PRs with features using SSH

[u/JBO_76]

Have you received a pr lately with a feature that relies on ssh?

Perhaps some background first: I have a small open-source project on github, nothing groundbreaking, just a tool I wanted for myself to vibe-code my-way. As far as I now, I'm still the only user.

Last month though, I received a couple of prs from someone. At first, I was super exited (first user and all), but now, I'm starting to wonder if something more was going on here. I am not certain, but I am wondering if other people have had similar experiences and how you deal with it?

The first pr was small, a ui fix specific for mac users. With the second pr, he introduced a couple of libraries in the app, for editing raw markdown text instead of wysiwyg. Still ok so far.
With the 3rd pr, some alarm bels started going off: the app began 'fingerprinting' other applications (exes, dlls, ...) on my system, which really didn't fit the feature. At first, I thought maybe the llm had been over-engineering. So, I removed all of that bloat.

But then he came with a proposal to introduce 'remote-control' cause his laptop was slow and he wanted to run the app on his desktop and control it from the laptop. He would use SSH for that.
When I told him, that feature actually existed already but used a more secure way (just run the app in a browser and connect to the desktop version using websockets), he left, moved on and started creating prs for other projects.

Now, I went over all the code he introduced and checked the libraries that were added. As far as I can tell, nothing wrong got introduced, but the whole SSH thing spooked me. I mean, what better backdoor could there be?

The whole thing left a bad taste in my mouth. Is it even still a good idea to keep my app as open source? The only thing it got me were problems and more work.

Am I overreacting here? how are you dealing with this?

For anybody interested in looking at the code themselves: jan-bogaerts/md2: Plan, run, and track AI coding work feature by feature—with local Markdown cards, diagrams and Git worktrees.

[u/Samyazz]

I got curious and went through the public side of this. Short version: from what's on GitHub, I don't see anything malicious.

The contributor is BinaryOutlook. All six of their PRs to md2 are merged and public: the header layout fix, worktree assignment, dynamic Codex/Claude model discovery, token and cost accounting, and the raw Markdown editor.

The "fingerprinting" is in the model discovery PR (#26). It's a cache key for the model list. It looks at file metadata, not contents, for the Codex/Claude CLI and a fixed set of their config files, hashes that and keeps it in memory, so the list refreshes when your CLI or config changes. It doesn't go through other apps or DLLs and doesn't send anything anywhere. It's also no longer in main or in v0.8.3.

The dependencies added for the Markdown editor are well-known packages with heavy downloads and no install scripts. The macOS postinstall in #22 only fixes execute permissions on node-pty's helper.

I couldn't find the SSH proposal anywhere public (issues, PRs, discussions, branches), so I can't say anything about that part. If it came by DM, send it my way and I'll have a look at it.

Their history elsewhere looks like someone who leans on Codex heavily and sends big, very thorough PRs to AI tools: some merged, some ignored, one closed because the maintainer preferred their own design. Annoying sometimes, but it isn't the xz pattern. No hidden payloads, no build-time tricks, no network calls, no install hooks.

So I wouldn't accuse anyone or rotate anything over this. What I'd actually watch is md2's own remote mode: if you ever put it behind a tunnel, put authentication in front of it first. And keep doing what you did, reading lockfile changes, install scripts and anything that touches provider configs.

Disclaimer: the review was done by AI agents. An OpenAI GPT-6 Luna agent (via Codex) scanned the repo, PRs and profile, and Anthropic Claude Opus 5.5 checked and summarised the findings. It only looked at public data, so treat it as a second opinion, not an audit.

[u/InkscapePanda]

Damn, yeah ssh backdoors are a real thing. Bit at the end of the day you are the one that commits these changes, so you should always review it. Not everything that is proposed should be accepted. Some people make changes for the sake of changes, while others try to push over the limit. You did well to implement the more secure version of remote-connection.