@mdevs/mai-cli@1.0.18

The mAI agent, directly in your terminal!

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a Claude Code-style AI CLI whose automatic postinstall registers a first-party Chrome MCP native host, which is guarded platform extension setup rather than a concrete malicious chain. Scanner similarity labels on dist chunks are noisy leftovers of that fork and do not show hidden exfiltration or foreign-agent hijack in the shipped install scripts.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with npm or bun, which runs the postinstall script.

Impact

Chrome native-messaging state can change without a separate setup command; a skip environment variable exists but is off by default.

Mechanism

Automatic Chrome native-host registration plus optional ripgrep download

AI rationale

Evidence

package.jsonscripts/setup-chrome-mcp.mjsscripts/postinstall.cjsscripts/run-parallel.mjsdist/vendor/ripgrep

Network endpoints2

github.com/microsoft/ripgrep-prebuiltghproxy.net

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json postinstall automatically runs both the ripgrep vendor script and Chrome MCP setup.
Unless CLAUDE_CODE_SKIP_CHROME_MCP_SETUP=1, setup-chrome-mcp.mjs runs fix-permissions, register --browser chrome, and doctor via @claude-code-best/mcp-chrome-bridge.
Bundled Chrome setup writes a native host manifest named com.anthropic.claude_code_browser_extension.json when that feature is enabled.

Evidence against

This package is an AI terminal CLI; Chrome MCP and ripgrep match that product.
scripts/postinstall.cjs only vendors microsoft/ripgrep-prebuilt into this package tree and treats download failure as non-fatal.
mai.val.run login and API-key storage run only after the user starts mai and logs in.
There is no runtime self-dependency, and the shipped install scripts do not write Cursor, Copilot, or other foreign agent settings files.
Scanner malware-similarity hits are Claude Code fork chunks such as SSH, REPL, and computer-use, not a hidden install payload.

Behavioral surface

Source

ChildProcessCrypto

Source & flagged code

26 flagged

package.jsonView file

Lines 45-85json

45 "build:vite": "vite build && bun run scripts/post-build.ts",

46 "build:vite:only": "vite build",

47 "build:bun": "bun run build.ts",

48 "dev": "bun run scripts/dev.ts",

49 "dev:inspect": "bun run scripts/dev-debug.ts",

50 "prepublishOnly": "bun run build:vite",

51 "lint": "biome lint .",

52 "lint:fix": "biome lint --fix .",

53 "format": "biome format --write .",

54 "check": "biome check .",

55 "check:fix": "biome check --fix .",

56 "prepare": "husky",

57 "test": "bun test",

58 "test:production": "bun run scripts/production-test.ts",

59 "test:production:offline": "bun run scripts/production-test.ts --offline",

60 "test:production:verbose": "bun run scripts/production-test.ts --verbose",

61 "test:production:bun": "bun run scripts/production-test.ts --bun",

62 "check:bundle": "bun run scripts/check-bundle-integrity.ts",

63 "check:unused": "knip-bun",

64 "health": "bun run scripts/health-check.ts",

65 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L65

66 "docs:dev": "npx mintlify dev",

67 "typecheck": "tsc --noEmit",

68 "precheck": "bun run typecheck && bun run check:fix && bun test",

69 "rcs": "bun run scripts/rcs.ts",

70 "reset:api": "node --env-file=.env scripts/reset-api-usage.js",

71 "reset:mai": "node --env-file=.env scripts/reset-mai-usage.js"

72 },

73 "dependencies": {

74 "@agentclientprotocol/sdk": "^0.19.0",

75 "@claude-code-best/mcp-chrome-bridge": "^3.0.1",

76 "highlight.js": "^11.11.1",

77 "ws": "^8.20.0"

78 },

79 "devDependencies": {

80 "@alcalzone/ansi-tokenize": "^0.3.0",

81 "@ant/claude-for-chrome-mcp": "workspace:*",

82 "@ant/computer-use-input": "workspace:*",

83 "@ant/computer-use-mcp": "workspace:*",

84 "@ant/computer-use-swift": "workspace:*",

85 "@ant/model-provider": "workspace:*",

dist/chunks/sentry-zQvqCg5T.jsView file

1import{a as e,i as t,n,r,t as i}from"./chunk-DR8-3Aex.js";import{n as a,t as o}from"./defineProperty-80gRi2ZW.js";import{a as s,c,i as l,l as u,n as d,o as f,r as p,s as m,t as h,u... L2: `);for(let e=n;e<a.length;e++){let n=a[e];n.length>1024&&(n=n.slice(0,1024));let o=Jo.test(n)?n.replace(Jo,`$1`):n;if(!o.includes(`Error: `)){for(let e of t){let t=e(o);if(t){i.pus...

