open-auther@1.4.2

Professional-grade authentication and model routing library

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The source shows no install lifecycle attack, and the suspicious credential requests target the services those credentials are for. The scanner’s fixed unofficial gateway and runtime installation signals were not supported by the inspected source.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the local diagnostic route.

Impact

No unrelated recipient, persistence behavior, or install-time attack was established.

Mechanism

The route sends the stored access token to api.openai.com and chatgpt.com for credential testing.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has a prepublishOnly build and verification script, with no preinstall, install, or postinstall hook.
The CLI dispatches commands from explicit command-line input; the inspected entrypoint does not run the update or uninstall commands by default.
The diagnostic route sends the saved access token to the official OpenAI API and ChatGPT Codex endpoints to test those credentials.
The inspected chunk is an imported application module; no malicious behavior was established from the required chunk citation.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 16 file(s), 1.13 MB of source, external domains: 127.0.0.1, accounts.google.com, aistudio.google.com, api.groq.com, api.openai.com, auth.openai.com, chat.deepseek.com, chat.qwen.ai, chatgpt.com, cloudcode-pa.googleapis.com, daily-cloudcode-pa.googleapis.com, gemini.google.com, generativelanguage.googleapis.com, github.com, oauth2.googleapis.com, openrouter.ai, platform.openai.com, registry.npmjs.org, www.googleapis.com, www.kimi.com, www.npmjs.com

Source & flagged code

4 flagged

dist/chunk-E4BTPYUD.mjsView file

Lines 1862-1902javascript

1862 registerSecret(tokens.id_token);

1863 const claims = decodeIdToken(tokens.id_token ?? tokens.access_token);

1864 if (!claims?.accountId) {

1865 throw new Error(

1866 "could not read chatgpt_account_id from the returned id_token; refusing to add a credential that cannot be deduplicated"

1867 );

1868 }

1869 log3.info("login_complete", { plan: claims.planType });

1870 return {

1871 accountId: claims.accountId,

1872 email: claims.email,

1873 planType: claims.planType,

1874 accessToken: tokens.access_token,

1875 refreshToken: tokens.refresh_token ?? null,

1876 idToken: tokens.id_token ?? null,

1877 accessExpiresAt: typeof tokens.expires_in === "number" ? now() + tokens.expires_in : claims.exp ?? null

1878 };

1879 })();

1880 return { authorizeUrl, completed };

1881}

1882function openBrowser(url) {

1883 void import("child_process").then(({ spawn }) => {

1884 try {

High

Child Process

Package source references child process execution.

dist/chunk-E4BTPYUD.mjsView on unpkg · L1882

1885 const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : [

1886 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

1887 } catch {

1888 }

1889 });

1890}

1891

1892// src/core/auth-adapters.ts

1893var AuthAdapterRegistry = class {

1894 adapters = /* @__PURE__ */ new Map();

1895 constructor(adapters = []) {

1896 for (const adapter of adapters) this.register(adapter);

1897 }

1898 register(adapter) {

1899 const id = adapter.id.trim();

1900 if (!id) throw new Error("Auth adapter id cannot be empty.");

1901 if (this.adapters.has(id)) throw new Error(`Auth adapter "${id}" is already registered.`);

1902 this.adapters.set(id, { ...adapter, id });

dist/cli.jsView file

Lines 10385-10425javascript

10385 const s = this.sessions.get(id);

10386 if (!s) return null;

10387 return {

10388 state: s.state,

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import { createInterface } from "readline/promises"; authorization: `Bearer ${token}` authorization: `Bearer ${token}` return cfg.upstreamBaseUrl.includes("api.openai.com") || !cfg.upstreamBaseUrl.includes("chatgpt.com") && !cfg.upstreamBaseUrl.includes("codex"); const base = cfg.upstreamBaseUrl.replace(/\/+$/, ""); return `${cfg.codexBaseUrl.replace(/\/+$/, "")}/responses`; message: `Credential ${credential.id} is marked "${credential.providerType}" but holds an OAuth token, not an API key. It was almost certainly added through the ChatGPT login flow ... const targetBase = (credential.baseUrl || (credential.providerType

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/chunk-E4BTPYUD.mjsView file

1882function openBrowser(url) { L1883: void import("child_process").then(({ spawn }) => { L1884: try {

High

Child Process

Package source references child process execution.

dist/chunk-E4BTPYUD.mjsView on unpkg · L1882

dist/cli.jsView file

10499child = needsShell ? ( L10500: // One string, no args array: pairing an args array with `shell: true` L10501: // raises DEP0190. Nothing here needs escaping — every argument is a

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L10499

10405// src/core/update.ts L10406: var import_node_child_process = require("child_process"); L10407: var UPDATE_REGISTRY_URL = "https://registry.npmjs.org/open-auther/latest"; L10408: var PACKAGE_URL = "https://www.npmjs.com/package/open-auther"; L10409: var INSTALL_COMMAND = "npm install -g open-auther@latest"; L10410: function parseVersion(value) {

High

Runtime Package Install

Findings

4 High3 Medium6 Low

HighChild Processdist/chunk-E4BTPYUD.mjs

HighShelldist/cli.js

HighCredential Redirect Persistencedist/cli.mjs

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to open-auther@1.4.2.

See all versions of open-auther for other recorded verdicts.

Review the evidence and your use of open-auther@1.4.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 17:59:43.809Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.