registry / @mmerterden/multi-agent-pipeline / 16.5.0

@mmerterden/multi-agent-pipeline@16.5.0

8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 71 file(s), 636 KB of source, external domains: github.com, mmerterden.vercel.app, registry.npmjs.org

Source & flagged code

5 flagged

pipeline/scripts/migrate-state.mjsView file

Lines 164-204javascript

164 process.exit(1);

165 }

166

167 if (from === to) {

168 console.log(`${path} already at schemaVersion ${to} - no migration needed`);

169 process.exit(0);

170 }

171

172 const chain = resolveChain(type, from, to);

173 if (!chain) {

174 console.error(

175 `migrate-state: no migration path from ${from} to ${to} for ${type}. ` +

176 `Fill the gap in pipeline/schemas/migrations/.`,

177 );

178 process.exit(2);

179 }

180

181 let current = doc;

182 for (const step of chain) {

183 console.log(` → applying ${type} ${step.from} → ${step.to} (${step.path.split("/").pop()})`);

184 try {

185 const mod = await import(pathToFileURL(step.path).href);

186 if (typeof mod.default !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/migrate-state.mjsView on unpkg · L184

187 throw new Error("migration module must export default function");

188 }

189 current = mod.default(current);

190 if (current?.schemaVersion !== step.to) {

191 throw new Error(

192 `migration did not set schemaVersion to ${step.to} (got ${current?.schemaVersion})`,

193 );

194 }

195 } catch (err) {

196 console.error(`migrate-state: migration failed - ${err.message}`);

197 process.exit(3);

198 }

199 }

200

201 if (dryRun) {

202 console.log("--- dry run, not writing ---");

203 console.log(JSON.stringify(current, null, 2));

204 process.exit(0);

pipeline/scripts/build-stack-plugins.mjsView file

Lines 3-43javascript

3 * build-stack-plugins.mjs

4 *

5 * Rebuild the per-stack plugin `knowledge/` trees in the multi-agent-plugins

pipeline/scripts/github-ssh-setup.shView file

•path = pipeline/scripts/github-ssh-setup.sh kind = build_helper sizeBytes = 2634 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pipeline/scripts/github-ssh-setup.shView on unpkg

pipeline/scripts/check-derived-drift.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

pipeline/scripts/check-derived-drift.mjsView on unpkg

install/_mcp-register.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mmerterden/multi-agent-pipeline@16.1.0 matchedIdentity = npm:[redacted]:16.1.0 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install/_mcp-register.mjsView on unpkg

Source & flagged code

5 flagged · loading source

pipeline/scripts/migrate-state.mjsView file

184try { L185: const mod = await import(pathToFileURL(step.path).href); L186: if (typeof mod.default !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pipeline/scripts/migrate-state.mjsView on unpkg · L184

pipeline/scripts/build-stack-plugins.mjsView file

23* L24: * Exit code 0 always (report-only); prints a JSON-ish summary + per-plugin diff. L25: */ ... L36: import { join } from "node:path"; L37: import { spawnSync } from "node:child_process"; L38: import { createHash } from "node:crypto"; ... L61: // gets a string instead of throwing a raw TypeError before any diagnostic. L62: const HOME = process.env.HOME || process.env.USERPROFILE; L63: if (!HOME) { ... L255: // regenerate plugin.json skills[]: keep non-knowledge entries, rebuild knowledge set L256: const pj = JSON.parse(readFileSync(pjPath, "utf8")); L257: const nonKnowledge = (pj.skills || []).filter((s) => !s.startsWith("./skills/knowledge/"));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

pipeline/scripts/build-stack-plugins.mjsView on unpkg · L23

Findings

2 High5 Medium5 Low

HighSemantic Analysis Limitedpipeline/scripts/check-derived-drift.mjs

HighPrevious Version Dangerous Deltainstall/_mcp-register.mjs

MediumDynamic Requirepipeline/scripts/migrate-state.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpipeline/scripts/github-ssh-setup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptopipeline/scripts/build-stack-plugins.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mmerterden/multi-agent-pipeline@16.5.0.

See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.

Review the evidence and your use of @mmerterden/multi-agent-pipeline@16.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-25 11:51:55.331Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.