High

Child Process

Package source references child process execution.

dist/chunks/sentry-zQvqCg5T.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/sentry-zQvqCg5T.jsView on unpkg · L1

dist/chunks/dist-es-fjXft-jH.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as

dist/chunks/main-Hz2hgCEo.jsView file

Lines 1-21javascript

1import{a as e,i as t,n,o as r,r as i,t as a}from"./chunk-DR8-3Aex.js";import{n as o,t as s}from"./memoize-DNnuA2aU.js";import{c,d as l,f

scripts/postinstall.cjsView file

Lines 3-43javascript

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode

dist/chunks/dist-es-DuAZyxJ02.jsView file

Lines 1-5javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{r as t,t as n}from"./dist-es-C41b_0B5.js";import{E as r,I as i,N as a,T as o,h as s}

dist/chunks/src-B4RZ3Bik.jsView file

19contains invisible/control Unicode U+200D (zero width joiner) `?(i+=e,a=0):(i+=e,a+=ba(e))}return i}var La,Ra=t((()=>{xa(),Mr(),La=8}));function za(){let e=new Map;for(let[t,n]of Object.entries(W)){for(let[t,r]of Object.entries(n))W[t]={open:`\u001B[${r[0]}m`,close:`\u001B[${r[1]}m`},n[t]=W[t],e.set(r

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/src-B4RZ3Bik.jsView on unpkg · L19

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/src-B4RZ3Bik.jsView on unpkg

dist/chunks/bridgeMain-BaqsfFmb.jsView file

1Cross-file remote execution chain: dist/chunks/bridgeMain-BaqsfFmb.js spawns dist/chunks/debug-Cisktvhb.js; helper contains network access plus dynamic code execution. L1: import{d as e,s as t,u as n}from"./envUtils-BWeoiL4Y.js";import{Cn as r,In as i,Ln as a,t as o}from"./src-B4RZ3Bik.js";import{M as s,Ms as c,Ns as l,S as u,js as d,l as f,z as p}fr... L2: `).filter(e=>e.length>0)}function Le(e){let t=e.write??(e=>process.stdout.write(e)),n=e.verbose,a=0,o=`idle`,s=`Ready`,l=``,u=``,f=``,p=``,m=``,h=``,g=null,_=[],v=!1,b=null,x=0,S=0... L3: `)){if(i.length===0){n++;continue}let e=r(i);n+=Math.max(1,Math.ceil(e/t))}return e.endsWith(` L4: `)&&n--,n}function M(e){t(e),a+=j(e)}function N(){a<=0||(y(`[bridge:ui] clearStatusLines count=${a}`),t(`\x1b[${a}A`),t(`\x1B[J`),a=0)}function F(e){N(),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/bridgeMain-BaqsfFmb.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/bridgeMain-BBSHlt23.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/bridgeMain-BaqsfFmb.jsView on unpkg

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-CWWCIoYw.jsView file

•matchType = token_shingles matchedPackage = investing@0.1.76 matchedPath = dist/index.mjs matchedIdentity = npm:aW52ZXN0aW5n:0.1.76 similarity = 1.000 shingleOverlap = 37 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/loadAgentsDir-CWWCIoYw.jsView on unpkg

•path = dist/chunks/loadAgentsDir-CWWCIoYw.js kind = oversized_source_file sizeBytes = 4329433 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-CWWCIoYw.jsView on unpkg

dist/chunks/createSSHSession-KmVpBGhw.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/createSSHSession-BHSorGb4.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/createSSHSession-KmVpBGhw.jsView on unpkg

dist/chunks/dist-Cg1a1Exw.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/dist-Cg1a1Exw.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/dist-Cg1a1Exw.jsView on unpkg

dist/chunks/esm-CsGLyWmS.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/esm-CsGLyWmS.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/esm-CsGLyWmS.jsView on unpkg

dist/chunks/executor-B3bqTa3n.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/executor-D6F3IuTA.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/executor-B3bqTa3n.jsView on unpkg

dist/chunks/lib-Ca3QWJjN.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/lib-Ca3QWJjN.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/lib-Ca3QWJjN.jsView on unpkg

dist/chunks/open-CDditBQ-.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/open-CDditBQ-.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/open-CDditBQ-.jsView on unpkg

dist/chunks/REPL-zP5smudy.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/REPL-DnHJofkV.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/REPL-zP5smudy.jsView on unpkg

dist/chunks/cliLaunch-BQLM_VtG.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/cliLaunch-lSqbpipz.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cliLaunch-BQLM_VtG.jsView on unpkg

dist/chunks/escHotkey-DzMWu-0q.jsView file

•matchType = normalized_sha256 matchedPackage = @mdevs/mai-cli@1.0.20 matchedPath = dist/chunks/escHotkey-DzMWu-0q.js matchedIdentity = npm:QG1kZXZzL21haS1jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/escHotkey-DzMWu-0q.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunks/sentry-zQvqCg5T.jsView file

High

Findings

1 Critical22 High6 Medium8 Low

CriticalTrojan Source Unicodedist/chunks/src-B4RZ3Bik.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunks/sentry-zQvqCg5T.js

HighShell

HighSame File Env Network Executiondist/chunks/sentry-zQvqCg5T.js

HighCommand Output Exfiltrationdist/chunks/main-Hz2hgCEo.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs

HighCloud Metadata Accessdist/chunks/dist-es-DuAZyxJ02.js

HighInstall Named Payload Filescripts/postinstall.cjs

HighCross File Remote Execution Contextdist/chunks/bridgeMain-BaqsfFmb.js

HighSemantic Analysis Limiteddist/chunks/src-B4RZ3Bik.js

Affected versions and remediation

This report applies to @mdevs/mai-cli@1.0.18.

See all versions of @mdevs/mai-cli for other recorded verdicts.

Review the evidence and your use of @mdevs/mai-cli@1.0.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 09:52:48.167Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code