@markus-global/cli@0.9.4
Markus — AI Digital Workforce Platform
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not malicious by source evidence: it has no install hooks or hidden credential-exfiltration chain. Its explicit cross-agent configuration capability warrants a warning under the stated policy.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `markus install openclaw` or another configured platform.
Impact
Writes an integration token and Markus endpoint to the selected platform's configuration; installs a platform skill.
Mechanism
Explicit external-agent installation and configuration
AI rationale
The package is not malicious by source evidence: it has no install hooks or hidden credential-exfiltration chain. Its explicit cross-agent configuration capability warrants a warning under the stated policy.
Evidence
package.jsondist/index.jsdist/commands/install-agent.jsdist/connector-service.jsconnectors/openclaw.jsondist/commands/update.js~/.openclaw/openclaw.json~/.openclaw/skills/openclaw-markus-skill~/.markus/app
Network endpoints2
localhost:8056github.com/markus-global/markus/releases/download/
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/commands/install-agent.js explicitly installs external agent CLIs and invokes their init commands.
- dist/connector-service.js writes Markus URL/token into external agent configs.
- connectors/openclaw.json targets ~/.openclaw/openclaw.json and installs a skill template.
- dist/commands/update.js downloads and replaces a user-invoked binary update.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- dist/index.js only registers command handlers; no install-time execution.
- Agent-platform writes occur only through explicit `markus install <platform>`.
- No source evidence of credential harvesting or covert exfiltration was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
12 flaggeddist/web-ui/assets/index-CDGrYm4a.jsView file
645`},p]}}const Xq=e=>({IMPORTANT:{scope:"meta",begin:"!important"},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:"number",begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\...
L646: ]`,w={scope:"string",variants:[h,p,g,x]},C={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[...
L647: https://github.com/highlightjs/highlight.js/issues/2277`),Rn=Ke,rn=vt),Ht===void 0&&(Ht=!0);const tr={code:rn,language:Rn};Ys("before:highlight",tr);const Mr=tr.result?tr.result:Ea...
High
Child Process
Package source references child process execution.
dist/web-ui/assets/index-CDGrYm4a.jsView on unpkg · L64510patternName = generic_password
severity = medium
line = 10
matchedText = `).repla...ent.
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/web-ui/assets/index-CDGrYm4a.jsView on unpkg · L1019patternName = generic_password
severity = medium
line = 19
matchedText = `,done:"...I v2
Medium
Findings
5 High10 Medium8 Low
HighChild Processdist/web-ui/assets/index-CDGrYm4a.js
HighShelldist/commands/update.js
HighSame File Env Network Executiondist/utils/browser.js
HighShips High Entropy Blobdist/markus-browser-extension.zip
HighPrevious Version Dangerous Deltadist/commands/start.js
MediumSecret Patterndist/web-ui/assets/index-CDGrYm4a.js
MediumDynamic Requiredist/web-ui/assets/viz-global-C_AyN6D9.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Compressed Blobdist/markus-browser-extension.zip
MediumOversized Source Filedist/web-ui/assets/plantuml-DezRDxd4.js
Affected versions and remediation
This report applies to @markus-global/cli@0.9.4.
See all versions of @markus-global/cli for other recorded verdicts.
- Review the evidence and your use of @markus-global/cli@0.9.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.