Loading npm security reports…
@mmerterden/multi-agent-pipeline@20.23.1: Agent extension | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
@mmerterden/multi-agent-pipeline@20.23.1 6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c
scanned 4d ago · by lpm-firewall-ai Source inspection found first-party MCP extension setup that is initiated by the CLI installer and can be skipped, with no npm install lifecycle hook. The registered server tracks the latest companion release, leaving a concrete agent extension update risk; the flagged text-normalization operation is only CLI output.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the package installer for a supported agent CLI, and the agent later starts the registered server.
Impact
A newly published companion release can be introduced into the agent environment on a later start without rerunning this package's installer.
Mechanism
The installer writes an npx command for the companion MCP package using the latest release from the npm registry; registration can be skipped with an environment variable.
AI rationale
Source inspection found first-party MCP extension setup that is initiated by the CLI installer and can be skipped, with no npm install lifecycle hook. The registered server tracks the latest companion release, leaving a concrete agent extension update risk; the flagged text-normalization operation is only CLI output.
Evidence
install/_mcp-register.mjs install/claude.mjs install/index.mjs
public snapshot AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
The installer registers the companion MCP server as an npm package resolved with the latest release whenever the agent starts it. The registration command runs through npx and uses the package's configured npm registry. Claude's installer calls the registration function as part of the installer workflow. The manifest's scripts include start, prepack, and gate, with no preinstall, install, or postinstall hook. The flagged text-normalization receiver writes normalized input to stdout in direct CLI mode. Evidence against
The agent registration is performed by the CLI installer and has an opt-out; no silent npm lifecycle trigger was found. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell
Supply chain HighEntropyStrings UrlStrings
Manifest No manifest risk signals triggered.
26 flagged · loading source pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View file 87 patternName = stripe_live_secret
severity = critical
line = 87
Critical Critical Secret
Package contains a critical-looking secret pattern.
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View on unpkg · L87 87 patternName = stripe_live_secret
severity = critical
line = 87
Critical Secret Pattern
Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View on unpkg · L87 pipeline/scripts/verify-citations.mjs View file 3 Critical 17 High 9 Medium 5 Low
Critical Critical Secret pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
Critical Trojan Source Unicode pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1
Critical Secret Pattern pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
High Child Process pipeline/scripts/verify-citations.mjs
High Shell
High Same File Env Network Execution pipeline/scripts/usage-register.mjs#virtual:normalized:round1
High External Ai Agent Control Surface Mutation pipeline/scripts/doctor.mjs
High Semantic Analysis Limited install/_mcp-register.mjs#virtual:normalized:round1
High Known Malware Source Similarity install/_mcp-register.mjs
High
Affected versions and remediation This report applies to @mmerterden/multi-agent-pipeline@20.23.1 .
See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.
Review the evidence and your use of @mmerterden/multi-agent-pipeline@20.23.1 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-19 13:08:55.419Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
86% Suspicious
AI assessment confidence
Package metadata npm Author Mert Erden
Maintainers mmerterden
Version 20.23.1
Latest on npm 20.27.2
Published Oct 13, 2026
License MIT
Dependencies 0
Integrity verified
Package size 4.39 MB
Files 1,368
Keywords multi-agent pipeline development-workflow tdd code-review claude-code copilot-cli copilot
scanned 202 file(s), 2.36 MB of source, external domains: 127.0.0.1, api.appstoreconnect.apple.com, api.figma.com, api.github.com, console.groq.com, github.com, mmerterden.com, mmerterden.vercel.app, oauth2.googleapis.com, playdeveloperreporting.googleapis.com, registry.npmjs.org, www.googleapis.com
66 import { dirname, resolve as resolvePath, sep } from "node:path";
L67: import { spawnSync } from "node:child_process";
L68: import { runMain } from "../lib/fatal.mjs";
High Child Process
Package source references child process execution.
pipeline/scripts/verify-citations.mjs View on unpkg · L66 225 try {
L226: const mod = await import(new URL("../../install/_dev-only-files.mjs", import.meta.url).href);
L227: return mod.isDevOnlyScript;
Medium Dynamic Require
Package source references dynamic require/import behavior.
pipeline/scripts/verify.mjs View on unpkg · L225 pipeline/scripts/build-stack-plugins.mjs View file 29 *
L30: * Exit code 0 on a build, 1 when the attribution check fails or a --check-* mode
L31: * finds a problem; prints a JSON-ish summary + per-plugin diff.
