registry / @markus-global/cli / 0.9.3
@markus-global/cli@0.9.3
Markus — AI Digital Workforce Platform
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection found no lifecycle scripts or covert execution. The scanner signals correspond to disclosed, user-invoked product functionality.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Explicit user commands such as `markus update` or `markus install <platform>`.
Impact
No confirmed malicious attack surface.
Mechanism
User-invoked CLI update, agent integration, and local browser automation.
AI rationale
Direct inspection found no lifecycle scripts or covert execution. The scanner signals correspond to disclosed, user-invoked product functionality.
Evidence
package.jsondist/index.jsdist/commands/update.jsdist/commands/install-agent.jsdist/connector-service.jsdist/markus-browser-extension.zip
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no lifecycle hooks.
- dist/index.js only loads command handlers after invoking the CLI.
- dist/commands/update.js runs only under explicit `markus update`.
- dist/commands/install-agent.js writes external configs only after explicit `markus install <platform>`.
- dist/markus-browser-extension.zip contains a loopback-only bridge to ws://127.0.0.1:9333.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
CopyleftLicense
Source & flagged code
12 flaggeddist/web-ui/assets/index-DipPqBFp.jsView file
645`},p]}}const Xq=e=>({IMPORTANT:{scope:"meta",begin:"!important"},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:"number",begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\...
L646: ]`,w={scope:"string",variants:[h,p,g,x]},C={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[...
L647: https://github.com/highlightjs/highlight.js/issues/2277`),Rn=Ke,rn=vt),Ht===void 0&&(Ht=!0);const tr={code:rn,language:Rn};Ys("before:highlight",tr);const Mr=tr.result?tr.result:Ea...
High
Child Process
Package source references child process execution.
dist/web-ui/assets/index-DipPqBFp.jsView on unpkg · L64510patternName = generic_password
severity = medium
line = 10
matchedText = `).repla...ent.
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/web-ui/assets/index-DipPqBFp.jsView on unpkg · L1019patternName = generic_password
severity = medium
line = 19
matchedText = `,done:"...I v2
Medium
Findings
5 High10 Medium8 Low
HighChild Processdist/web-ui/assets/index-DipPqBFp.js
HighShelldist/commands/update.js
HighSame File Env Network Executiondist/utils/browser.js
HighShips High Entropy Blobdist/markus-browser-extension.zip
HighPrevious Version Dangerous Deltadist/commands/start.js
MediumSecret Patterndist/web-ui/assets/index-DipPqBFp.js
MediumDynamic Requiredist/web-ui/assets/viz-global-C_AyN6D9.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Compressed Blobdist/markus-browser-extension.zip
MediumOversized Source Filedist/web-ui/assets/plantuml-DezRDxd4.js
Affected versions and remediation
This report applies to @markus-global/cli@0.9.3.
See all versions of @markus-global/cli for other recorded verdicts.
- Review the evidence and your use of @markus-global/cli@0.9.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.