registry / Credential exfiltration / @m8t-stack/cli
@m8t-stack/cli
CLI for managing m8t deployments on Azure / Microsoft Agent Foundry
This report shows the evidence for @m8t-stack/cli@0.2.152. 3 of 45 known versions are blocked or flagged. The newest version, 0.2.166, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource directly establishes off-device transmission of an Azure bearer token to a hard-coded endpoint. The absence of an install hook limits automatic exposure but does not neutralize credential exfiltration through a misleading command.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs m8t telemetry enroll.
Impact
The receiving service obtains the caller's Azure management access token and may use it within the token's permissions and lifetime.
Mechanism
Azure CLI token collection followed by an external HTTP POST.
Attack narrative
When telemetry enrollment is run, the CLI invokes Azure CLI to obtain a management access token. It places that token in an entra-jwt proof object and posts it to the hard-coded m8t ingest endpoint. The command presents this as telemetry enrollment, but its user-facing description does not clearly state that the complete bearer token is transmitted to that external service.
AI rationale
Source directly establishes off-device transmission of an Azure bearer token to a hard-coded endpoint. The absence of an install hook limits automatic exposure but does not neutralize credential exfiltration through a misleading command.
Evidence
dist/cli.js
Network endpoints1
m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The telemetry command obtains an Azure management access token from the local Azure CLI.
- It sends that bearer token in a JSON request to a hard-coded m8t-controlled ingest host.
- The command description does not clearly disclose that the full Azure access token is transmitted off-device.
Evidence against
- package.json has no install, preinstall, or postinstall hook; prepublishOnly only builds before publishing.
- The token transfer is reached through the explicit telemetry enroll command, not on package installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/cli.jsView file
130Source sends the broad process environment to a literal external destination.
L130: try {
L131: const obj2 = JSON.parse(raw);
L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0)
...
L343: // ../../packages/github-app-auth/dist/esm/jwt.js
L344: import { createSign, createPrivateKey } from "crypto";
L345: function signAppJwt(args) {
...
L356: sign.update(unsigned);
L357: sign.end();
L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url");
...
L461: const appJwt = signAppJwt({ appId, privateKeyPem });
L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L13012929init_errors();
L12930: import { spawn } from "child_process";
L12931: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${token.token}`,
headers: { Authorization: `Bearer ${token.token}` }
headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })
Findings
1 Critical7 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @m8t-stack/cli@0.2.152.
The versions list below shows the verdict for each recorded version.
- Avoid installing @m8t-stack/cli@0.2.152. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.