@aspectlylabs/mikka@0.0.26
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis is undisclosed runtime telemetry: local quota snapshots are forwarded to the Mikka service during normal daemon operation. The inspected code sends provider tokens only to their providers’ official quota endpoints, so the evidence supports a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts the local daemon; quota polling begins automatically, and registered-device heartbeats carry the snapshots.
Impact
The Mikka service receives provider usage levels, plan labels and reset times. The reviewed forwarding path does not send the provider access tokens to Mikka.
Mechanism
The daemon reads local provider credentials, requests quota data from the providers’ official endpoints, then includes quota snapshots in heartbeats sent to the configured Mikka server.
AI rationale
This is undisclosed runtime telemetry: local quota snapshots are forwarded to the Mikka service during normal daemon operation. The inspected code sends provider tokens only to their providers’ official quota endpoints, so the evidence supports a warning rather than a malicious verdict.
Evidence
main.jscli.jsREADME.md~/.claude/.credentials.json~/.codex/auth.json~/Library/Application Support/Cursor/User/globalStorage/state.vscdb~/AppData/Roaming/Cursor/User/globalStorage/state.vscdb~/.config/Cursor/User/globalStorage/state.vscdb
Network endpoints4
api.anthropic.comchatgpt.comcursor.comapp.aspectlylabs.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The README describes daemon sign-in and the default Mikka server but does not disclose local provider quota polling or reporting.
- Starting a non-hosted daemon starts a quota poller backed by local credentials.
- The quota reader uses local Claude and Codex credential files; Claude’s access token is sent to Anthropic’s official usage endpoint for a quota request.
- Device heartbeats include quota snapshots and use the Mikka service, whose default host is app.aspectlylabs.com.
- Quota snapshots contain vendor, plan, status, usage windows and reset times; the inspected forwarding code does not include provider access tokens.
Evidence against
- The package has no lifecycle scripts; its documented workflow requires the user to sign in and start the daemon.
- Provider credentials are sent to their respective vendors’ official usage endpoints, not to the Mikka server.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggedgithub-credentials.mjsView file
4import { randomUUID } from 'node:crypto'
L5: import { spawn } from 'node:child_process'
L6: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L4mikka.jsView file
67"use strict";
L68: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ...
L69: };
...
L2058: try {
L2059: return JSON.parse(readFileSync(file, "utf8"));
L2060: } catch {
...
L2066: import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync } from "node:fs";
L2067: import { createConnection } from "node:net";
L2068: import { join } from "node:path";
...
L2177: }
L2178: if (options.stdout) streams.push({ stream: process.stdout });
L2179: const level = options.level ?? process.env.MIKKA_LOG_LEVEL ?? "info";
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
mikka.jsView on unpkg · L67Findings
2 Critical5 High3 Medium4 Low
CriticalCredential Exfiltrationmikka.js
CriticalTrigger Reachable Dangerous Capabilitycli.js
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighTrigger Reachable Credential Exfiltrationcli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.26.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.