registry / openwriter / 0.40.3

openwriter@0.40.3

The open-source writing surface for AI agents. Markdown-native editor with pending change review — your agent writes, you accept or reject.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious install-time behavior was found. The package has real user-invoked risk: explicit Claude setup mutates a first-party agent control surface, and legacy sync routes can store PATs in git remotes plus use shell:true around git/gh arguments.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

user runs openwriter setup/install-skill or uses /api/sync/setup/openwriter GitHub sync

Impact

Claude Code gains OpenWriter MCP/skills; GitHub PAT may be written to .git/config and sync args may be shell-injection prone if attacker-controlled input reaches the local API

Mechanism

first-party MCP/skill setup plus vulnerable git sync command construction

Rationale

Source inspection shows no automatic install/import attack, credential harvesting, remote payload loading, or unconsented broad AI-agent hijack. However, explicit agent extension setup and the legacy GitHub sync implementation create real but user-invoked risk, so this should warn rather than block.

Evidence

package.jsondist/bin/pad.jsdist/server/install-skill.jsdist/server/git-sync.jsdist/server/sync-routes.jsdist/server/plugin-install.jsdist/plugins/github/dist/git-sync.jsskill/SKILL.mdskill/agents/openwriter-enrichment-minion.mdskill/agents/openwriter-sort-minion.md~/.claude.json~/.claude/skills/openwriter/SKILL.md~/.claude/agents/openwriter-enrichment-minion.md~/.claude/agents/openwriter-sort-minion.md~/.openwriter/config.json~/.openwriter/plugins/package.json.git/config

Network endpoints6

api.github.com/user/repospublish.openwriter.ioauthors-voice.comapi.x.com/2127.0.0.1:5050localhost:5050

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/server/install-skill.js explicitly writes ~/.claude.json and copies OpenWriter skills/agents when user runs setup.
dist/server/git-sync.js uses execFile(...,{shell:true}) and weak quoting for git/gh args from /api/sync/setup.
dist/server/git-sync.js embeds GitHub PATs in remote URLs for setupWithPat/connectExisting, writing them into .git/config.
dist/server/plugin-install.js runs npm install/uninstall for user-supplied plugin names, though names are regex-limited.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook; only prepublishOnly.
dist/bin/pad.js activates server/setup/plugin paths only when the user invokes the CLI.
dist/plugins/github/dist/git-sync.js uses safer execFile argv arrays and PAT env credential helper.
Packaged skill/agents are first-party OpenWriter workflow files with restricted OpenWriter MCP tools, not hidden exfiltration instructions.
Network endpoints are product-aligned: GitHub, OpenWriter publish, Author's Voice, X API, localhost.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 2.40 MB of source, external domains: 127.0.0.1, api.fxtwitter.com, api.github.com, api.x.com, authors-voice.com, developer.x.com, example.com, git-scm.com, github.com, prosemirror.net, publish.openwriter.io, purl.org, reactjs.org, registry.npmjs.org, twemoji.maxcdn.com, unavatar.io, www.idpf.org, www.w3.org, x.com

Source & flagged code

6 flagged

dist/plugins/github/dist/blog-tools.jsView file

Lines 1-37javascript

1/**

2 * Blog publishing MCP tools — local git ops, no Worker, no PAT.

3 *

4 * Auth: piggybacks on the user's existing `gh auth login`.

5 * Persistence: blogSites in plugins['@openwriter/plugin-github'].blogSites.

6 */

7import { execFile } from 'child_process';

8import { existsSync, mkdirSync, readFileSync, copyFileSync, writeFileSync, readdirSync, statSync, rmSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L6

9import { join, extname, dirname, basename } from 'path';

10import { randomUUID } from 'crypto';

11import { homedir } from 'os';

12import { getServerModules, listBlogSites, writeBlogSites, } from './helpers.js';

13const NETWORK_TIMEOUT = 60000;

14// SECURITY (MCP-1): no shell. `git`/`gh` are spawned directly via execFile

15// with an argv array, so every element — including attacker-influenced blog

16// config values (owner/repo/branch) and slugs — is passed to the program as a

17// single literal argument and is NEVER interpreted by a shell. Do NOT add

18// `shell: true` or hand-roll arg quoting here: that reintroduces OS command

19// injection. If a future call genuinely needs shell features, whitelist-

High

Shell

Package source references shell execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L17

20// validate the inputs instead.

21function exec(cmd, args, cwd, timeout = NETWORK_TIMEOUT) {

22 return new Promise((resolve, reject) => {

23 execFile(cmd, args, { cwd, timeout, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {

24 if (err)

25 reject(new Error(stderr?.trim() || err.message));

26 else

27 resolve(stdout.trim());

28 });

29 });

30}

31async function ghAuthOk(cwd) {

32 try {

33 await exec('gh', ['auth', 'status'], cwd);

34 return true;

35 }

36 catch {

37 return false;

dist/plugins/x-api/dist/server-bridge.jsView file

Lines 1-36javascript

1/**

2 * Thin runtime bridge to the OpenWriter server modules this plugin needs for

3 * article publishing — the active document, its title/metadata, the data dir,

4 * and the shared TipTap -> DraftJS converter.

