registry / Credential exfiltration / @mmerterden/multi-agent-pipeline

@mmerterden/multi-agent-pipeline

6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c

This report shows the evidence for @mmerterden/multi-agent-pipeline@20.22.0. 2 of 106 known versions are blocked or flagged. The newest version, 20.27.1, is allowed. See all versions.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The normal GitHub authentication path forwards a stored GitHub token to the package’s publisher-selected reporting host, and the first-run path can activate this without recipient-specific consent. The transfer is concrete source behavior, so this warrants blocking.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The Phase 0 exit gate quietly invokes registration when a pipeline run reaches that gate.

Impact

This discloses a GitHub credential to the package’s reporting server.

Mechanism

The registration code retrieves a token from the GitHub CLI or credential helper and sends it in a bearer header to the package’s default reporting endpoint.

Attack narrative

A pipeline run quietly invokes registration at the Phase 0 exit gate. When no reporting token exists and opt-out is unset, the package retrieves a GitHub access token and sends it as a bearer credential to its default reporting server. This is an unconsented disclosure of a service credential.

AI rationale

Evidence

pipeline/scripts/usage-register.mjspipeline/scripts/usage-identity.mjspipeline/multi-agent-refs/phases/phase-0-init.md

Network endpoints1

mmerterden.com/api/usage/register

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The Phase 0 exit gate runs registration quietly; without an existing token, registration proceeds unless the user opted out.
Registration defaults to the package’s reporting host, constructs its registration path, and trusts that built-in host.
On the GitHub authentication path, the registration code retrieves a token from the GitHub CLI or Git credential helper and passes it as proof.
The request sends that proof in a bearer header to the selected registration URL.
The requested agent integration locations concern installer paths, configuration, model synchronization, and plugin discovery; they are separate from the credential transfer path.
The manifest exposes a CLI entry point and does not declare an npm install lifecycle hook; the confirmed behavior is runtime-triggered.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

15 flagged

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView file

Lines 67-107markdown

67```

69Standards: MASTG-TEST-0300, MASTG-TEST-0302, MASWE-0006 (legacy MSTG-STORAGE-1).

71Detection: case-insensitive search of `.swift` files for lines containing `UserDefaults` together with token, password, secret, credential, auth, session, api key, jwt or bearer.

73```sh

75```

77## 2. Hardcoded API keys

79Severity: Critical. OWASP: M1. Fix effort: High.

81A Swift string literal ends up in the binary's `__TEXT.__cstring` section, where `strings` prints it in seconds. Values in `.xcconfig` files or `Info.plist` ship inside the IPA just the same. The 2025 scan mentioned above found about 78,800 keys for a single cloud provider's APIs alone.

83Insecure:

85```swift

86enum Secrets {

87 static let paymentsKey = "sk_live_EXAMPLEONLY000000000000"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

88 static let backendKey = "AIzaEXAMPLEONLY00000000000000000"

89}

90request.setValue("Bearer \(Secrets.paymentsKey)", forHTTPHeaderField: "Authorization")

91let plistKey = Bundle.main.infoDictionary?["API_KEY"] as? String

92```

94Secure, in order of preference:

961. A server-side proxy holds the key and the app calls the proxy, so the key never reaches the device.

972. If the device genuinely needs a key, fetch it at runtime from your server after the user or device is authenticated and cache it in the keychain.

99```swift

100func quoteShipment(_ order: ShipmentRequest) async throws -> Quote {

101 var request = URLRequest(url: quotesEndpoint)

102 request.httpMethod = "POST"

103 request.httpBody = try JSONEncoder().encode(order)

104 request.setValue("Bearer \(try await session.userAccessToken())", forHTTPHeaderField: "Authorization")

105 let (body, _) = try await URLSession.shared.data(for: request)

106 return try JSONDecoder().decode(Quote.self, from: body)

107}

87patternName = stripe_live_secret severity = critical line = 87

Critical

Secret Pattern

Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

pipeline/scripts/verify-citations.mjsView file

Lines 46-86javascript

46 * characters, or is the whole line. A line number with no quote only says

47 * the line exists; the quote says what the reviewer read on it;

48 * - every finding claimed pre-existing is checked against the base commit

49 * (_pre-existing.mjs);

pipeline/scripts/verify.mjsView file

Lines 205-245javascript

205 * for commands/, where install.js rewrites each SKILL.md's `description` into

206 * the user's outputLanguage - every file differs there BY DESIGN, so comparing

207 * bytes would report 57 findings on a healthy machine and teach everyone to

208 * ignore the whole report.

pipeline/scripts/build-stack-plugins.mjsView file

Lines 9-49javascript

9 * pipeline is the single authoring source; the marketplace is a derived, versioned

10 * publish artifact.

11 *

12 * The authored lifecycle skills (index / reference / workflow / tools) live in the

pipeline/scripts/autopilot-awake.mjsView file

Lines 2-42javascript

2/**

3 * autopilot-awake.mjs - the launchd job that keeps the Mac awake while

4 * autopilot is on.

