@markus-global/cli@0.9.8
Markus — AI Digital Workforce Platform
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a real unrestricted credential-forwarding capability, which warrants a warning. There is no source evidence of automatic installation behavior or a concealed default exfiltration endpoint.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user or agent launches the Markus Hub connector and invokes a Hub operation.
Impact
A locally configured untrusted Hub endpoint could receive the existing Hub bearer token.
Mechanism
The connector reads ~/.markus/hub-token, obtains hub.url from ~/.markus/markus.json, and places the token in an Authorization header for fetch without validating the configured host.
AI rationale
The package contains a real unrestricted credential-forwarding capability, which warrants a warning. There is no source evidence of automatic installation behavior or a concealed default exfiltration endpoint.
Evidence
templates/skills/markus-hub-connector/server.mjsdist/commands/start.js~/.markus/markus.json~/.markus/hub-token
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- A shipped MCP-server template reads the Markus Hub token and sends it as a bearer credential.
- The request destination is taken directly from the user's hub URL configuration, with no host allowlist or destination validation.
- The start command also reads the Hub token and passes it with a configurable Hub URL to remote-access code.
- The manifest has no npm lifecycle hooks, so this is not install-time behavior.
Evidence against
- The credential-bearing template is a separately launched MCP server, not an npm lifecycle script.
- The manifest exposes a user-invoked CLI command and declares no preinstall, install, or postinstall hook.
- The browser helper only opens a supplied URL after a local health check.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
11 flaggeddist/utils/browser.jsView file
4*/
L5: import { exec } from 'node:child_process';
L6: import { get as httpGet } from 'node:http';
High
Child Process
Package source references child process execution.
dist/utils/browser.jsView on unpkg · L44*/
L5: import { exec } from 'node:child_process';
L6: import { get as httpGet } from 'node:http';
L7: import { platform } from 'node:os';
L8: export function openBrowser(url) {
L9: if (process.env['NO_BROWSER'])
L10: return;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/utils/browser.jsView on unpkg · L4dist/commands/update.jsView file
40stdio: 'inherit',
L41: shell: true,
L42: });
High
Shell
Findings
7 High6 Medium7 Low
HighChild Processdist/utils/browser.js
HighShelldist/commands/update.js
HighSame File Env Network Executiondist/utils/browser.js
HighShips High Entropy Blobdist/markus-browser-extension.zip
HighSemantic Analysis Limiteddist/web-ui/assets/DeliverableShareModal-DAR6-GIg.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/web-ui/assets/chunk-AQP2D5EJ-CvHiJGw_.js
HighPrevious Version Dangerous Deltadist/commands/start.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/markus-browser-extension.zip
MediumOversized Source Filedist/web-ui/assets/plantuml-DezRDxd4.js
Medium
Affected versions and remediation
This report applies to @markus-global/cli@0.9.8.
See all versions of @markus-global/cli for other recorded verdicts.
- Review the evidence and your use of @markus-global/cli@0.9.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.