@m8t-stack/cli@0.2.81

CLI for managing m8t deployments on Azure / Microsoft Agent Foundry

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The scanner’s execution/exfiltration signals map to documented, explicitly invoked Azure-management, telemetry, and companion-install features. No install-time execution or concrete unconsented malicious chain was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs commands such as `m8t telemetry enroll` or `m8t companion install`.

Impact

Can enroll telemetry or install a per-user companion only after the corresponding user command.

Mechanism

User-invoked Azure platform management, telemetry enrollment, and companion installation.

AI rationale

Evidence

package.jsonREADME.mddist/cli.js~/.m8t~/Library/LaunchAgents/com.m8t.companion.plistHKCU\Software\Microsoft\Windows\CurrentVersion\Run

Network endpoints2

m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.iogithub.com/m8t-labs/m8t-releases/releases

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

`dist/cli.js` telemetry enroll posts an Azure access token to the m8t ingest endpoint, but only under `m8t telemetry enroll`.
`dist/cli.js` companion install downloads a release asset and registers a per-user login item, only under documented companion commands.

Evidence against

`package.json` has no install, preinstall, or postinstall hook; `prepublishOnly` only builds before publishing.
`dist/cli.js` registers side-effecting operations as explicit CLI subcommands.
`README.md` documents companion installation, login registration, and release-digest verification.
Companion downloads are size-limited and SHA-256 checked before unpacking.
No unconsented import-time execution, credential harvesting, or foreign AI-agent configuration mutation found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

5 flagged

dist/cli.jsView file

135Source sends the broad process environment to a literal external destination. L135: try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L270: // ../../packages/github-app-auth/dist/esm/jwt.js L271: import { createSign, createPrivateKey } from "crypto"; L272: function signAppJwt(args) { ... L283: sign.update(unsigned); L284: sign.end(); L285: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L379: const appJwt = signAppJwt({ appId, privateKeyPem }); L380: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L381: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L135

12844init_errors(); L12845: import { spawn } from "child_process"; L12846: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12844

26521); L26522: this.context.stdout.write( L26523: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26529: // src/commands/open.ts L26530: import { spawn as spawn5 } from "child_process"; L26531: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26535: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26536: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26537: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L26521

135try { L136: const obj = JSON.parse(raw); L137: if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0) ... L270: // ../../packages/github-app-auth/dist/esm/jwt.js L271: import { createSign, createPrivateKey } from "crypto"; L272: function signAppJwt(args) { ... L283: sign.update(unsigned); L284: sign.end(); L285: const signature = sign.sign(createPrivateKey(args.privateKeyPem)).toString("base64url"); ... L379: const appJwt = signAppJwt({ appId, privateKeyPem }); L380: const url = `https://api.github.com/app/installations/${args.installationId}/access_tokens`; L381: const repoName = args.repository.includes("/") ? args.repository.split("/", 2)[1] : args.repository;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L135

26521Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js L26521: ); L26522: this.context.stdout.write( L26523: colors.dim("next: run 'm8t doctor' to verify gateway + data-plane access.\n") ... L26529: // src/commands/open.ts L26530: import { spawn as spawn5 } from "child_process"; L26531: import { Command as Command51, Option as Option48 } from "clipanion"; ... L26535: var OPEN_TARGETS = ["webapp", "foundry", "portal"]; L26536: var FOUNDRY_PORTAL_URL = "https://ai.azure.com"; L26537: function azurePortalRgUrl(tenantId, subscriptionId, resourceGroup) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L26521

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L135

12844init_errors(); L12845: import { spawn } from "child_process"; L12846: var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12844

Findings

1 Critical5 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @m8t-stack/cli@0.2.81.

See all versions of @m8t-stack/cli for other recorded verdicts.

Review the evidence and your use of @m8t-stack/cli@0.2.81 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-09 19:30:05.041Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.