registry / Credential exfiltration / open-auther / 1.2.2

open-auther@1.2.2

Professional-grade authentication and model routing library

AI Security Review

scanned 22h ago · by lpm-firewall-ai

The refresh token recipient is operator-configurable and is not checked against the credential’s original issuer, leaving a conditional exposure risk. The default issuer is expected, and the source does not show covert redirection, so this supports a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A runtime request or model-discovery operation refreshes a saved credential, and the active issuer has been overridden.

Impact

A configured alternate issuer could receive a saved refresh token and potentially use it to obtain credentials.

Mechanism

The refresh request posts the stored refresh token to the active issuer’s /oauth/token endpoint without checking that the issuer matches the credential’s original service.

AI rationale

Evidence

dist/cli.mjsdist/index.jsdist/chunk-6CR3K3FL.mjs

Network endpoints1

auth.openai.com/oauth/token

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI defaults its OAuth issuer to auth.openai.com, but also accepts an issuer from the AI_AUTHER_ISSUER environment variable or its config file.
When a saved credential needs refreshing, the code sends its refresh token to the active issuer’s /oauth/token endpoint.
Runtime request, credential, and model-discovery paths can invoke token refresh; the recipient is not bound to the issuer that originally issued the saved token.
The manifest lists prepublishOnly build and verification commands, not an install hook.

Evidence against

The default OAuth issuer is the expected auth.openai.com host, and the alternate issuer comes from operator-controlled configuration.
The reviewed source does not establish a package-selected unrelated default recipient or a hidden install-time credential transfer.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

5 flagged

dist/chunk-6CR3K3FL.mjsView file

Lines 1857-1897javascript

1857 registerSecret(tokens.id_token);

1858 const claims = decodeIdToken(tokens.id_token ?? tokens.access_token);

1859 if (!claims?.accountId) {

1860 throw new Error(

1861 "could not read chatgpt_account_id from the returned id_token; refusing to add a credential that cannot be deduplicated"

1862 );

1863 }

1864 log3.info("login_complete", { plan: claims.planType });

1865 return {

1866 accountId: claims.accountId,

1867 email: claims.email,

1868 planType: claims.planType,

1869 accessToken: tokens.access_token,

1870 refreshToken: tokens.refresh_token ?? null,

1871 idToken: tokens.id_token ?? null,

1872 accessExpiresAt: typeof tokens.expires_in === "number" ? now() + tokens.expires_in : claims.exp ?? null

1873 };

1874 })();

1875 return { authorizeUrl, completed };

1876}

1877function openBrowser(url) {

1878 void import("child_process").then(({ spawn }) => {

1879 try {

High

Child Process

Package source references child process execution.

dist/chunk-6CR3K3FL.mjsView on unpkg · L1877

1880 const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : [

1881 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

1882 } catch {

1883 }

1884 });

1885}

1886

1887// src/core/auth-adapters.ts

1888var AuthAdapterRegistry = class {

1889 adapters = /* @__PURE__ */ new Map();

1890 constructor(adapters = []) {

1891 for (const adapter of adapters) this.register(adapter);

1892 }

1893 register(adapter) {

1894 const id = adapter.id.trim();

1895 if (!id) throw new Error("Auth adapter id cannot be empty.");

1896 if (this.adapters.has(id)) throw new Error(`Auth adapter "${id}" is already registered.`);

1897 this.adapters.set(id, { ...adapter, id });

dist/cli.jsView file

Lines 9938-9978javascript

9938 const s = this.sessions.get(id);

9939 if (!s) return null;

9940 return {

9941 state: s.state,

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import { createInterface } from "readline/promises"; authorization: `Bearer ${token}` authorization: `Bearer ${token}` return cfg.upstreamBaseUrl.includes("api.openai.com") || !cfg.upstreamBaseUrl.includes("chatgpt.com") && !cfg.upstreamBaseUrl.includes("codex"); const base = cfg.upstreamBaseUrl.replace(/\/+$/, ""); return `${cfg.codexBaseUrl.replace(/\/+$/, "")}/responses`; message: `Credential ${credential.id} is marked "${credential.providerType}" but holds an OAuth token, not an API key. It was almost certainly added through the ChatGPT login flow ... const targetBase = (credential.baseUrl || (credential.providerType

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

Source & flagged code

5 flagged · loading source

dist/chunk-6CR3K3FL.mjsView file

1877function openBrowser(url) { L1878: void import("child_process").then(({ spawn }) => { L1879: try {

High

Child Process

Package source references child process execution.

dist/chunk-6CR3K3FL.mjsView on unpkg · L1877

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = open-auther@1.0.4 matchedIdentity = npm:b3Blbi1hdXRoZXI:1.0.4 similarity = 0.375 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

10052child = needsShell ? ( L10053: // One string, no args array: pairing an args array with `shell: true` L10054: // raises DEP0190. Nothing here needs escaping — every argument is a

High

Shell

Findings

1 Critical4 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/chunk-6CR3K3FL.mjs

HighShelldist/cli.js

HighCredential Redirect Persistencedist/cli.mjs

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to open-auther@1.2.2.

See all versions of open-auther for other recorded verdicts.

Review the evidence and your use of open-auther@1.2.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 05:07:18.436Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.