130Source sends the broad process environment to a literal external destination.
L130: try {
L131: const obj = JSON.parse(raw);
L132: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0)
...
L335: // ../../packages/github-app-auth/dist/esm/jwt.js
L336: import { createSign, createPrivateKey } from "crypto";
L337: function signAppJwt(args) {
...
L348: sign.update(unsigned);
L349: sign.end();
L350: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url");
...
L453: const appJwt = signAppJwt({ appId, privateKeyPem });
L454: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
L455: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L130 12919init_errors();
L12920: import { spawn } from "child_process";
L12921: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${token.token}`,
headers: { Authorization: `Bearer ${token.token}` }
headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/cli.js:
const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
const res = await fetch("https://api.github.com/app", {
const res = await fetch("https://api.github.com/app/installations", {
message: "Could not acquire Foundry data-plane token (scope: https://ai.azure.com/.default)."
FOUNDRY_SCOPE = "https://ai.azure.com/.default";
FOUNDRY_DATA_SCOPE = "https://ai.azure.com/.default";
const url = `https://api.github.com/repos/${owner}/${repoName}/contents/.m8t/brain.yaml`;
FOUNDRY_SCOPE2 = "https://ai.azure.com/.default";
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/cli.jsView on unpkg 27859);
L27860: this.context.stdout.write(
L27861: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L27867: // src/commands/open.ts
L27868: import { spawn as spawn5 } from "child_process";
L27869: import { Command as Command53, Option as Option50 } from "clipanion";
...
L27873: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L27874: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L27875: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L27859 130try {
L131: const obj = JSON.parse(raw);
L132: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0)
...
L335: // ../../packages/github-app-auth/dist/esm/jwt.js
L336: import { createSign, createPrivateKey } from "crypto";
L337: function signAppJwt(args) {
...
L348: sign.update(unsigned);
L349: sign.end();
L350: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url");
...
L453: const appJwt = signAppJwt({ appId, privateKeyPem });
L454: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
L455: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/cli.jsView on unpkg · L130 2149}
L2150: throw new Error("`fetch` is not defined as a global; Either pass `fetch` to the client, `new OpenAI({ fetch })` or polyfill the global, `globalThis.fetch = fetch`");
L2151: }
...
L12919: init_errors();
L12920: import { spawn } from "child_process";
L12921: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
...
L14630: try {
L14631: creds = JSON.parse(fs3.readFileSync(credsPath, "utf8"));
L14632: } catch {
...
L34521: args.stdout(
L34522: `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")}
L34523: gateway: ${d.gatewayUrl}
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/cli.jsView on unpkg · L2149 27859Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js
L27859: );
L27860: this.context.stdout.write(
L27861: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L27867: // src/commands/open.ts
L27868: import { spawn as spawn5 } from "child_process";
L27869: import { Command as Command53, Option as Option50 } from "clipanion";
...
L27873: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L27874: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L27875: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/cli.jsView on unpkg · L27859