@m8t-stack/cli@0.2.152: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@m8t-stack/cli@0.2.152: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/cli.jsView file

130Source sends the broad process environment to a literal external destination. L130: try { L131: const obj2 = JSON.parse(raw); L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0) ... L343: // ../../packages/github-app-auth/dist/esm/jwt.js L344: import { createSign, createPrivateKey } from "crypto"; L345: function signAppJwt(args) { ... L356: sign.update(unsigned); L357: sign.end(); L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L461: const appJwt = signAppJwt({ appId, privateKeyPem }); L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L130

12929init_errors(); L12930: import { spawn } from "child_process"; L12931: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12929

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${token.token}`, headers: { Authorization: `Bearer ${token.token}` } headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

28922); L28923: this.context.stdout.write( L28924: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L28930: // src/commands/open.ts L28931: import { spawn as spawn5 } from "child_process"; L28932: import { Command as Command55, Option as Option52 } from "clipanion"; ... L28936: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L28937: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L28938: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L28922

130try { L131: const obj2 = JSON.parse(raw); L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0) ... L343: // ../../packages/github-app-auth/dist/esm/jwt.js L344: import { createSign, createPrivateKey } from "crypto"; L345: function signAppJwt(args) { ... L356: sign.update(unsigned); L357: sign.end(); L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L461: const appJwt = signAppJwt({ appId, privateKeyPem }); L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L130

2159} L2160: throw new Error("`fetch` is not defined as a global; Either pass `fetch` to the client, `new OpenAI({ fetch })` or polyfill the global, `globalThis.fetch = fetch`"); L2161: } ... L12929: init_errors(); L12930: import { spawn } from "child_process"; L12931: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]); ... L14640: try { L14641: creds = JSON.parse(fs3.readFileSync(credsPath, "utf8")); L14642: } catch { ... L36735: args.stdout( L36736: `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")} L36737: gateway: ${d.gatewayUrl}

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.jsView on unpkg · L2159

28922Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L28922: ); L28923: this.context.stdout.write( L28924: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L28930: // src/commands/open.ts L28931: import { spawn as spawn5 } from "child_process"; L28932: import { Command as Command55, Option as Option52 } from "clipanion"; ... L28936: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L28937: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L28938: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L28922

Source & flagged code

7 flagged

dist/cli.jsView file

130Source sends the broad process environment to a literal external destination. L130: try { L131: const obj2 = JSON.parse(raw); L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0) ... L343: // ../../packages/github-app-auth/dist/esm/jwt.js L344: import { createSign, createPrivateKey } from "crypto"; L345: function signAppJwt(args) { ... L356: sign.update(unsigned); L357: sign.end(); L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L461: const appJwt = signAppJwt({ appId, privateKeyPem }); L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L130

12929init_errors(); L12930: import { spawn } from "child_process"; L12931: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12929

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${token.token}`, headers: { Authorization: `Bearer ${token.token}` } headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

28922); L28923: this.context.stdout.write( L28924: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L28930: // src/commands/open.ts L28931: import { spawn as spawn5 } from "child_process"; L28932: import { Command as Command55, Option as Option52 } from "clipanion"; ... L28936: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L28937: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L28938: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L28922

130try { L131: const obj2 = JSON.parse(raw); L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0) ... L343: // ../../packages/github-app-auth/dist/esm/jwt.js L344: import { createSign, createPrivateKey } from "crypto"; L345: function signAppJwt(args) { ... L356: sign.update(unsigned); L357: sign.end(); L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L461: const appJwt = signAppJwt({ appId, privateKeyPem }); L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L130

2159} L2160: throw new Error("`fetch` is not defined as a global; Either pass `fetch` to the client, `new OpenAI({ fetch })` or polyfill the global, `globalThis.fetch = fetch`"); L2161: } ... L12929: init_errors(); L12930: import { spawn } from "child_process"; L12931: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]); ... L14640: try { L14641: creds = JSON.parse(fs3.readFileSync(credsPath, "utf8")); L14642: } catch { ... L36735: args.stdout( L36736: `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")} L36737: gateway: ${d.gatewayUrl}

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.jsView on unpkg · L2159

28922Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L28922: ); L28923: this.context.stdout.write( L28924: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L28930: // src/commands/open.ts L28931: import { spawn as spawn5 } from "child_process"; L28932: import { Command as Command55, Option as Option52 } from "clipanion"; ... L28936: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L28937: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L28938: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L28922