registry / @m8t-stack/cli / 0.2.16
@m8t-stack/cli@0.2.16
CLI for managing m8t-stack deployments on Azure / Microsoft Agent Foundry
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows a legitimate CLI for m8t-stack Azure/Foundry/GitHub workflows; suspicious primitives are package-aligned and user-invoked. There is no install-time execution or concrete exfiltration/persistence/control-hijack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
user runs m8t CLI commands
Impact
No unconsented behavior identified by static inspection.
Mechanism
user-invoked cloud deployment and configuration automation
AI rationale
Static inspection shows a legitimate CLI for m8t-stack Azure/Foundry/GitHub workflows; suspicious primitives are package-aligned and user-invoked. There is no install-time execution or concrete exfiltration/persistence/control-hijack behavior.
Evidence
package.jsondist/cli.jsREADME.md~/.m8t-stack/cli-config.yaml~/.m8t-stack/config.yaml~/.m8t-stack/github-app.json~/.m8t-stack/repo-root
Network endpoints5
api.github.commanagement.azure.comai.azure.com/.defaultapi.githubcopilot.com/mcpapi.openai.com/v1
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install/postinstall hooks; only prepublishOnly build script
- dist/cli.js entrypoint only runs Clipanion CLI commands via main()
- child_process usage is for user-invoked az/gh/git/browser commands
- network calls are aligned to Azure, GitHub, OpenAI SDK, and configured m8t gateway operations
- local writes are user-invoked config/state under ~/.m8t-stack or temp dirs
- no credential harvesting, persistence, destructive import-time behavior, or reviewer prompt manipulation found
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourcedist/cli.jsView file
11456init_errors();
L11457: import { spawn } from "child_process";
L11458: function runAz(args) {
High
19660);
L19661: this.context.stdout.write(
L19662: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L19668: // src/commands/open.ts
L19669: import { spawn as spawn5 } from "child_process";
L19670: import { Command as Command42, Option as Option40 } from "clipanion";
...
L19674: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L19675: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L19676: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L19660Findings
3 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @m8t-stack/cli@0.2.16.
See all versions of @m8t-stack/cli for other recorded verdicts.
- Review the evidence and your use of @m8t-stack/cli@0.2.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.