open-tag@0.1.3
openTag command-line interface for connecting team messaging with AI coding agents.
AI Security Review
scanned 14d ago · by lpm-firewall-aiInspected source resolves the scanner’s credential, dynamic-code, and agent-configuration hints as an official Anthropic credential check, an empty-function feature test, and a temporary MCP configuration. The dependency install hook exits for nested installs, and no confirmed attack surface remains.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The credential check runs when the CLI probes a logged-in first-party Claude Code setup; the dependency hook has a separate direct-global-install condition.
Impact
The inspected paths establish no unrelated credential disclosure or persistent foreign agent-configuration change.
Mechanism
The CLI validates the configured Anthropic destination before sending credentials. The dependency hook exits when installed inside another package.
AI rationale
Inspected source resolves the scanner’s credential, dynamic-code, and agent-configuration hints as an official Anthropic credential check, an empty-function feature test, and a temporary MCP configuration. The dependency install hook exits for nested installs, and no confirmed attack surface remains.
Evidence
package.jsondist/program-DtKWcSL6.mjsdist/index.d.mts.lpm-dependency-evidence-b2a244ac-cead-4e96-8a09-cba237c4a73c/0/npm-linux/package.json.lpm-dependency-evidence-b2a244ac-cead-4e96-8a09-cba237c4a73c/0/npm-linux/scripts/postinstall.mjs
Network endpoints1
api.anthropic.com/v1/models?limit=1
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and import entrypoint, has no install lifecycle script, and declares context-tree@0.1.16; dist/index.d.mts declares typed APIs.
- The Claude credential probe is limited to logged-in first-party setups; unsupported backends and nondefault Anthropic base URLs skip it.
- The credential check sends credentials to the fixed official Anthropic models endpoint.
- The dynamic Function match creates an empty function in a caught feature test; it does not evaluate package-supplied code.
- The MCP configuration is written under an OS temporary directory for the run.
- The dependency postinstall proceeds only for a direct global install, and exits when installed as another package’s dependency.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/program-DtKWcSL6.mjsView file
10import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
L11: import childProcess, { execFile, spawn } from "node:child_process";
L12: import http, { createServer } from "node:http";
L13: import https, { Agent, request } from "node:https";
...
L19: import { pipeline } from "node:stream/promises";
L20: import { createGunzip, gunzipSync } from "node:zlib";
L21: import process$1 from "node:process";
...
L809: success: true,
L810: data: result.value
L811: };
...
L7827: * being substituted. Hostname destinations are not resolved here — this is not DNS-rebinding
L7828: * protection; the Router re-checks its own host policy. Rejects loopback, private, link-local,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/program-DtKWcSL6.mjsView on unpkg · L1010Trigger-reachable chain: scripts.start -> dist/cli/index.mjs -> dist/program-DtKWcSL6.mjs
L10: import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
L11: import childProcess, { execFile, spawn } from "node:child_process";
L12: import http, { createServer } from "node:http";
L13: import https, { Agent, request } from "node:https";
...
L19: import { pipeline } from "node:stream/promises";
L20: import { createGunzip, gunzipSync } from "node:zlib";
L21: import process$1 from "node:process";
...
L809: success: true,
L810: data: result.value
L811: };
...
L7827: * being substituted. Hostname destinations are not resolved here — this is not DNS-rebinding
L7828: * protec
Findings
3 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/program-DtKWcSL6.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/program-DtKWcSL6.mjs
CriticalPrevious Version Dangerous Deltadist/program-DtKWcSL6.mjs
HighChild Processdist/program-DtKWcSL6.mjs
HighEvaldist/program-DtKWcSL6.mjs
HighCredential Redirect Persistencedist/program-DtKWcSL6.mjs
HighCommand Output Exfiltrationdist/program-DtKWcSL6.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-DtKWcSL6.mjs
HighTrigger Reachable Credential Exfiltrationdist/program-DtKWcSL6.mjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to open-tag@0.1.3.
See all versions of open-tag for other recorded verdicts.
- Review the evidence and your use of open-tag@0.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.