registry / @m8t-stack/cli / 0.2.79
@m8t-stack/cli@0.2.79
CLI for managing m8t deployments on Azure / Microsoft Agent Foundry
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner conflates explicit CLI functionality with automatic compromise. Source inspection found no lifecycle execution or concrete unconsented exfiltration/persistence chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit `m8t` subcommands such as telemetry enrollment, bootstrap, or companion install.
Impact
The invoked commands can manage the user's Azure resources and install a user-requested desktop companion; no malicious chain was established.
Mechanism
User-directed Azure/GitHub deployment management and optional companion installation.
AI rationale
The scanner conflates explicit CLI functionality with automatic compromise. Source inspection found no lifecycle execution or concrete unconsented exfiltration/persistence chain.
Evidence
package.jsondist/cli.js
Network endpoints3
m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.iomanagement.azure.comapi.github.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js:34085 posts an Azure ARM token to the m8t telemetry enrollment endpoint, but only under `m8t telemetry enroll`.
- dist/cli.js:31599 implements login-item persistence, reachable only through explicit `m8t companion install`/repair commands.
Evidence against
- package.json has only prepublishOnly; no install, postinstall, or preinstall hook.
- dist/cli.js is a CLI entrypoint and calls main only after the user invokes `m8t`.
- Telemetry enrollment is an explicit command and source discloses its payload and optional contact fields.
- Companion download verifies a release-pinned SHA-256 before extraction.
- No source evidence of credential harvesting, hidden exfiltration, eval, or foreign AI-agent configuration writes.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/cli.jsView file
135Source sends the broad process environment to a literal external destination.
L135: try {
L136: const obj = JSON.parse(raw);
L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0)
...
L260: // ../../packages/github-app-auth/dist/esm/jwt.js
L261: import { createSign, createPrivateKey } from "crypto";
L262: function signAppJwt(args) {
...
L273: sign.update(unsigned);
L274: sign.end();
L275: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url");
...
L369: const appJwt = signAppJwt({ appId, privateKeyPem });
L370: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`;
L371: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L13512834init_errors();
L12835: import { spawn } from "child_process";
L12836: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
High
26511);
L26512: this.context.stdout.write(
L26513: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n")
...
L26519: // src/commands/open.ts
L26520: import { spawn as spawn5 } from "child_process";
L26521: import { Command as Command51, Option as Option48 } from "clipanion";
...
L26525: var OPEN_TARGETS = ["webapp", "foundry", "portal"];
L26526: var FOUNDRY_PORTAL_URL = "https://ai.azure.com";
L26527: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {
Findings
1 Critical5 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @m8t-stack/cli@0.2.79.
See all versions of @m8t-stack/cli for other recorded verdicts.
- Review the evidence and your use of @m8t-stack/cli@0.2.79 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.