open-tag@0.1.4
openTag command-line interface for connecting team messaging with AI coding agents.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe scanner’s credential signal resolves to a first-party Claude credential check against Anthropic’s official endpoint. The nested dependency’s install hook exits before agent setup, and no concrete attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; the dependency postinstall hook runs during installation but exits for this nested dependency.
Impact
No confirmed credential theft, unconsented install-time agent mutation, or other attack impact was established.
Mechanism
The observed credential probe authenticates to Anthropic’s models endpoint. Agent skill setup is part of runtime connection preparation.
AI rationale
The scanner’s credential signal resolves to a first-party Claude credential check against Anthropic’s official endpoint. The nested dependency’s install hook exits before agent setup, and no concrete attack behavior was found.
Network endpoints1
api.anthropic.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- The package has no install lifecycle hook of its own; its scripts are build, start, typecheck, and test.
- The dependency postinstall exits for non-global installs and when nested inside another package, before it can launch agent skill installation.
- The Claude credential probe targets Anthropic’s official models endpoint and sends credentials only when Claude Code reports first-party authentication.
- The type entry declares package APIs; the executable code is in separate module files.
- The runtime skill setup occurs while preparing agent connections and invokes the package’s own installer.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/program-WVDGMlg_.mjsView file
10import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
L11: import childProcess, { execFile, spawn } from "node:child_process";
L12: import http, { createServer } from "node:http";
L13: import https, { Agent, request } from "node:https";
...
L20: import { pipeline } from "node:stream/promises";
L21: import { createGunzip, gunzipSync } from "node:zlib";
L22: import process$1 from "node:process";
...
L810: success: true,
L811: data: result.value
L812: };
...
L7841: * being substituted. Hostname destinations are not resolved here — this is not DNS-rebinding
L7842: * protection; the Router re-checks its own host policy. Rejects loopback, private, link-local,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/program-WVDGMlg_.mjsView on unpkg · L1010Trigger-reachable chain: scripts.start -> dist/cli/index.mjs -> dist/program-WVDGMlg_.mjs
L10: import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
L11: import childProcess, { execFile, spawn } from "node:child_process";
L12: import http, { createServer } from "node:http";
L13: import https, { Agent, request } from "node:https";
...
L20: import { pipeline } from "node:stream/promises";
L21: import { createGunzip, gunzipSync } from "node:zlib";
L22: import process$1 from "node:process";
...
L810: success: true,
L811: data: result.value
L812: };
...
L7841: * being substituted. Hostname destinations are not resolved here — this is not DNS-rebinding
L7842: * protec
Findings
3 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/program-WVDGMlg_.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/program-WVDGMlg_.mjs
CriticalPrevious Version Dangerous Deltadist/program-WVDGMlg_.mjs
HighChild Processdist/program-WVDGMlg_.mjs
HighEvaldist/program-WVDGMlg_.mjs
HighCredential Redirect Persistencedist/program-WVDGMlg_.mjs
HighCommand Output Exfiltrationdist/program-WVDGMlg_.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-WVDGMlg_.mjs
HighTrigger Reachable Credential Exfiltrationdist/program-WVDGMlg_.mjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to open-tag@0.1.4.
See all versions of open-tag for other recorded verdicts.
- Review the evidence and your use of open-tag@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.