registry / @aspectlylabs/mikka / 0.0.378
@aspectlylabs/mikka@0.0.378
Local Mikka daemon: runs agents through the user's own CLIs
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged shell, process, and network activity is consistent with a local agent daemon that runs coding CLIs and brokers their requests to the configured model provider. Reviewed credential flows are run-scoped and tied to configured providers or GitHub access; no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A user starts the daemon or an assigned agent run.
Impact
The reviewed flows do not show unsolicited credential collection, redirection, or unrelated data exfiltration.
Mechanism
The agent CLI uses a local broker to send model requests to the default or user-configured provider; run-scoped GitHub access uses the configured token exchange endpoint.
AI rationale
The flagged shell, process, and network activity is consistent with a local agent daemon that runs coding CLIs and brokers their requests to the configured model provider. Reviewed credential flows are run-scoped and tied to configured providers or GitHub access; no malicious behavior was identified.
Network endpoints3
api.anthropic.comapi.openai.comgithub.com
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a local daemon CLI and library entry points consistent with the package description.
- Model credentials are validated and sent through a broker to the default Anthropic/OpenAI API or the configured HTTPS provider; the broker restricts request paths and rejects redirects.
- Hosted model traffic is routed through a local proxy to the run’s broker socket.
- GitHub credentials are exchanged using a run token at the configured endpoint and used for GitHub repositories.
Evidence against
- No install lifecycle scripts are declared in the manifest.
- The flagged credential and network flows are part of explicitly assigned agent runs and use configured provider endpoints or run-scoped service credentials.
- The shell and child-process references support running the coding CLIs and agent tasks the package describes.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggedgithub-credentials.mjsView file
7import { randomUUID } from 'node:crypto'
L8: import { spawn } from 'node:child_process'
L9: import { pathToFileURL } from 'node:url'
High
Child Process
Package source references child process execution.
github-credentials.mjsView on unpkg · L7mikka.jsView file
4632ai: "7.0.142",
L4633: execa: "10.1.1",
L4634: pino: "10.4.0",
High
6526assertSafeId("run id", runId);
L6527: const common = resolve4(await worktreeGitDir(repoPath, worktree), "..", "..");
L6528: if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
...
L6537: }
L6538: async function pinnedGit(repoPath, worktree, env = process.env) {
L6539: const gitDir = await worktreeGitDir(repoPath, worktree);
L6540: const workTree = realpathSync4(worktree);
L6541: return (args, extra, options) => execa3("git", [...SAFE_GIT, ...args], {
L6542: cwd: workTree,
Findings
5 High2 Medium5 Low
HighChild Processgithub-credentials.mjs
HighShellmikka.js
HighSame File Env Network Executionmikka.js
HighCredential Redirect Persistencemain.js
HighCommand Output Exfiltrationagents/native-container.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @aspectlylabs/mikka@0.0.378.
See all versions of @aspectlylabs/mikka for other recorded verdicts.
- Review the evidence and your use of @aspectlylabs/mikka@0.0.378 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.