registry / @aspectlylabs/mikka / 0.0.374
@aspectlylabs/mikka@0.0.374
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe reviewed credential flow uses a local broker to forward supported model requests to the selected provider, while hosted runs use a broker socket and placeholder credentials. The harness installer verifies pinned artifact integrity; the reported shell and process execution matches the package’s daemon and agent-runner purpose.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Explicit daemon, CLI, or agent-run activity; the manifest has no install lifecycle scripts.
Impact
No malicious impact identified in the reviewed code.
Mechanism
The API-key broker forwards supported requests to the credential’s configured provider base URL. Harness downloads are integrity checked.
AI rationale
The reviewed credential flow uses a local broker to forward supported model requests to the selected provider, while hosted runs use a broker socket and placeholder credentials. The harness installer verifies pinned artifact integrity; the reported shell and process execution matches the package’s daemon and agent-runner purpose.
Evidence
harness/install.mjsmain.jsagents/native-container.mjs
Network endpoints3
api.anthropic.comapi.openai.com/v1app.aspectlylabs.com/mikka
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a daemon CLI and JavaScript entry points; it declares no lifecycle scripts.
- The API-key broker restricts requests to Anthropic or OpenAI API paths and sends them to the credential’s configured provider base URL.
- The hosted runner passes a placeholder credential to its CLI and routes model requests through a local broker.
- The harness installer downloads pinned artifacts and checks their SHA-512 integrity before unpacking them.
Evidence against
- No reviewed source showed credentials being sent to an unrelated host or unrelated install-time contact.
- The reported shell and process execution occurs in harness installation and agent-runner code, consistent with the package’s stated purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedgithub-credentials.mjsView file
7import { randomUUID } from 'node:crypto'
L8: import { spawn } from 'node:child_process'
L9: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L7mikka.jsView file
4625ai: "7.0.142",
L4626: execa: "10.1.1",
L4627: pino: "10.4.0",
High
6446assertSafeId("run id", runId);
L6447: const common = resolve4(await worktreeGitDir(repoPath, worktree), "..", "..");
L6448: if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
...
L6457: }
L6458: async function pinnedGit(repoPath, worktree, env = process.env) {
L6459: const gitDir = await worktreeGitDir(repoPath, worktree);
L6460: const workTree = realpathSync4(worktree);
L6461: return (args, extra, options) => execa3("git", [...SAFE_GIT, ...args], {
L6462: cwd: workTree,
Findings
1 Critical5 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltaharness/install.mjs
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighCommand Output Exfiltrationagents/native-container.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.374.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.374 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.