5 *

6 * The schedule's StartInterval does not wake a sleeping Mac. The in-flight lock

7 * (`caffeinate -s -w <runner pid>`, _autopilot-ops.mjs) covers a run while it is

8 * going, and nothing covers the gap between ticks: the machine sleeps, the next

9 * tick never fires, and the queue stops with nothing to say so. This job closes

10 * that gap. It is a second, separate launchd agent that runs

pipeline/scripts/usage-register.mjs#virtual:normalized:round1View file

123if (!name || !existsSync(credStore)) return null; L124: const r = spawnSync("bash", [credStore, "get", name], { encoding: "utf8", timeout: 8000 }); L125: const out = (r.stdout || "").trim(); L126: return out || null; ... L130: * May the gh token be sent to `url`? The token is a full GitHub credential, so L131: * it only goes over https to the reporting site"s own hosts or a host the prefs\n * name in `usageLog.trustedHosts`; http only to loopback (local development).\n */\nexport functio... L132: ssh_key_unsupported: (u) =>

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

pipeline/scripts/usage-register.mjs#virtual:normalized:round1View on unpkg · L123

pipeline/scripts/doctor.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mmerterden/multi-agent-pipeline@20.18.0 matchedIdentity = npm:[redacted]:20.18.0 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

pipeline/scripts/doctor.mjsView on unpkg

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { existssync, readfilesync, readdirsync, mkdirsync, writefilesync, rmsync, realpathsync, } from "node:fs"; import { basename, join, dirname } from "node:path"; import { homedir } from "node:os"; import { execfilesync } from "node:child_process"; import { fileurltopath, pathtofileurl } from "node:url"; import { runmain } from "../lib/fatal.mjs"; import { hostcommand } from "../lib/user-facing.mjs"; import { unattended_profile_install, unattended_settings_file, } from "../lib/unattended-settings-location.mjs"; import { prefshosts, profilegaps } from "../lib/unattended-profile-check.mjs"; import { xcodeskillsstatus } from "../lib/xcode-plugin.mjs"; const here = dirname(fileurlt

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

pipeline/scripts/doctor.mjsView on unpkg

pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1View file

52contains invisible/control Unicode U+FEFF (zero width no-break space) const src = text.replace(new RegExp(`^${"<U+FEFF>"}`), "");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1View on unpkg · L52

pipeline/scripts/github-ssh-setup.shView file

•path = pipeline/scripts/github-ssh-setup.sh kind = build_helper sizeBytes = 10099 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/github-ssh-setup.shView on unpkg

install/_mcp-register.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install/_mcp-register.mjs#virtual:normalized:round1View on unpkg

pipeline/scripts/keychain.pyView file

Lines 121-161python

121 info = doctor()

122 if not info["backend_ok"]:

123 sys.stderr.write(f"keychain: backend unavailable on {info['platform']}\n")

124 if info["remediation"]:

125 sys.stderr.write(f"keychain: {info['remediation']}\n")

126 sys.exit(2)

127 return info["platform"]

128

129

130def _decode_security_password(stderr: bytes) -> Optional[str]:

131 """Pull the secret out of `security ... -g` stderr and decode it.

132

pipeline/scripts/usage-identity.mjsView file

230patternName = generic_password severity = medium line = 230

Medium

Secret Pattern

Hardcoded password in pipeline/scripts/usage-identity.mjs

pipeline/scripts/usage-identity.mjsView on unpkg · L230

Source & flagged code

15 flagged · loading source

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView file

87patternName = stripe_live_secret severity = critical line = 87

Critical

Critical Secret

Package contains a critical-looking secret pattern.

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

87patternName = stripe_live_secret severity = critical line = 87

Critical

Secret Pattern

Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

pipeline/skills/shared/external/swift-security/references/common-anti-patterns.mdView on unpkg · L87

pipeline/scripts/verify-citations.mjsView file

Findings

4 Critical5 High9 Medium5 Low

CriticalCritical Secretpipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

CriticalTrojan Source Unicodepipeline/scripts/scenario-audit.mjs#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltapipeline/scripts/doctor.mjs

CriticalSecret Patternpipeline/skills/shared/external/swift-security/references/common-anti-patterns.md

HighChild Processpipeline/scripts/verify-citations.mjs

HighShell

HighCommand Output Exfiltrationpipeline/scripts/usage-register.mjs#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationpipeline/scripts/doctor.mjs

HighSemantic Analysis Limitedinstall/_mcp-register.mjs#virtual:normalized:round1

Medium

Affected versions and remediation

This report applies to @mmerterden/multi-agent-pipeline@20.22.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @mmerterden/multi-agent-pipeline@20.22.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-12 23:26:54.904Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

106 known versions

20.27.1latestClean—AllowPublishedOct 19, 2026, 7:25 PM 20.27.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 6:06 AM 20.26.0Clean—AllowPublishedOct 14, 2026, 8:19 PM 20.25.1Clean—AllowPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Runtime surface

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code