registry / Credential exfiltration / open-auther / 1.2.1

open-auther@1.2.1

Professional-grade authentication and model routing library

AI Security Review

scanned 23h ago · by lpm-firewall-ai

The diagnostic handler forwards stored access tokens to fixed OpenAI endpoints when requested, leaving a conditional credential exposure risk. This supports a warning rather than a publish block because the inspected transfer is not automatic and no unrelated recipient is established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A client requests GET /diag-test while the CLI server is running.

Impact

A request can expose stored ChatGPT credentials to the API endpoints; the source does not establish an installation-time or ordinary-login transfer.

Mechanism

The route iterates through stored credentials and uses each access token in requests to fixed OpenAI endpoints.

AI rationale

Evidence

dist/cli.mjs

Network endpoints2

api.openai.com/v1/chat/completionschatgpt.com/backend-api/codex/responses

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI exposes a diagnostic route that sends stored ChatGPT access tokens to fixed OpenAI API and ChatGPT endpoints; this can expose credentials when the route is requested.

Evidence against

The credential forwarding is attached to an explicitly requested diagnostic route, not an install hook or ordinary login flow.
The manifest's prepublishOnly script runs build and verification commands and does not run during consumer installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 16 file(s), 1.04 MB of source, external domains: 127.0.0.1, aistudio.google.com, api.groq.com, api.openai.com, auth.openai.com, chat.deepseek.com, chat.qwen.ai, chatgpt.com, cloudcode-pa.googleapis.com, daily-cloudcode-pa.googleapis.com, gemini.google.com, generativelanguage.googleapis.com, github.com, oauth2.googleapis.com, openrouter.ai, platform.openai.com, registry.npmjs.org, www.googleapis.com, www.kimi.com, www.npmjs.com

Source & flagged code

6 flagged

dist/chunk-6CR3K3FL.mjsView file

Lines 1857-1897javascript

1857 registerSecret(tokens.id_token);

1858 const claims = decodeIdToken(tokens.id_token ?? tokens.access_token);

1859 if (!claims?.accountId) {

1860 throw new Error(

1861 "could not read chatgpt_account_id from the returned id_token; refusing to add a credential that cannot be deduplicated"

1862 );

1863 }

1864 log3.info("login_complete", { plan: claims.planType });

1865 return {

1866 accountId: claims.accountId,

1867 email: claims.email,

1868 planType: claims.planType,

1869 accessToken: tokens.access_token,

1870 refreshToken: tokens.refresh_token ?? null,

1871 idToken: tokens.id_token ?? null,

1872 accessExpiresAt: typeof tokens.expires_in === "number" ? now() + tokens.expires_in : claims.exp ?? null

1873 };

1874 })();

1875 return { authorizeUrl, completed };

1876}

1877function openBrowser(url) {

1878 void import("child_process").then(({ spawn }) => {

1879 try {

High

Child Process

Package source references child process execution.

dist/chunk-6CR3K3FL.mjsView on unpkg · L1877

1880 const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : [

1881 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

1882 } catch {

1883 }

1884 });

1885}

1886

1887// src/core/auth-adapters.ts

1888var AuthAdapterRegistry = class {

1889 adapters = /* @__PURE__ */ new Map();

1890 constructor(adapters = []) {

1891 for (const adapter of adapters) this.register(adapter);

1892 }

1893 register(adapter) {

1894 const id = adapter.id.trim();

1895 if (!id) throw new Error("Auth adapter id cannot be empty.");

1896 if (this.adapters.has(id)) throw new Error(`Auth adapter "${id}" is already registered.`);

1897 this.adapters.set(id, { ...adapter, id });

dist/cli.jsView file

Lines 9722-9762javascript

9722 const s = this.sessions.get(id);

9723 if (!s) return null;

9724 return {

9725 state: s.state,

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import { createInterface } from "readline/promises"; authorization: `Bearer ${token}` authorization: `Bearer ${token}` return cfg.upstreamBaseUrl.includes("api.openai.com") || !cfg.upstreamBaseUrl.includes("chatgpt.com") && !cfg.upstreamBaseUrl.includes("codex"); const base = cfg.upstreamBaseUrl.replace(/\/+$/, ""); return `${cfg.codexBaseUrl.replace(/\/+$/, "")}/responses`; message: `Credential ${credential.id} is marked "${credential.providerType}" but holds an OAuth token, not an API key. It was almost certainly added through the ChatGPT login flow ... const targetBase = (credential.baseUrl || (credential.providerType

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

6 flagged · loading source

dist/chunk-6CR3K3FL.mjsView file

1877function openBrowser(url) { L1878: void import("child_process").then(({ spawn }) => { L1879: try {

High

Child Process

Package source references child process execution.

dist/chunk-6CR3K3FL.mjsView on unpkg · L1877

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = open-auther@1.0.4 matchedIdentity = npm:b3Blbi1hdXRoZXI:1.0.4 similarity = 0.438 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

9836child = needsShell ? ( L9837: // One string, no args array: pairing an args array with `shell: true` L9838: // raises DEP0190. Nothing here needs escaping — every argument is a

High

Shell

Package source references shell execution.

Findings

1 Critical5 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/chunk-6CR3K3FL.mjs

HighShelldist/cli.js

HighCredential Redirect Persistencedist/cli.mjs

HighRuntime Package Installdist/cli.js

HighSemantic Analysis Limitedpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to open-auther@1.2.1.

See all versions of open-auther for other recorded verdicts.

Review the evidence and your use of open-auther@1.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 05:08:39.165Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.