open-tag@0.1.5
openTag command-line interface for connecting team messaging with AI coding agents.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe source does not establish the credential exfiltration or fixed gateway redirection suggested by the scanner. It does show automatic, undocumented error reporting to the configured OpenTag server, including error messages and stacks, so this merits a telemetry warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Normal CLI execution can report internal, dependency, or protocol errors; unhandled process failures also reach the reporting handler.
Impact
The server operator receives error messages, stacks, and command or platform metadata without an explicit opt-in; error details may contain sensitive context.
Mechanism
The CLI reads the saved server identity and posts a JSON report with redacted error text and diagnostic metadata to `/api/v1/error-reports`.
AI rationale
The source does not establish the credential exfiltration or fixed gateway redirection suggested by the scanner. It does show automatic, undocumented error reporting to the configured OpenTag server, including error messages and stacks, so this merits a telemetry warning rather than a publish block.
Evidence
dist/cli/index.mjsdist/program-DZw9EJav.mjs
Network endpoints1
Configured OpenTag server: /api/v1/error-reports
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes `dist/cli/index.mjs` as the CLI and has no install lifecycle script.
- Normal CLI startup installs process error reporting and observes command failures.
- Command error reports are limited to internal, dependency, and protocol categories.
- The report destination is recovered from saved OpenTag credentials or account and computer identity state.
- The CLI POSTs JSON reports to that server’s `/api/v1/error-reports` endpoint.
- The report payload includes redacted error messages and stacks, along with diagnostic metadata.
Evidence against
- No package lifecycle hook is declared.
- The reporter targets the saved OpenTag server rather than a hard-coded unrelated collector.
- The inspected code did not show discovered credentials being sent to a foreign host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
14 flaggeddist/program-DZw9EJav.mjsView file
10import { access, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, writeFile } from "node:fs...
L11: import childProcess, { execFile, spawn } from "node:child_process";
L12: import http, { createServer } from "node:http";
L13: import https, { Agent, request } from "node:https";
...
L20: import { pipeline } from "node:stream/promises";
L21: import { createGunzip, gunzipSync } from "node:zlib";
L22: import process$1 from "node:process";
...
L810: success: true,
L811: data: result.value
L812: };
...
L8489: * being substituted. Hostname destinations are not resolved here — this is not DNS-rebinding
L8490: * protection; the Router re-checks its own host policy. Rejects loopback, private, link-local,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/program-DZw9EJav.mjsView on unpkg · L1032711code: number$1().int(),
L32712: stdout: string(),
L32713: stderr: string()
...
L32721: request.on("timeout", () => request.destroy(/* @__PURE__ */ new Error("Context Tree command timed out")));
L32722: request.end(JSON.stringify({ args }));
L32723: });
...
L32725: const CONTEXT_TREE_COMMAND_CLIENT_SOURCE = `
L32726: import http from 'node:http';
L32727: import { spawn } from 'node:child_process';
L32728: import { readFileSync } from 'node:fs';
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/program-DZw9EJav.mjsFindings
4 Critical10 High3 Medium5 Low
CriticalCredential Exfiltrationdist/program-DZw9EJav.mjs
CriticalCommand Output Exfiltrationdist/program-DZw9EJav.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/program-DZw9EJav.mjs
CriticalPrevious Version Dangerous Deltadist/program-DZw9EJav.mjs
HighChild Processdist/program-DZw9EJav.mjs
HighEvaldist/program-DZw9EJav.mjs
HighSame File Env Network Executiondist/program-DZw9EJav.mjs
HighCredential Redirect Persistencedist/program-DZw9EJav.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-DZw9EJav.mjs
HighTrigger Reachable Credential Exfiltrationdist/program-DZw9EJav.mjs
Affected versions and remediation
This report applies to open-tag@0.1.5.
See all versions of open-tag for other recorded verdicts.
- Review the evidence and your use of open-tag@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.