registry / @m8t-stack/cli / 0.2.73
@m8t-stack/cli@0.2.73
CLI for managing m8t deployments on Azure / Microsoft Agent Foundry
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner's command-output/exfiltration characterization is not supported by source inspection: the package is a bundled Azure deployment CLI with explicit command handlers and no install lifecycle execution. Its telemetry and companion behaviors are disclosed, command-scoped, and package-aligned.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs an m8t deployment, telemetry, or companion command.
Impact
Can modify the user's selected Azure, GitHub, local m8t, or companion resources as requested by commands.
Mechanism
User-invoked Azure/GitHub/platform management CLI
AI rationale
The scanner's command-output/exfiltration characterization is not supported by source inspection: the package is a bundled Azure deployment CLI with explicit command handlers and no install lifecycle execution. Its telemetry and companion behaviors are disclosed, command-scoped, and package-aligned.
Evidence
package.jsondist/cli.jsREADME.md
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js has an explicit telemetry enroll command that POSTs an Entra token to the m8t ingest host.
- dist/cli.js can download and install a desktop companion, including login startup, only through CLI bootstrap/companion commands.
Evidence against
- package.json has no preinstall, install, or postinstall hook; prepublishOnly only builds for publishing.
- dist/cli.js runs through registered user-invoked CLI commands, not import-time setup.
- Telemetry enrollment sends only schema/contact options and an Azure proof token; it is an explicit command.
- Companion downloads are SHA-256 checked and installed only through explicit/bootstrap deployment flows.
- child_process use invokes declared tools such as az, git, tar, gh, and companion binaries for CLI operations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcedist/cli.jsView file
124Source sends the broad process environment to a literal external destination.
L124: try {
L125: const obj = JSON.parse(raw);
L126: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0)
...
L240: // ../../packages/github-app-auth/dist/esm/jwt.js
L241: import { createSign, createPrivateKey } from "crypto";
L242: function signAppJwt(args) {
...
L253: sign.update(unsigned);
L254: sign.end();
L255: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url");
...
L349: const appJwt = signAppJwt({ appId, privateKeyPem });
L350: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
L351: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L12412814init_errors();
L12815: import { spawn } from "child_process";
L12816: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
High
26353);
L26354: this.context.stdout.write(
L26355: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L26361: // src/commands/open.ts
L26362: import { spawn as spawn5 } from "child_process";
L26363: import { Command as Command51, Option as Option48 } from "clipanion";
...
L26367: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L26368: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L26369: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
Findings
1 Critical5 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @m8t-stack/cli@0.2.73.
See all versions of @m8t-stack/cli for other recorded verdicts.
- Review the evidence and your use of @m8t-stack/cli@0.2.73 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.