open-tag@0.1.1
OpenTag command-line interface for connecting team messaging with AI coding agents.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe source does not substantiate the scanner’s credential-redirection or persistent agent-control claims. The manifest has no install hook, and the inspected runtime paths align with the declared CLI and hosted-tool functionality.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked, or the exported runtime API is called by a consumer.
Impact
The inspected behavior supports the package’s CLI and agent integration; no credential redirection or persistent agent configuration change was established.
Mechanism
No install hook is present. The inspected Claude Code bridge writes a temporary MCP configuration for a loopback tool server; authenticated API context uses the saved OpenTag server URL.
AI rationale
The source does not substantiate the scanner’s credential-redirection or persistent agent-control claims. The manifest has no install hook, and the inspected runtime paths align with the declared CLI and hosted-tool functionality.
Evidence
package.jsondist/cli/index.mjsdist/index.mjsdist/program-CXdTyo53.mjsdist/index.d.mts
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to a CLI and runtime module and defines no install lifecycle hook.
- The CLI runs when its executable is invoked; package.json lists only build, start, typecheck, and test scripts.
- The flagged agent-related code lists skill directories and prepares a Claude Code hosted-tool bridge during runtime.
- That bridge uses a temporary configuration and a loopback server for OpenTag tools.
- Authenticated API requests use the server URL saved in OpenTag credentials.
- The declaration file exposes the package’s command and result APIs.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/program-CXdTyo53.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = open-tag@0.1.0
matchedIdentity = npm:b3Blbi10YWc:0.1.0
similarity = 0.857
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/program-CXdTyo53.mjsView on unpkg10import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
L11: import childProcess, { execFile, spawn } from "node:child_process";
L12: import http, { createServer } from "node:http";
High
Child Process
Package source references child process execution.
dist/program-CXdTyo53.mjsView on unpkg · L10•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/program-CXdTyo53.mjs:
import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
"reauthorization_required",
"reauthorization_required",
reauthorizationRequired: boolean(),
message: "Slack reauthorization requires the exact current Slack binding"
authorizationUrl: string().url(),
reauthorizationRequired: boolean(),
"authorization-failed",
Findings
1 Critical4 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/program-CXdTyo53.mjs
HighChild Processdist/program-CXdTyo53.mjs
HighCredential Redirect Persistencedist/program-CXdTyo53.mjs
HighCommand Output Exfiltrationdist/program-CXdTyo53.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-CXdTyo53.mjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/program-CXdTyo53.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to open-tag@0.1.1.
See all versions of open-tag for other recorded verdicts.
- Review the evidence and your use of open-tag@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.