registry / AI-agent control-surface risk / @mdevs/mai-cli

@mdevs/mai-cli

The mAI agent, directly in your terminal!

This report shows the evidence for @mdevs/mai-cli@1.0.20. 3 of 8 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package performs automatic postinstall registration of an external Chrome MCP bridge and permission changes. That is a concrete unconsented AI-agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation, through postinstall.

Impact

An installed package can add or alter browser-agent integration outside the consumer's explicit command.

Mechanism

Automatic external MCP bridge registration and permission modification.

Policy narrative

The manifest runs setup-chrome-mcp.mjs during npm postinstall. The script resolves a separately packaged MCP bridge, then automatically runs fix-permissions and register --browser chrome. This is an unconsented installation-time change to an AI-agent/browser integration rather than an explicit CLI setup action.

AI rationale

The package performs automatic postinstall registration of an external Chrome MCP bridge and permission changes. That is a concrete unconsented AI-agent control-surface mutation.

Evidence

package.jsonscripts/setup-chrome-mcp.mjsscripts/run-parallel.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically launches Chrome MCP setup.
That setup resolves an external bridge and runs its register command for Chrome.
It also runs a permission-changing command without an explicit user action.

Evidence against

The separate postinstall downloader only targets a ripgrep release URL and writes inside the package.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

Manifest

NoLicense

scanned 629 file(s), 10.4 MB of source, external domains: 1.1.1.1, 127.0.0.1, 169.254.169.254, 169.254.170.2, a.co, aka.ms, anthropic.com, api-staging.anthropic.com, api.anthropic.com, api.deepseek.com, app.corridor.dev, aws.amazon.com, clau.de, cli.github.com, console.anthropic.com, docs.anthropic.com, docs.aws.amazon.com, docs.expo.dev, evil.com, example.com, fonts.googleapis.com, generativelanguage.googleapis.com, ghproxy.net, git-scm.com, github.com, grpc.io, ilinkai.weixin.qq.com, json-schema.org, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.de, login.microsoftonline.us, login.windows-ppe.net, mai-devs.vercel.app, mai-docs.vercel.app, mai.val.run, mcp-proxy-staging.anthropic.com, mcp-proxy.anthropic.com, mcp.exa.ai, mcp.sentry.dev, metcoder.dev, novac2c.cdn.weixin.qq.com, opencollective.com, platform.claude.com, platform.staging.ant.dev, portal.sso, portal.sso-fips, raw.githubusercontent.com, react-native.canny.io, react.dev

Source & flagged code

26 flagged

package.jsonView file

Lines 45-85json

45 "build:vite": "vite build && bun run scripts/post-build.ts",

46 "build:vite:only": "vite build",

47 "build:bun": "bun run build.ts",

48 "dev": "bun run scripts/dev.ts",

49 "dev:inspect": "bun run scripts/dev-debug.ts",

50 "prepublishOnly": "bun run build:vite",

51 "lint": "biome lint .",

52 "lint:fix": "biome lint --fix .",

53 "format": "biome format --write .",

54 "check": "biome check .",

55 "check:fix": "biome check --fix .",

56 "prepare": "husky",

57 "test": "bun test",

58 "test:production": "bun run scripts/production-test.ts",

59 "test:production:offline": "bun run scripts/production-test.ts --offline",

60 "test:production:verbose": "bun run scripts/production-test.ts --verbose",

61 "test:production:bun": "bun run scripts/production-test.ts --bun",

62 "check:bundle": "bun run scripts/check-bundle-integrity.ts",

63 "check:unused": "knip-bun",

64 "health": "bun run scripts/health-check.ts",

65 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L65

66 "docs:dev": "npx mintlify dev",

67 "typecheck": "tsc --noEmit",

68 "precheck": "bun run typecheck && bun run check:fix && bun test",

69 "rcs": "bun run scripts/rcs.ts",

70 "reset:api": "node --env-file=.env scripts/reset-api-usage.js",

71 "reset:mai": "node --env-file=.env scripts/reset-mai-usage.js"

72 },

73 "dependencies": {

74 "@agentclientprotocol/sdk": "^0.19.0",

75 "@claude-code-best/mcp-chrome-bridge": "^3.0.1",

76 "highlight.js": "^11.11.1",

77 "ws": "^8.20.0"

78 },

79 "devDependencies": {

80 "@alcalzone/ansi-tokenize": "^0.3.0",

81 "@ant/claude-for-chrome-mcp": "workspace:*",

82 "@ant/computer-use-input": "workspace:*",

83 "@ant/computer-use-mcp": "workspace:*",

84 "@ant/computer-use-swift": "workspace:*",

85 "@ant/model-provider": "workspace:*",

dist/chunks/exit-BbAyh7iz.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{Rn as t}from"./src-r4yz4Txc.js";import{t as n}from"./jsx-runtime-D-D469L8.js";import{dl as r,fl as i}from

scripts/postinstall.cjsView file

Lines 2-42javascript

2/**

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

12 */

dist/chunks/instinctParser-B3kl9V1w.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{createHash as t}from"node:crypto";function n(){return i?{minConfidence:i.minConfidence??r.minConfidence,minClusterSize:i.minClusterSize??r.minClusterSize,llm:{...

