open-auther@1.4.1

Professional-grade authentication and model routing library

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The source inspection found no install-time attack or unrelated credential forwarding. Flagged process execution is tied to browser authorization or the explicit update command, and the OAuth endpoint configuration separates the intended services.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the CLI; the package update install path activates only through the update command when a newer version is available.

Impact

No confirmed attack surface was established from the inspected behavior.

Mechanism

OAuth configuration distinguishes the OpenAI API endpoint from the ChatGPT OAuth endpoint. The shared chunk's child process opens the authorization URL in the browser.

AI rationale

Evidence

package.jsondist/cli.jsdist/cli.mjsdist/chunk-E4BTPYUD.mjsdist/chunk-3B7ATHGI.mjs

Network endpoints3

registry.npmjs.orgapi.openai.comchatgpt.com

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines no preinstall, install, or postinstall hook; its prepublishOnly command is for publishing.
The shared chunk uses child_process only to open a browser for an authorization URL.
The CLI installs the latest package only when the user runs the update command and an update is available.
The CLI config separates the OpenAI platform API endpoint from the ChatGPT OAuth endpoint.
The flagged files inspected showed no credential redirect to an unrelated fixed gateway.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 16 file(s), 1.13 MB of source, external domains: 127.0.0.1, accounts.google.com, aistudio.google.com, api.groq.com, api.openai.com, auth.openai.com, chat.deepseek.com, chat.qwen.ai, chatgpt.com, cloudcode-pa.googleapis.com, daily-cloudcode-pa.googleapis.com, gemini.google.com, generativelanguage.googleapis.com, github.com, oauth2.googleapis.com, openrouter.ai, platform.openai.com, registry.npmjs.org, www.googleapis.com, www.kimi.com, www.npmjs.com

Source & flagged code

4 flagged

dist/chunk-E4BTPYUD.mjsView file

Lines 1862-1902javascript

1862 registerSecret(tokens.id_token);

1863 const claims = decodeIdToken(tokens.id_token ?? tokens.access_token);

1864 if (!claims?.accountId) {

1865 throw new Error(

1866 "could not read chatgpt_account_id from the returned id_token; refusing to add a credential that cannot be deduplicated"

1867 );

1868 }

1869 log3.info("login_complete", { plan: claims.planType });

1870 return {

1871 accountId: claims.accountId,

1872 email: claims.email,

1873 planType: claims.planType,

1874 accessToken: tokens.access_token,

1875 refreshToken: tokens.refresh_token ?? null,

1876 idToken: tokens.id_token ?? null,

1877 accessExpiresAt: typeof tokens.expires_in === "number" ? now() + tokens.expires_in : claims.exp ?? null

1878 };

1879 })();

1880 return { authorizeUrl, completed };

1881}

1882function openBrowser(url) {

1883 void import("child_process").then(({ spawn }) => {

1884 try {

High

Child Process

Package source references child process execution.

dist/chunk-E4BTPYUD.mjsView on unpkg · L1882

1885 const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : [

1886 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

1887 } catch {

1888 }

1889 });

1890}

1891

1892// src/core/auth-adapters.ts

1893var AuthAdapterRegistry = class {

1894 adapters = /* @__PURE__ */ new Map();

1895 constructor(adapters = []) {

1896 for (const adapter of adapters) this.register(adapter);

1897 }

1898 register(adapter) {

1899 const id = adapter.id.trim();

1900 if (!id) throw new Error("Auth adapter id cannot be empty.");

1901 if (this.adapters.has(id)) throw new Error(`Auth adapter "${id}" is already registered.`);

1902 this.adapters.set(id, { ...adapter, id });

dist/cli.jsView file

Lines 10385-10425javascript

10385 const s = this.sessions.get(id);

10386 if (!s) return null;

10387 return {

10388 state: s.state,

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import { createInterface } from "readline/promises"; authorization: `Bearer ${token}` authorization: `Bearer ${token}` return cfg.upstreamBaseUrl.includes("api.openai.com") || !cfg.upstreamBaseUrl.includes("chatgpt.com") && !cfg.upstreamBaseUrl.includes("codex"); const base = cfg.upstreamBaseUrl.replace(/\/+$/, ""); return `${cfg.codexBaseUrl.replace(/\/+$/, "")}/responses`; message: `Credential ${credential.id} is marked "${credential.providerType}" but holds an OAuth token, not an API key. It was almost certainly added through the ChatGPT login flow ... const targetBase = (credential.baseUrl || (credential.providerType

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/chunk-E4BTPYUD.mjsView file

1882function openBrowser(url) { L1883: void import("child_process").then(({ spawn }) => { L1884: try {

High

Child Process

Package source references child process execution.

dist/chunk-E4BTPYUD.mjsView on unpkg · L1882

dist/cli.jsView file

10499child = needsShell ? ( L10500: // One string, no args array: pairing an args array with `shell: true` L10501: // raises DEP0190. Nothing here needs escaping — every argument is a

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L10499

10405// src/core/update.ts L10406: var import_node_child_process = require("child_process"); L10407: var UPDATE_REGISTRY_URL = "https://registry.npmjs.org/open-auther/latest"; L10408: var PACKAGE_URL = "https://www.npmjs.com/package/open-auther"; L10409: var INSTALL_COMMAND = "npm install -g open-auther@latest"; L10410: function parseVersion(value) {

High

Runtime Package Install

Findings

4 High3 Medium6 Low

HighChild Processdist/chunk-E4BTPYUD.mjs

HighShelldist/cli.js

HighCredential Redirect Persistencedist/cli.mjs

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to open-auther@1.4.1.

See all versions of open-auther for other recorded verdicts.

Review the evidence and your use of open-auther@1.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 17:17:02.616Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.