@m8t-stack/cli@0.2.80

CLI for managing m8t deployments on Azure / Microsoft Agent Foundry

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

No concrete malicious or install-time attack chain was found. The package nevertheless performs first-party remote companion installation with login persistence during user-invoked platform setup.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running m8t bootstrap completion or m8t companion install on macOS/Windows.

Impact

Persistent execution of a release-channel desktop binary for the current user.

Mechanism

remote companion download followed by start-at-login registration

AI rationale

No concrete malicious or install-time attack chain was found. The package nevertheless performs first-party remote companion installation with login persistence during user-invoked platform setup.

Evidence

package.jsondist/cli.js~/.m8t/companion~/Library/LaunchAgents/com.m8t.companion.plistHKCU\Software\Microsoft\Windows\CurrentVersion\Run

Network endpoints2

github.com/m8t-labs/m8t-releases/releases/latest/download/manifest.jsongithub.com/m8t-labs/m8t-releases/releases/download/

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/cli.js downloads a desktop companion from the release channel.
The companion is set to start at login via LaunchAgents or HKCU Run.
bootstrap finalization automatically converges the companion on supported hosts.
The fetched archive is hash-checked, but the hash comes from the same remote manifest.

Evidence against

package.json has no preinstall/install/postinstall hook.
dist/cli.js only runs when the m8t CLI is invoked.
Companion installation is m8t-owned and is exposed as an explicit command.
Telemetry enrollment and Azure-token submission are explicit, disclosed commands.
No credential harvesting or unrelated outbound receiver was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/cli.jsView file

135Source sends the broad process environment to a literal external destination. L135: try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L270: // ../../packages/github-app-auth/dist/esm/jwt.js L271: import { createSign, createPrivateKey } from "crypto"; L272: function signAppJwt(args) { ... L283: sign.update(unsigned); L284: sign.end(); L285: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L379: const appJwt = signAppJwt({ appId, privateKeyPem }); L380: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L381: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L135

12844init_errors(); L12845: import { spawn } from "child_process"; L12846: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12844

26521); L26522: this.context.stdout.write( L26523: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26529: // src/commands/open.ts L26530: import { spawn as spawn5 } from "child_process"; L26531: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26535: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26536: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26537: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L26521

135try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L270: // ../../packages/github-app-auth/dist/esm/jwt.js L271: import { createSign, createPrivateKey } from "crypto"; L272: function signAppJwt(args) { ... L283: sign.update(unsigned); L284: sign.end(); L285: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L379: const appJwt = signAppJwt({ appId, privateKeyPem }); L380: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L381: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L135

26521Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L26521: ); L26522: this.context.stdout.write( L26523: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26529: // src/commands/open.ts L26530: import { spawn as spawn5 } from "child_process"; L26531: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26535: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26536: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26537: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L26521

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L135

12844init_errors(); L12845: import { spawn } from "child_process"; L12846: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12844

Findings

1 Critical5 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @m8t-stack/cli@0.2.80.

See all versions of @m8t-stack/cli for other recorded verdicts.

Review the evidence and your use of @m8t-stack/cli@0.2.80 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-08 10:29:03.287Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.