@m8t-stack/cli@0.2.158: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@m8t-stack/cli@0.2.158: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/cli.jsView file

130Source sends the broad process environment to a literal external destination. L130: try { L131: const obj2 = JSON.parse(raw); L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0) ... L343: // ../../packages/github-app-auth/dist/esm/jwt.js L344: import { createSign, createPrivateKey } from "crypto"; L345: function signAppJwt(args) { ... L356: sign.update(unsigned); L357: sign.end(); L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L461: const appJwt = signAppJwt({ appId, privateKeyPem }); L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L130

12936init_errors(); L12937: import { spawn } from "child_process"; L12938: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12936

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${token.token}`, headers: { Authorization: `Bearer ${token.token}` } headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

29215); L29216: this.context.stdout.write( L29217: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L29223: // src/commands/open.ts L29224: import { spawn as spawn5 } from "child_process"; L29225: import { Command as Command55, Option as Option52 } from "clipanion"; ... L29229: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L29230: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L29231: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L29215

130try { L131: const obj2 = JSON.parse(raw); L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0) ... L343: // ../../packages/github-app-auth/dist/esm/jwt.js L344: import { createSign, createPrivateKey } from "crypto"; L345: function signAppJwt(args) { ... L356: sign.update(unsigned); L357: sign.end(); L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L461: const appJwt = signAppJwt({ appId, privateKeyPem }); L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L130

2163} L2164: throw new Error("`fetch` is not defined as a global; Either pass `fetch` to the client, `new OpenAI({ fetch })` or polyfill the global, `globalThis.fetch = fetch`"); L2165: } ... L12936: init_errors(); L12937: import { spawn } from "child_process"; L12938: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]); ... L14647: try { L14648: creds = JSON.parse(fs3.readFileSync(credsPath, "utf8")); L14649: } catch { ... L37125: args.stdout( L37126: `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")} L37127: gateway: ${d.gatewayUrl}

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.jsView on unpkg · L2163

29215Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L29215: ); L29216: this.context.stdout.write( L29217: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L29223: // src/commands/open.ts L29224: import { spawn as spawn5 } from "child_process"; L29225: import { Command as Command55, Option as Option52 } from "clipanion"; ... L29229: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L29230: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L29231: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L29215

Source & flagged code

7 flagged

dist/cli.jsView file

130Source sends the broad process environment to a literal external destination. L130: try { L131: const obj2 = JSON.parse(raw); L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0) ... L343: // ../../packages/github-app-auth/dist/esm/jwt.js L344: import { createSign, createPrivateKey } from "crypto"; L345: function signAppJwt(args) { ... L356: sign.update(unsigned); L357: sign.end(); L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L461: const appJwt = signAppJwt({ appId, privateKeyPem }); L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L130

12936init_errors(); L12937: import { spawn } from "child_process"; L12938: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12936

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${appJwt}`, Authorization: `Bearer ${token.token}`, headers: { Authorization: `Bearer ${token.token}` } headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

29215); L29216: this.context.stdout.write( L29217: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L29223: // src/commands/open.ts L29224: import { spawn as spawn5 } from "child_process"; L29225: import { Command as Command55, Option as Option52 } from "clipanion"; ... L29229: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L29230: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L29231: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L29215

130try { L131: const obj2 = JSON.parse(raw); L132: if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0) ... L343: // ../../packages/github-app-auth/dist/esm/jwt.js L344: import { createSign, createPrivateKey } from "crypto"; L345: function signAppJwt(args) { ... L356: sign.update(unsigned); L357: sign.end(); L358: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L461: const appJwt = signAppJwt({ appId, privateKeyPem }); L462: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L463: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L130

2163} L2164: throw new Error("`fetch` is not defined as a global; Either pass `fetch` to the client, `new OpenAI({ fetch })` or polyfill the global, `globalThis.fetch = fetch`"); L2165: } ... L12936: init_errors(); L12937: import { spawn } from "child_process"; L12938: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]); ... L14647: try { L14648: creds = JSON.parse(fs3.readFileSync(credsPath, "utf8")); L14649: } catch { ... L37125: args.stdout( L37126: `${colors.success("\u2705 The platform is live and your local tools are pointed at it.")} L37127: gateway: ${d.gatewayUrl}

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.jsView on unpkg · L2163

29215Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L29215: ); L29216: this.context.stdout.write( L29217: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L29223: // src/commands/open.ts L29224: import { spawn as spawn5 } from "child_process"; L29225: import { Command as Command55, Option as Option52 } from "clipanion"; ... L29229: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L29230: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L29231: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L29215