@dvmkit/dvm-cli@0.12.1
Command-line client and agent skill for Digital Vending Machines: pay-per-use HTTPS services AI agents can find, pay, and call with no account or API key
AI Security Review
scanned 3d ago · by lpm-firewall-aiA normal completed job triggers a Lightning-funded wallet refill by default, spending from the user's saved float without a separate request for that purchase. The requirement for a configured float and the target limit reduce the amount at risk but do not make this automatic spend requested.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A normal CLI job completes while an agent wallet and Lightning float are configured and the pocket is below its refill threshold.
Impact
Funds can be spent on repeated refills without a separate user request for each purchase; the default pocket target is $5.
Mechanism
The completion path invokes the refiller by default. It creates a mint quote for the shortfall and pays the invoice using the saved Lightning float.
Attack narrative
When a job completes, the CLI automatically checks the saved ecash wallet and, if its balance is low, buys a refill by paying a mint invoice from the user's configured Lightning float. This can spend funds without a separate request for the refill; the default target is $5.
AI rationale
A normal completed job triggers a Lightning-funded wallet refill by default, spending from the user's saved float without a separate request for that purchase. The requirement for a configured float and the target limit reduce the amount at risk but do not make this automatic spend requested.
Evidence
dist/dvm.jsdist/pocket-refill-Z4YT7CHW.jsdist/chunk-WPTJM5A7.js
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- After a completed job, the CLI calls the pocket refiller by default unless top-up was explicitly disabled; ordinary calls set that flag from `creditOnly`.
- The refiller uses the saved agent wallet and Lightning float, then calculates funding when the pocket is below its target.
- It creates a mint quote and pays its Lightning invoice from the float, moving funds without a separate approval for that refill.
- The default pocket target is $5, and refill is considered when the balance falls below 25% of the target.
Evidence against
- Refill requires both an existing agent wallet and a configured Lightning float, and is limited to the gap between the current balance and the configured target.
- The code emits a float budget warning before paying the invoice, and records the payment against the selected mint.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
15 flaggeddist/chunk-MBSCP52L.jsView file
12$ZodArray,
L13: $ZodBase64,
L14: $ZodBase64URL,
...
L293: initCallerLoggers,
L294: isValidEvmPrivateKey,
L295: kdfInputToBytes,
...
L408: var cwd = null;
L409: var platform = process.env.GRACEFUL_FS_PLATFORM || process.platform;
L410: process.cwd = function() {
...
L415: try {
L416: process.cwd();
L417: } catch (er) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-MBSCP52L.jsView on unpkg · L1212$ZodArray,
L13: $ZodBase64,
L14: $ZodBase64URL,
...
L293: initCallerLoggers,
L294: isValidEvmPrivateKey,
L295: kdfInputToBytes,
...
L408: var cwd = null;
L409: var platform = process.env.GRACEFUL_FS_PLATFORM || process.platform;
L410: process.cwd = function() {
...
L415: try {
L416: process.cwd();
L417: } catch (er) {
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/chunk-MBSCP52L.jsView on unpkg · L1212Trigger-reachable chain: manifest.bin -> dist/dvm.js -> dist/chunk-MBSCP52L.js
L12: $ZodArray,
L13: $ZodBase64,
L14: $ZodBase64URL,
...
L293: initCallerLoggers,
L294: isValidEvmPrivateKey,
L295: kdfInputToBytes,
...
L408: var cwd = null;
L409: var platform = process.env.GRACEFUL_FS_PLATFORM || process.platform;
L410: process.cwd = function() {
...
L415: try {
L416: process.cwd();
L417: } catch (er) {
Findings
4 Critical11 High3 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-MBSCP52L.js
CriticalWallet Draindist/chunk-MBSCP52L.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-MBSCP52L.js
CriticalPrevious Version Dangerous Deltadist/dvm.js
HighFixed Recipient Near Full Balance Transferdist/chunk-MBSCP52L.js
HighCredential Redirect Persistencedist/chunk-MBSCP52L.js
HighCommand Output Exfiltrationdist/dvm.js
HighCross File Remote Execution Contextdist/dvm.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-MBSCP52L.js
HighSemantic Analysis Limiteddist/chunk-X7SEGALJ.js#virtual:normalized:round1
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @dvmkit/dvm-cli@0.12.1.
See all versions of @dvmkit/dvm-cli for other recorded verdicts.
- Avoid installing @dvmkit/dvm-cli@0.12.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.