@m8t-stack/cli@0.2.78

CLI for managing m8t deployments on Azure / Microsoft Agent Foundry

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The scanner conflates expected privileged CLI behavior with exfiltration. Source inspection found no install-time execution, covert collection, or unconsented external control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User invokes m8t deployment, telemetry, agent-content, or companion commands.

Impact

Can modify the operator-selected m8t Azure/GitHub resources and install a first-party desktop companion when explicitly requested.

Mechanism

User-directed Azure/GitHub API calls and verified companion installation.

AI rationale

The scanner conflates expected privileged CLI behavior with exfiltration. Source inspection found no install-time execution, covert collection, or unconsented external control-surface mutation.

Evidence

package.jsondist/cli.jsREADME.md

Network endpoints4

api.github.commanagement.azure.comai.azure.comm8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

package.json has only prepublishOnly; no install lifecycle hook.
dist/cli.js executes CLI command dispatch, not hidden install-time work.
Network and Azure/GitHub token use implement named, user-invoked deployment and management commands.
Companion download verifies the release-pinned SHA-256 before unpacking.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.30 MB of source, external domains: acc.services.ai.azure.com, ai.azure.com, aka.ms, api.github.com, api.githubcopilot.com, api.openai.com, auth.openai.com, companion.invalid, docs.expo.dev, ghcr.io, github.com, graph.microsoft.com, help.openai.com, learn.microsoft.com, m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io, m8t-kv.vault.azure.net, management.azure.com, myaccount.services.ai.azure.com, portal.azure.com, vault.azure.net, www.apple.com

Source & flagged code

5 flagged

dist/cli.jsView file

135Source sends the broad process environment to a literal external destination. L135: try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L260: // ../../packages/github-app-auth/dist/esm/jwt.js L261: import { createSign, createPrivateKey } from "crypto"; L262: function signAppJwt(args) { ... L273: sign.update(unsigned); L274: sign.end(); L275: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L369: const appJwt = signAppJwt({ appId, privateKeyPem }); L370: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L371: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L135

12834init_errors(); L12835: import { spawn } from "child_process"; L12836: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12834

26511); L26512: this.context.stdout.write( L26513: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26519: // src/commands/open.ts L26520: import { spawn as spawn5 } from "child_process"; L26521: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26525: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26526: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26527: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L26511

135try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L260: // ../../packages/github-app-auth/dist/esm/jwt.js L261: import { createSign, createPrivateKey } from "crypto"; L262: function signAppJwt(args) { ... L273: sign.update(unsigned); L274: sign.end(); L275: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L369: const appJwt = signAppJwt({ appId, privateKeyPem }); L370: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L371: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L135

26511Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L26511: ); L26512: this.context.stdout.write( L26513: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26519: // src/commands/open.ts L26520: import { spawn as spawn5 } from "child_process"; L26521: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26525: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26526: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26527: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L26511

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L135

12834init_errors(); L12835: import { spawn } from "child_process"; L12836: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12834

Findings

1 Critical5 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @m8t-stack/cli@0.2.78.

See all versions of @m8t-stack/cli for other recorded verdicts.

Review the evidence and your use of @m8t-stack/cli@0.2.78 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-08 09:53:49.430Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.