@m8t-stack/cli@0.2.75: Clean npm security report (Allow)

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Static hints conflate legitimate CLI management behavior with exfiltration. Source inspection found no install-time execution, covert credential harvesting, or unconsented foreign control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs m8t deployment, bootstrap, telemetry, or companion commands.

Impact

Can modify the user's selected Azure/GitHub resources and install a same-product desktop companion with login startup after explicit CLI use.

Mechanism

User-invoked cloud management, authenticated API calls, and verified companion installation.

AI rationale

Static hints conflate legitimate CLI management behavior with exfiltration. Source inspection found no install-time execution, covert credential harvesting, or unconsented foreign control-surface mutation.

Evidence

package.jsondist/cli.jsREADME.md

Network endpoints5

api.github.commanagement.azure.comai.azure.comgithub.com/m8t-labs/m8t/releases/latest/download/manifest.jsonm8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

package.json has no install/preinstall/postinstall hook; only prepublishOnly builds.
dist/cli.js exposes network and shell actions through named CLI commands, not import/install execution.
Azure CLI invocation uses fixed executable/argument arrays and redacts secret-like arguments in errors.
Companion download is explicit/bootstrapping behavior and SHA-256 verifies the fetched release artifact.
Telemetry enrollment is an explicit command; its payload is limited to optional contact fields and a stated identity proof.
README.md documents deployment, companion, and local-state behavior consistent with the bundled code.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.30 MB of source, external domains: acc.services.ai.azure.com, ai.azure.com, aka.ms, api.github.com, api.githubcopilot.com, api.openai.com, auth.openai.com, companion.invalid, docs.expo.dev, ghcr.io, github.com, graph.microsoft.com, help.openai.com, learn.microsoft.com, m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io, m8t-kv.vault.azure.net, management.azure.com, myaccount.services.ai.azure.com, portal.azure.com, vault.azure.net, www.apple.com

Source & flagged code

5 flagged

dist/cli.jsView file

135Source sends the broad process environment to a literal external destination. L135: try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L260: // ../../packages/github-app-auth/dist/esm/jwt.js L261: import { createSign, createPrivateKey } from "crypto"; L262: function signAppJwt(args) { ... L273: sign.update(unsigned); L274: sign.end(); L275: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L369: const appJwt = signAppJwt({ appId, privateKeyPem }); L370: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L371: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L135

12834init_errors(); L12835: import { spawn } from "child_process"; L12836: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12834

26458); L26459: this.context.stdout.write( L26460: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26466: // src/commands/open.ts L26467: import { spawn as spawn5 } from "child_process"; L26468: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26472: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26473: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26474: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L26458

135try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L260: // ../../packages/github-app-auth/dist/esm/jwt.js L261: import { createSign, createPrivateKey } from "crypto"; L262: function signAppJwt(args) { ... L273: sign.update(unsigned); L274: sign.end(); L275: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L369: const appJwt = signAppJwt({ appId, privateKeyPem }); L370: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L371: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L135

26458Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L26458: ); L26459: this.context.stdout.write( L26460: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26466: // src/commands/open.ts L26467: import { spawn as spawn5 } from "child_process"; L26468: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26472: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26473: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26474: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L26458

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

135Source sends the broad process environment to a literal external destination. L135: try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L260: // ../../packages/github-app-auth/dist/esm/jwt.js L261: import { createSign, createPrivateKey } from "crypto"; L262: function signAppJwt(args) { ... L273: sign.update(unsigned); L274: sign.end(); L275: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L369: const appJwt = signAppJwt({ appId, privateKeyPem }); L370: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L371: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L135

12834init_errors(); L12835: import { spawn } from "child_process"; L12836: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12834

26458); L26459: this.context.stdout.write( L26460: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26466: // src/commands/open.ts L26467: import { spawn as spawn5 } from "child_process"; L26468: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26472: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26473: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26474: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

Findings

1 Critical5 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code