Description

runBundledPluginPostinstall() now always installs bundled plugin runtime dependencies for packaged installs by invoking npm install at install time.

Security impact:

• Dependency specs (missingSpecs) are derived from each bundled plugin's dist/extensions/<pluginId>/package.json (dependencies + optionalDependencies).
• The script then executes npm install ... <name>@<version> without --ignore-scripts / npm_config_ignore_scripts=true.
• Any dependency (or its transitive dependencies) can run arbitrary code via npm lifecycle scripts (preinstall, install, postinstall, prepare).
• Because this runs during postinstall, it expands the attack surface for supply-chain attacks and for scenarios where the packaged plugin manifests can be tampered with before installation (e.g., compromised distribution channel / mirrored artifacts).

Vulnerable code (install-time execution path):

const result = spawn(npmRunner.command, npmRunner.args, {
  cwd: packageRoot,
  encoding: "utf8",
  env: npmRunner.env ?? nestedEnv,
  stdio: "pipe",
  shell: npmRunner.shell,
  windowsVerbatimArguments: npmRunner.windowsVerbatimArguments,
});

and dependency specs are sourced from plugin manifests:

const packageJson = readJsonFile(packageJsonPath);
for (const [name, version] of Object.entries(collectRuntimeDeps(packageJson))) {
  deps.set(name, { name, version, ... });
}

Recommendation

Avoid executing third-party lifecycle scripts during install-time dependency remediation.

Preferred: disable scripts and only install from controlled, integrity-checked sources.

Example hardening:

const nestedEnv = createNestedNpmInstallEnv(env);
​// Disable lifecycle scripts
nestedEnv.npm_config_ignore_scripts = "true";

const npmRunner = resolveNpmRunner({
  env: nestedEnv,
  ...,
  npmArgs: [
    "install",
    "--omit=dev",
    "--no-save",
    "--package-lock=false",
    "--legacy-peer-deps",
    "--ignore-scripts",
    ...missingSpecs,
  ],
});

Additional mitigations (defense in depth):

• Use an allowlist of packages/versions permitted to be installed (do not accept arbitrary deps from plugin package.json).
• Prefer shipping required runtime deps pre-bundled, or use a lockfile with integrity (package-lock.json/npm ci) if network install is unavoidable.
• Consider pinning/validating registry configuration (npm_config_registry) to a trusted registry and disabling git+* / file: dependency spec types when constructing missingSpecs.

Description

The gateway RPC handler for method: "agent" restricts provider/model overrides to owner/internal callers, but forwards the caller-supplied thinking parameter without any authorization check.

• request.thinking is accepted from the RPC request.
• Authorization is only enforced for request.provider/request.model via allowModelOverride.
• request.thinking is then forwarded into dispatchAgentRunFromGateway() as ingressOpts.thinking.

Impact:

• Any client that can call the gateway agent method can potentially force higher-cost or less-safe reasoning/thinking modes (depending on how thinking maps to internal behavior), even when model overrides are disallowed.
• This is a policy/billing control bypass and can facilitate cost escalation or bypass of configured runtime constraints.

Vulnerable code:

const allowModelOverride = resolveAllowModelOverrideFromClient(client);
const requestedModelOverride = Boolean(request.provider || request.model);
if (requestedModelOverride && !allowModelOverride) { /* reject */ }

​// ... later
thinking: request.thinking,

Recommendation

Enforce authorization and validation for thinking overrides similarly to model/provider overrides.

Suggested approach:

• Add a separate capability check (e.g., allowThinkingOverride) or reuse allowModelOverride.
• Reject unauthorized requests that include thinking.
• Validate thinking against an allowlist (e.g., via the same normalizeThinkLevel() used elsewhere) before dispatch.

Example:

const allowThinkingOverride = resolveSenderIsOwnerFromClient(client) || client?.internal?.allowThinkingOverride === true;
if (request.thinking && !allowThinkingOverride) {
  respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST,
    "thinking override is not authorized for this caller."));
  return;
}
const thinking = request.thinking ? normalizeThinkLevel(request.thinking) : undefined;
if (request.thinking && !thinking) {
  respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST,
    "invalid thinking level"));
  return;
}
​// ...
thinking,

Description

doFetch() stores OpenRouter API-provided canonical_slug as an additional key in the capabilities map without validation or collision checks.

This introduces two issues when the OpenRouter catalog response is malicious/compromised (or provided by an attacker-controlled proxy via resolveProxyFetchFromEnv()):

• Cache poisoning via key collision: if canonical_slug equals another model's id, the later map.set() overwrites the prior entry, causing lookups for the victim ID to return the wrong capabilities.
• Memory/disk pressure: arbitrary/very long canonical_slug strings (or many unique slugs) increase Map size and the on-disk JSON cache written by writeDiskCache(), with no bounds/length limits.

Vulnerable code:

const parsed = parseModel(model);
map.set(model.id, parsed);
if (model.canonical_slug && model.canonical_slug !== model.id) {
  map.set(model.canonical_slug, parsed);
}

Recommendation

Treat canonical_slug as untrusted input and harden aliasing:

• Validate/normalize canonical_slug (type, length limit, allowed charset like /^[a-z0-9_.-]+\/[a-z0-9_.-]+$/i depending on expected format).
• Prevent collisions: only add the alias if it does not already exist in the map, or if it already points to the same parsed record.
• Bound cache growth: cap total models/aliases processed and reject excessively large responses.

Example:

function isSafeAlias(alias: unknown): alias is string {
  return (
    typeof alias === "string" &&
    alias.length > 0 &&
    alias.length <= 128 &&
    ​/^[a-z0-9_.-]+\/[a-z0-9_.-]+$/i.test(alias)
  );
}

​// ...
map.set(model.id, parsed);
if (isSafeAlias(model.canonical_slug) && model.canonical_slug !== model.id) {
  if (!map.has(model.canonical_slug)) {
    map.set(model.canonical_slug, parsed);
  }
}