open-auther@1.4.0

Professional-grade authentication and model routing library

AI Security Review

scanned 23h ago · by lpm-firewall-ai

Source inspection found provider-directed credential requests and caller-configured custom-provider endpoints, with no evidence of an unrelated package-selected recipient. The shell-enabled process helper is CLI functionality and the manifest shows no install-time trigger.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A caller uses the library or starts the CLI and configures a provider.

Impact

No unauthorized credential disclosure or other attack effect was established.

Mechanism

Provider requests use provider endpoints or a caller-configured base URL; refresh requests use the configured token endpoint. No install lifecycle hook is declared.

AI rationale

Network endpoints3

www.kimi.comapi.openai.com/v1oauth2.googleapis.com

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes library and CLI entrypoints and shows only a prepublishOnly build and verification script; no install hook is declared.
The inspected credential transports and callers route requests through provider-specific or configured endpoints. The custom provider flow takes its base URL and API key from the caller.
The CLI’s credential checks, refresh routes, and model discovery are reachable product operations; the inspected excerpts show no package-selected unrelated credential recipient.
The reviewed dependency entry files identify ordinary Hono server and web framework exports.

Evidence against

The CLI contains shell-enabled child-process support, but the reviewed source does not show it running automatically during installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

5 flagged

dist/chunk-I2WU2TOI.mjsView file

Lines 1858-1898javascript

1858 registerSecret(tokens.id_token);

1859 const claims = decodeIdToken(tokens.id_token ?? tokens.access_token);

1860 if (!claims?.accountId) {

1861 throw new Error(

1862 "could not read chatgpt_account_id from the returned id_token; refusing to add a credential that cannot be deduplicated"

1863 );

1864 }

1865 log3.info("login_complete", { plan: claims.planType });

1866 return {

1867 accountId: claims.accountId,

1868 email: claims.email,

1869 planType: claims.planType,

1870 accessToken: tokens.access_token,

1871 refreshToken: tokens.refresh_token ?? null,

1872 idToken: tokens.id_token ?? null,

1873 accessExpiresAt: typeof tokens.expires_in === "number" ? now() + tokens.expires_in : claims.exp ?? null

1874 };

1875 })();

1876 return { authorizeUrl, completed };

1877}

1878function openBrowser(url) {

1879 void import("child_process").then(({ spawn }) => {

1880 try {

High

Child Process

Package source references child process execution.

dist/chunk-I2WU2TOI.mjsView on unpkg · L1878

1881 const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : [

1882 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

1883 } catch {

1884 }

1885 });

1886}

1887

1888// src/core/auth-adapters.ts

1889var AuthAdapterRegistry = class {

1890 adapters = /* @__PURE__ */ new Map();

1891 constructor(adapters = []) {

1892 for (const adapter of adapters) this.register(adapter);

1893 }

1894 register(adapter) {

1895 const id = adapter.id.trim();

1896 if (!id) throw new Error("Auth adapter id cannot be empty.");

1897 if (this.adapters.has(id)) throw new Error(`Auth adapter "${id}" is already registered.`);

1898 this.adapters.set(id, { ...adapter, id });

dist/cli.jsView file

Lines 10033-10073javascript

10033 const s = this.sessions.get(id);

10034 if (!s) return null;

10035 return {

10036 state: s.state,

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import { createInterface } from "readline/promises"; authorization: `Bearer ${token}` authorization: `Bearer ${token}` return cfg.upstreamBaseUrl.includes("api.openai.com") || !cfg.upstreamBaseUrl.includes("chatgpt.com") && !cfg.upstreamBaseUrl.includes("codex"); const base = cfg.upstreamBaseUrl.replace(/\/+$/, ""); return `${cfg.codexBaseUrl.replace(/\/+$/, "")}/responses`; message: `Credential ${credential.id} is marked "${credential.providerType}" but holds an OAuth token, not an API key. It was almost certainly added through the ChatGPT login flow ... const targetBase = (credential.baseUrl || (credential.providerType

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

Source & flagged code

5 flagged · loading source

dist/chunk-I2WU2TOI.mjsView file

1878function openBrowser(url) { L1879: void import("child_process").then(({ spawn }) => { L1880: try {

High

Child Process

Package source references child process execution.

dist/chunk-I2WU2TOI.mjsView on unpkg · L1878

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = open-auther@1.4.2 matchedIdentity = npm:b3Blbi1hdXRoZXI:1.4.2 similarity = 0.421 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

10147child = needsShell ? ( L10148: // One string, no args array: pairing an args array with `shell: true` L10149: // raises DEP0190. Nothing here needs escaping — every argument is a

High

Shell

Findings

1 Critical4 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/chunk-I2WU2TOI.mjs

HighShelldist/cli.js

HighCredential Redirect Persistencedist/cli.mjs

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to open-auther@1.4.0.

See all versions of open-auther for other recorded verdicts.

Review the evidence and your use of open-auther@1.4.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 05:06:47.471Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.