dist/chunks/esm-CsGLyWmS.jsView file

Lines 1-21javascript

1import{i as e,n as t,o as n,t as r}from"./chunk-DR8-3Aex.js";import{n as i,t as a}from"./defineProperty-80gRi2ZW.js";import{n as o,t as s}from

dist/chunks/dist-es-DuAZyxJ02.jsView file

3- ECS container host 169.254.170.2 L4: - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:t})}}}));function y(e){return new t({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,quer... L5: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let l=new URL(t);_(l,e.logger);let d=i.create({requestTimeout:e.timeout??1e3,c...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

dist/chunks/bridgeMain-BBSHlt23.jsView file

1Cross-file remote execution chain: dist/chunks/bridgeMain-BBSHlt23.js spawns dist/chunks/debug-Cisktvhb.js; helper contains network access plus dynamic code execution. L1: import{d as e,s as t,u as n}from"./envUtils-BWeoiL4Y.js";import{Cn as r,In as i,Ln as a,t as o}from"./src-r4yz4Txc.js";import{M as s,Ms as c,Ns as l,S as u,js as d,l as f,z as p}fr... L2: `).filter(e=>e.length>0)}function Le(e){let t=e.write??(e=>process.stdout.write(e)),n=e.verbose,a=0,o=`idle`,s=`Ready`,l=``,u=``,f=``,p=``,m=``,h=``,g=null,_=[],v=!1,b=null,x=0,S=0... L3: `)){if(i.length===0){n++;continue}let e=r(i);n+=Math.max(1,Math.ceil(e/t))}return e.endsWith(` L4: `)&&n--,n}function M(e){t(e),a+=j(e)}function N(){a<=0||(y(`[bridge:ui] clearStatusLines count=${a}`),t(`\x1b[${a}A`),t(`\x1B[J`),a=0)}function F(e){N(),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-BBSHlt23.jsView on unpkg · L1

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-UyQxvIqQ.jsView file

•matchType = token_shingles matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/loadAgentsDir-Dt65bOMO.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 shingleOverlap = 43 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/loadAgentsDir-UyQxvIqQ.jsView on unpkg

•path = dist/chunks/loadAgentsDir-UyQxvIqQ.js kind = oversized_source_file sizeBytes = 4329139 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-UyQxvIqQ.jsView on unpkg

dist/chunks/createSSHSession-BHSorGb4.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/createSSHSession-cz2LbC-m.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/createSSHSession-BHSorGb4.jsView on unpkg

dist/chunks/dist-Cg1a1Exw.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/dist-Cg1a1Exw.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/dist-Cg1a1Exw.jsView on unpkg

dist/chunks/executor-D6F3IuTA.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/executor-0LskEQWE.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/executor-D6F3IuTA.jsView on unpkg

dist/chunks/open-CDditBQ-.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/open-CDditBQ-.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/open-CDditBQ-.jsView on unpkg

dist/chunks/REPL-DnHJofkV.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/REPL-Ce4YOPOK.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/REPL-DnHJofkV.jsView on unpkg

dist/chunks/cliLaunch-lSqbpipz.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/cliLaunch-BQLM_VtG.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cliLaunch-lSqbpipz.jsView on unpkg

dist/chunks/escHotkey-DzMWu-0q.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/escHotkey-DzMWu-0q.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/escHotkey-DzMWu-0q.jsView on unpkg

dist/chunks/insights-DydC1MGH.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/insights-C2o7asev.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/insights-DydC1MGH.jsView on unpkg

dist/chunks/SSETransport-Sj1hLbwN.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/SSETransport-CWRmwahP.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/SSETransport-Sj1hLbwN.jsView on unpkg

dist/chunks/bridgeMessaging-BVQPWW7V.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.19 matchedPath = dist/chunks/bridgeMessaging-SODsFdVN.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/bridgeMessaging-BVQPWW7V.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunks/exit-BbAyh7iz.jsView file

1import{n as e}from"./chunk-DR8-3Aex.js";import{Rn as t}from"./src-r4yz4Txc.js";import{t as n}from"./jsx-runtime-D-D469L8.js";import{dl as r,fl as i}from"./paths-lAtRt-7B.js";import...

High

Child Process

Package source references child process execution.

dist/chunks/exit-BbAyh7iz.js

Findings

1 Critical21 High8 Medium8 Low

CriticalBrowser Credential Phishingdist/chunks/esm-CsGLyWmS.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunks/exit-BbAyh7iz.js

HighShell

HighSame File Env Network Executiondist/chunks/esm-CsGLyWmS.js

HighCommand Output Exfiltrationdist/chunks/esm-CsGLyWmS.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs

HighCloud Metadata Accessdist/chunks/dist-es-DuAZyxJ02.js

HighInstall Named Payload Filescripts/postinstall.cjs

HighCross File Remote Execution Contextdist/chunks/bridgeMain-BBSHlt23.js

HighKnown Malware Source Similaritydist/chunks/createSSHSession-BHSorGb4.js

Affected versions and remediation

This report applies to @mdevs/mai-cli@1.0.20.

The versions list below shows the verdict for each recorded version.

Avoid installing @mdevs/mai-cli@1.0.20. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-31 07:31:38.595Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

8 known versions

1.0.20latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 31, 2026, 7:26 AM 1.0.19MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 27, 2026, 2:24 PM 1.0.18SuspiciousAgent extension lifecycle riskWarnPublishedAug 27, 2026, 11:22 AM 1.0.17MaliciousSoft block: AI-agent control surfaceBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code