@m8t-stack/cli@0.2.71: Persistence – npm package flagged

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

No concrete malicious install-time or stealth-exfiltration chain was established. The explicit persisted companion installer and token-bearing telemetry enrollment remain high-impact capabilities requiring a warning.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `m8t telemetry enroll`, `m8t companion install`, or bootstrap status completion.

Impact

A user-authorized command can disclose an Azure bearer token to the vendor endpoint or install and persist a downloaded executable.

Mechanism

user-invoked cloud administration, telemetry enrollment, and persisted companion installation

AI rationale

No concrete malicious install-time or stealth-exfiltration chain was established. The explicit persisted companion installer and token-bearing telemetry enrollment remain high-impact capabilities requiring a warning.

Evidence

package.jsonREADME.mddist/cli.js~/.m8t/companion~/Applications/m8t Companion.app~/Library/LaunchAgents/com.m8t.companion.plistHKCU\Software\Microsoft\Windows\CurrentVersion\Run

Network endpoints2

m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io/api/ingest/enrollgithub.com/m8t-labs/m8t/releases/latest/download/manifest.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/cli.js: telemetry enroll POSTs an Azure access token to the m8t ingest endpoint.
dist/cli.js: companion install downloads, unpacks, and launches a remote release artifact.
dist/cli.js: companion install enables macOS LaunchAgent or Windows Run-key persistence.
dist/cli.js: bootstrap status flow can invoke companion installation.

Evidence against

package.json has no preinstall, install, or postinstall hook; prepublishOnly only builds.
All observed sensitive/network actions are reached through named CLI commands.
Remote companion assets are size- and SHA-256-checked before installation.
Telemetry command disclosure states contact fields are opt-in.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/cli.jsView file

124Source sends the broad process environment to a literal external destination. L124: try { L125: const obj = JSON.parse(raw); L126: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L240: // ../../packages/github-app-auth/dist/esm/jwt.js L241: import { createSign, createPrivateKey } from "crypto"; L242: function signAppJwt(args) { ... L253: sign.update(unsigned); L254: sign.end(); L255: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L349: const appJwt = signAppJwt({ appId, privateKeyPem }); L350: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L351: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L124

12814init_errors(); L12815: import { spawn } from "child_process"; L12816: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12814

25800); L25801: this.context.stdout.write( L25802: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L25808: // src/commands/open.ts L25809: import { spawn as spawn5 } from "child_process"; L25810: import { Command as Command49, Option as Option46 } from "clipanion"; ... L25814: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L25815: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L25816: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L25800

124try { L125: const obj = JSON.parse(raw); L126: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L240: // ../../packages/github-app-auth/dist/esm/jwt.js L241: import { createSign, createPrivateKey } from "crypto"; L242: function signAppJwt(args) { ... L253: sign.update(unsigned); L254: sign.end(); L255: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L349: const appJwt = signAppJwt({ appId, privateKeyPem }); L350: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L351: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L124

25800Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L25800: ); L25801: this.context.stdout.write( L25802: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L25808: // src/commands/open.ts L25809: import { spawn as spawn5 } from "child_process"; L25810: import { Command as Command49, Option as Option46 } from "clipanion"; ... L25814: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L25815: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L25816: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L25800

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

124Source sends the broad process environment to a literal external destination. L124: try { L125: const obj = JSON.parse(raw); L126: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L240: // ../../packages/github-app-auth/dist/esm/jwt.js L241: import { createSign, createPrivateKey } from "crypto"; L242: function signAppJwt(args) { ... L253: sign.update(unsigned); L254: sign.end(); L255: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L349: const appJwt = signAppJwt({ appId, privateKeyPem }); L350: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L351: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L124

12814init_errors(); L12815: import { spawn } from "child_process"; L12816: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12814

25800); L25801: this.context.stdout.write( L25802: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L25808: // src/commands/open.ts L25809: import { spawn as spawn5 } from "child_process"; L25810: import { Command as Command49, Option as Option46 } from "clipanion"; ... L25814: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L25815: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L25816: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

Findings

1 Critical5 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code