open-tag@0.1.2
OpenTag command-line interface for connecting team messaging with AI coding agents.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected credential and agent integration code is consistent with explicit runtime functionality. The scanner’s credential-redirection and agent-configuration signals are not supported by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; credential verification and agent runtime setup occur only through their relevant runtime operations.
Impact
No confirmed credential theft, malicious agent configuration change, or other attack effect was established.
Mechanism
The credential probe declines custom Anthropic base URLs. The Claude bridge writes temporary configuration for a loopback tool server and an optional configured gateway.
AI rationale
The manifest has no install lifecycle hook, and the inspected credential and agent integration code is consistent with explicit runtime functionality. The scanner’s credential-redirection and agent-configuration signals are not supported by the inspected source.
Evidence
package.jsondist/cli/index.mjsdist/index.mjsdist/index.d.mtsdist/program-BpXcUOCH.mjs
Network endpoints1
api.anthropic.com/v1/models?limit=1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and runtime module, and declares no install lifecycle script.
- The credential probe rejects custom Anthropic base URLs and sends credentials only to the official Anthropic models endpoint.
- The agent-path match is a skill-directory entry; the Claude bridge uses a temporary configuration with a loopback server and optional configured gateway.
- The runtime declaration file lists exported API types and functions; no harmful behavior is present in that declaration.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/program-BpXcUOCH.mjsView file
10import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
L11: import childProcess, { execFile, spawn } from "node:child_process";
L12: import http, { createServer } from "node:http";
L13: import https, { Agent, request } from "node:https";
...
L18: import { pipeline } from "node:stream/promises";
L19: import { createGunzip, gunzipSync } from "node:zlib";
L20: import process$1 from "node:process";
...
L808: success: true,
L809: data: result.value
L810: };
...
L7827: * being substituted. Hostname destinations are not resolved here — this is not DNS-rebinding
L7828: * protection; the Router re-checks its own host policy. Rejects loopback, private, link-local,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/program-BpXcUOCH.mjsView on unpkg · L1010Trigger-reachable chain: scripts.start -> dist/cli/index.mjs -> dist/program-BpXcUOCH.mjs
L10: import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
L11: import childProcess, { execFile, spawn } from "node:child_process";
L12: import http, { createServer } from "node:http";
L13: import https, { Agent, request } from "node:https";
...
L18: import { pipeline } from "node:stream/promises";
L19: import { createGunzip, gunzipSync } from "node:zlib";
L20: import process$1 from "node:process";
...
L808: success: true,
L809: data: result.value
L810: };
...
L7827: * being substituted. Hostname destinations are not resolved here — this is not DNS-rebinding
L7828: * protec
Findings
3 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/program-BpXcUOCH.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/program-BpXcUOCH.mjs
CriticalPrevious Version Dangerous Deltadist/program-BpXcUOCH.mjs
HighChild Processdist/program-BpXcUOCH.mjs
HighEvaldist/program-BpXcUOCH.mjs
HighCredential Redirect Persistencedist/program-BpXcUOCH.mjs
HighCommand Output Exfiltrationdist/program-BpXcUOCH.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-BpXcUOCH.mjs
HighTrigger Reachable Credential Exfiltrationdist/program-BpXcUOCH.mjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to open-tag@0.1.2.
See all versions of open-tag for other recorded verdicts.
- Review the evidence and your use of open-tag@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.