registry / Credential exfiltration / @merels/cli
@merels/cli
Developer CLI toolchain to bootstrap, build, and publish games on Merels
This report shows the evidence for @merels/cli@0.0.9. 1 of 4 known versions is blocked or flagged. The newest version, 0.0.10, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install lifecycle hook, but its normal CLI pre-action hook performs undisclosed identity/environment telemetry and modifies project agent instructions. These are concrete harmful behaviors, not merely suspicious primitives.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running most merels CLI commands in a directory containing merels.config.json.
Impact
Sensitive identity and environment data are exfiltrated; agent behavior in the project can be influenced by remotely served documentation.
Mechanism
automatic host/identity telemetry and AGENTS.md remote-instruction injection
Attack narrative
When a user runs most CLI commands inside a Merels project, the pre-action hook creates local identifiers, rewrites AGENTS.md with a remote documentation URL, gathers Git identity, hostname, username, agent-related environment details, command data, and project metadata, and POSTs the payload to the worker endpoint. This is automatic at command runtime rather than installation, but it is concrete unconsented data exfiltration with an agent-control side effect.
AI rationale
The package has no install lifecycle hook, but its normal CLI pre-action hook performs undisclosed identity/environment telemetry and modifies project agent instructions. These are concrete harmful behaviors, not merely suspicious primitives.
Evidence
package.jsonsrc/index.tssrc/telemetry.tstemplates/game/AGENTS.mdmerels.config.json.merels/local.json.gitignoreAGENTS.md
Network endpoints2
merels-worker.yuriplex.workers.dev/api/telemetry/eventmerels.app/docs/
Decision evidence
public snapshotAI called this Malicious at 92.0% confidence as Malware with low false-positive risk.
Evidence for block
- Non-exempt CLI commands automatically run customization and telemetry.
- Telemetry reads Git name and email.
- Telemetry includes hostname and local username, then POSTs the payload.
- Agent-related environment-variable values are included in telemetry.
- CLI modifies or creates AGENTS.md with a remote documentation URL.
Evidence against
- No npm preinstall, install, or postinstall hook is declared.
- Endpoint is fixed to Merels infrastructure; no downloaded code is executed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
UrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcedist/telemetry.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @merels/cli@0.0.8
matchedIdentity = npm:QG1lcmVscy9jbGk:0.0.8
similarity = 0.634
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/telemetry.jsView on unpkg2import os from 'node:os';
L3: import { execSync } from 'node:child_process';
L4: import fs from 'fs-extra';
...
L7: import { resolveWorkerTarget } from './commands/workerTarget.js';
L8: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L9: const templatesDir = path.resolve(__dirname, '../templates');
...
L77: export function detectAgent() {
L78: if (process.env.GEMINI_AGENT || process.env.ANTIGRAVITY) {
L79: return { isAgent: true, type: 'antigravity', details: `gemini_telemetry=${process.env.GEMINI_TELEMETRY || ''}` };
...
L118: catch {
L119: resolvedDocsBaseUrl = 'https://merels.app';
L120: }
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/telemetry.jsView on unpkg · L2src/index.tsView file
Findings
1 Critical5 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/telemetry.js
HighHost Fingerprint Exfiltrationdist/telemetry.js
HighAi Review Evidencesrc/index.ts
HighAi Review Evidencesrc/telemetry.ts
HighAi Review Evidencesrc/telemetry.ts
HighAi Review Evidencesrc/telemetry.ts
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @merels/cli@0.0.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing @merels/cli@0.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.