130Source sends the broad process environment to a literal external destination.
L130: try {
L131: const obj2 = JSON.parse(raw);
L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0)
...
L343: // ../../packages/github-app-auth/dist/esm/jwt.js
L344: import { createSign, createPrivateKey } from "crypto";
L345: function signAppJwt(args) {
...
L356: sign.update(unsigned);
L357: sign.end();
L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url");
...
L461: const appJwt = signAppJwt({ appId, privateKeyPem });
L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L130 12929init_errors();
L12930: import { spawn } from "child_process";
L12931: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${appJwt}`,
Authorization: `Bearer ${token.token}`,
headers: { Authorization: `Bearer ${token.token}` }
headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/cli.js:
const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
const res = await fetch("https://api.github.com/app", {
const res = await fetch("https://api.github.com/app/installations", {
message: "Could not acquire Foundry data-plane token (scope: https://ai.azure.com/.default)."
FOUNDRY_SCOPE = "https://ai.azure.com/.default";
FOUNDRY_DATA_SCOPE = "https://ai.azure.com/.default";
const url = `https://api.github.com/repos/${owner}/${repoName}/contents/.m8t/brain.yaml`;
FOUNDRY_SCOPE2 = "https://ai.azure.com/.default";
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/cli.jsView on unpkg 28922);
L28923: this.context.stdout.write(
L28924: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L28930: // src/commands/open.ts
L28931: import { spawn as spawn5 } from "child_process";
L28932: import { Command as Command55, Option as Option52 } from "clipanion";
...
L28936: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L28937: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L28938: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L28922 130try {
L131: const obj2 = JSON.parse(raw);
L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0)
...
L343: // ../../packages/github-app-auth/dist/esm/jwt.js
L344: import { createSign, createPrivateKey } from "crypto";
L345: function signAppJwt(args) {
...
L356: sign.update(unsigned);
L357: sign.end();
L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url");
...
L461: const appJwt = signAppJwt({ appId, privateKeyPem });
L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/cli.jsView on unpkg · L130 2159}
L2160: throw new Error("`fetch` is not defined as a global; Either pass `fetch` to the client, `new OpenAI({ fetch })` or polyfill the global, `globalThis.fetch = fetch`");
L2161: }
...
L12929: init_errors();
L12930: import { spawn } from "child_process";
L12931: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
...
L14640: try {
L14641: creds = JSON.parse(fs3.readFileSync(credsPath, "utf8"));
L14642: } catch {
...
L36580: args.stdout(
L36581: `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")}
L36582: gateway: ${d.gatewayUrl}
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/cli.jsView on unpkg · L2159 28922Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js
L28922: );
L28923: this.context.stdout.write(
L28924: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L28930: // src/commands/open.ts
L28931: import { spawn as spawn5 } from "child_process";
L28932: import { Command as Command55, Option as Option52 } from "clipanion";
...
L28936: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L28937: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L28938: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/cli.jsView on unpkg · L28922