registry / @aspectlylabs/mikka / 0.0.373
@aspectlylabs/mikka@0.0.373
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no install lifecycle scripts, and the reviewed credential path uses an HTTPS provider base URL with official Anthropic and OpenAI defaults. The scanner's credential and process-execution leads fit the package's stated local agent-daemon function; the examined paths did not show an unrelated credential destination.
Static reason
One or more suspicious static signals were detected.
Trigger
A run is assigned a model credential and invokes the corresponding supported CLI.
Impact
The credential authorizes model requests for the run; reviewed code did not show it redirected to an unrelated collector.
Mechanism
A local broker forwards supported model API requests to the credential's HTTPS provider base URL, defaulting to the official Anthropic or OpenAI API host.
AI rationale
The manifest has no install lifecycle scripts, and the reviewed credential path uses an HTTPS provider base URL with official Anthropic and OpenAI defaults. The scanner's credential and process-execution leads fit the package's stated local agent-daemon function; the examined paths did not show an unrelated credential destination.
Evidence
main.jsagents/native-container.mjs
Network endpoints2
api.anthropic.comapi.openai.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines a CLI and module exports, with no lifecycle scripts.
- The API-key broker defaults to the official Anthropic and OpenAI API hosts and permits only the expected model API paths.
- The broker uses the run assignment's model credential and sends it in the provider's authentication header.
- The native-container bootstrap says it accepts no provider token and reaches the model through the broker.
Evidence against
- The package launches CLIs and handles credentials, filesystem access, and network requests, which are capabilities relevant to its local agent-daemon purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
6 flaggedgithub-credentials.mjsView file
7import { randomUUID } from 'node:crypto'
L8: import { spawn } from 'node:child_process'
L9: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L7mikka.jsView file
4625ai: "7.0.142",
L4626: execa: "10.1.1",
L4627: pino: "10.4.0",
High
6446assertSafeId("run id", runId);
L6447: const common = resolve4(await worktreeGitDir(repoPath, worktree), "..", "..");
L6448: if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
...
L6457: }
L6458: async function pinnedGit(repoPath, worktree, env = process.env) {
L6459: const gitDir = await worktreeGitDir(repoPath, worktree);
L6460: const workTree = realpathSync4(worktree);
L6461: return (args, extra, options) => execa3("git", [...SAFE_GIT, ...args], {
L6462: cwd: workTree,
Findings
5 High2 Medium5 Low
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighCommand Output Exfiltrationagents/native-container.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.373.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.373 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.