5 *

6 * The converter (server/tiptap-draftjs.ts) is shared with plugins/publish so

7 * both posting paths produce identical X content_state. We import the compiled

8 * server module at runtime rather than vendoring it, resolving both the npm

9 * package layout and the monorepo layout — the same dual-path trick the publish

10 * plugin's helpers use.

11 */

dist/server/plugin-install.jsView file

Lines 14-54javascript

14 if (!existsSync(PLUGINS_DIR)) {

15 mkdirSync(PLUGINS_DIR, { recursive: true });

16 }

17 if (!existsSync(PLUGINS_PKG)) {

18 writeFileSync(PLUGINS_PKG, JSON.stringify

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg

dist/plugins/github/dist/git-sync.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openwriter@0.40.1 matchedIdentity = npm:b3BlbndyaXRlcg:0.40.1 similarity = 0.986 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/plugins/github/dist/git-sync.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/plugins/github/dist/blog-tools.jsView file

6*/ L7: import { execFile } from 'child_process'; L8: import { existsSync, mkdirSync, readFileSync, copyFileSync, writeFileSync, readdirSync, statSync, rmSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L6

17// single literal argument and is NEVER interpreted by a shell. Do NOT add L18: // `shell: true` or hand-roll arg quoting here: that reintroduces OS command L19: // injection. If a future call genuinely needs shell features, whitelist-

High

Shell

Package source references shell execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L17

dist/plugins/x-api/dist/server-bridge.jsView file

16let cached = null; L17: async function tryImport(base) { L18: const [state, helpers, draftjs] = await Promise.all([

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/x-api/dist/server-bridge.jsView on unpkg · L16

dist/server/plugin-install.jsView file

34try { L35: execSync(`npm install --save ${packageName}`, { L36: cwd: PLUGINS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/server/plugin-install.jsView on unpkg · L34

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg

dist/plugins/github/dist/git-sync.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/plugins/github/dist/git-sync.jsView on unpkg

Findings

1 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/plugins/github/dist/git-sync.js

HighChild Processdist/plugins/github/dist/blog-tools.js

HighShelldist/plugins/github/dist/blog-tools.js

HighRuntime Package Installdist/server/plugin-install.js

HighShips High Entropy Blobdist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2

MediumDynamic Requiredist/plugins/x-api/dist/server-bridge.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/plugins/github/dist/blog-tools.jsView file

Lines 1-37javascript

1/**

2 * Blog publishing MCP tools — local git ops, no Worker, no PAT.

3 *

4 * Auth: piggybacks on the user's existing `gh auth login`.

5 * Persistence: blogSites in plugins['@openwriter/plugin-github'].blogSites.

6 */

7import { execFile } from 'child_process';

8import { existsSync, mkdirSync, readFileSync, copyFileSync, writeFileSync, readdirSync, statSync, rmSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L6

9import { join, extname, dirname, basename } from 'path';

10import { randomUUID } from 'crypto';

11import { homedir } from 'os';

12import { getServerModules, listBlogSites, writeBlogSites, } from './helpers.js';

13const NETWORK_TIMEOUT = 60000;

14// SECURITY (MCP-1): no shell. `git`/`gh` are spawned directly via execFile

15// with an argv array, so every element — including attacker-influenced blog

16// config values (owner/repo/branch) and slugs — is passed to the program as a

17// single literal argument and is NEVER interpreted by a shell. Do NOT add

18// `shell: true` or hand-roll arg quoting here: that reintroduces OS command

19// injection. If a future call genuinely needs shell features, whitelist-

High

Shell

Package source references shell execution.

dist/plugins/github/dist/blog-tools.jsView on unpkg · L17

20// validate the inputs instead.

21function exec(cmd, args, cwd, timeout = NETWORK_TIMEOUT) {

22 return new Promise((resolve, reject) => {

23 execFile(cmd, args, { cwd, timeout, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {

24 if (err)

25 reject(new Error(stderr?.trim() || err.message));

26 else

27 resolve(stdout.trim());

28 });

29 });

30}

31async function ghAuthOk(cwd) {

32 try {

33 await exec('gh', ['auth', 'status'], cwd);

34 return true;

35 }

36 catch {

37 return false;

dist/plugins/x-api/dist/server-bridge.jsView file

Lines 1-36javascript

1/**

2 * Thin runtime bridge to the OpenWriter server modules this plugin needs for

3 * article publishing — the active document, its title/metadata, the data dir,

4 * and the shared TipTap -> DraftJS converter.

5 *

6 * The converter (server/tiptap-draftjs.ts) is shared with plugins/publish so

7 * both posting paths produce identical X content_state. We import the compiled

8 * server module at runtime rather than vendoring it, resolving both the npm

9 * package layout and the monorepo layout — the same dual-path trick the publish

10 * plugin's helpers use.

11 */

dist/server/plugin-install.jsView file

Lines 14-54javascript

14 if (!existsSync(PLUGINS_DIR)) {

15 mkdirSync(PLUGINS_DIR, { recursive: true });

16 }

17 if (!existsSync(PLUGINS_PKG)) {

18 writeFileSync(PLUGINS_PKG, JSON.stringify

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View file

•path = dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 kind = high_entropy_blob sizeBytes = 51516 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2View on unpkg

dist/plugins/github/dist/git-sync.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/plugins/github/dist/git-sync.jsView on unpkg