cannot be empty.");

1896 if (this.adapters.has(id)) throw new Error(`Auth adapter "${id}" is already registered.`);

1897 this.adapters.set(id, { ...adapter, id });

dist/cli.jsView file

Lines 9701-9741javascript

9701 const s = this.sessions.get(id);

9702 if (!s) return null;

9703 return {

9704 state: s.state,

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import { createInterface } from "readline/promises"; authorization: `Bearer ${token}` authorization: `Bearer ${token}` return cfg.upstreamBaseUrl.includes("api.openai.com") || !cfg.upstreamBaseUrl.includes("chatgpt.com") && !cfg.upstreamBaseUrl.includes("codex"); const base = cfg.upstreamBaseUrl.replace(/\/+$/, ""); return `${cfg.codexBaseUrl.replace(/\/+$/, "")}/responses`; message: `Credential ${credential.id} is marked "${credential.providerType}" but holds an OAuth token, not an API key. It was almost certainly added through the ChatGPT login flow ... const targetBase = (credential.baseUrl || (credential.providerType

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

6 flagged · loading source

dist/chunk-6CR3K3FL.mjsView file

1877function openBrowser(url) { L1878: void import("child_process").then(({ spawn }) => { L1879: try {

High

Child Process

Package source references child process execution.

dist/chunk-6CR3K3FL.mjsView on unpkg · L1877

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = open-auther@1.0.4 matchedIdentity = npm:b3Blbi1hdXRoZXI:1.0.4 similarity = 0.438 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

9815child = needsShell ? ( L9816: // One string, no args array: pairing an args array with `shell: true` L9817: // raises DEP0190. Nothing here needs escaping — every argument is a

High

Shell

Package source references shell execution.

Findings

1 Critical5 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/chunk-6CR3K3FL.mjs

HighShelldist/cli.js

HighCredential Redirect Persistencedist/cli.mjs

HighRuntime Package Installdist/cli.js

HighSemantic Analysis Limitedpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to open-auther@1.2.0.

See all versions of open-auther for other recorded verdicts.

Review the evidence and your use of open-auther@1.2.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 05:05:56.988Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.