...
L44: import { fileURLToPath } from "node:url";
L45: import { spawnSync } from "node:child_process";
L46: import { createHash } from "node:crypto";
...
L68: // Checked up front so join() never throws a raw TypeError before any diagnostic.
L69: const HOME = process.env.HOME;
L70: if (!HOME) {
...
L300: // regenerate plugin.json skills[]: keep non-knowledge entries, rebuild knowledge set
L301: const pj = JSON.parse(readFileSync(pjPath, "utf8"));
L302: const nonKnowledge = (pj.skills || []).filter((s) => !s.startsWith("./skills/knowledge/"));
Low Weak Crypto
Package source references weak cryptographic algorithms.
pipeline/scripts/build-stack-plugins.mjs View on unpkg · L29 pipeline/scripts/autopilot-awake.mjs View file 22 * Injectable for tests: MA_AP_LAUNCH_AGENTS (the LaunchAgents dir),
L23: * MA_AP_LAUNCHCTL_BIN, MA_AP_PS_BIN, MA_AP_AWAKE_TEMPLATE, MA_AUTOPILOT_ROOT.
L24: *
...
L27:
L28: import { spawnSync } from "node:child_process";
L29: import {
...
L49: function home(env) {
L50: return env.HOME || homedir();
L51: }
...
L54: try {
L55: return JSON.parse(readFileSync(p, "utf-8"));
L56: } catch {
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
pipeline/scripts/autopilot-awake.mjs View on unpkg · L22 pipeline/scripts/usage-register.mjs#virtual:normalized:round1 View file 11 *
L12: * `--login <name>` records the person"s GitHub username, for a machine that\n * proves no account (a work machine), and implies `--refresh`.\n *\n * Exit: always 0. `--json` says w...
L13: * name in `usageLog.trustedHosts`; http only to loopback (local development).
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
pipeline/scripts/usage-register.mjs#virtual:normalized:round1 View on unpkg · L11 • Runtime or CLI code links a write operation to an explicit external AI-agent control path:
import {
existssync,
readfilesync,
readdirsync,
mkdirsync,
writefilesync,
rmsync,
realpathsync,
} from "node:fs";
import { basename, join, dirname } from "node:path";
import { homedir } from "node:os";
import { execfilesync } from "node:child_process";
import { fileurltopath, pathtofileurl } from "node:url";
import { runmain } from "../lib/fatal.mjs";
import { hostcommand } from "../lib/user-facing.mjs";
import {
unattended_profile_install,
unattended_settings_file,
} from "../lib/unattended-settings-location.mjs";
import { prefshosts, profilegaps } from "../lib/unattended-profile-check.mjs";
import { xcodeskillsstatus } from "../lib/xcode-plugin.mjs";
const here = dirname(fileurlt
High External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
pipeline/scripts/doctor.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/doctor.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/doctor.mjs View on unpkg pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1 View file 52 contains invisible/control Unicode U+FEFF (zero width no-break space)
const src = text.replace(new RegExp(`^${"<U+FEFF>"}`), "");
Critical Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1 View on unpkg · L52 pipeline/scripts/github-ssh-setup.sh View file • path = pipeline/scripts/github-ssh-setup.sh
kind = build_helper
sizeBytes = 10099
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
pipeline/scripts/github-ssh-setup.sh View on unpkg install/_mcp-register.mjs#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
install/_mcp-register.mjs#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = install/_mcp-register.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
install/_mcp-register.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/_autopilot-ops.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/_autopilot-ops.mjs View on unpkg pipeline/scripts/autopilot-arming.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-arming.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-arming.mjs View on unpkg pipeline/scripts/autopilot-publish.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-publish.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-publish.mjs View on unpkg pipeline/scripts/capture-evidence.sh View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/capture-evidence.sh
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/capture-evidence.sh View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/contract/build.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/contract/build.mjs View on unpkg pipeline/scripts/analysis-sources.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/analysis-sources.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/analysis-sources.mjs View on unpkg pipeline/scripts/autopilot-intake.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-intake.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-intake.mjs View on unpkg pipeline/scripts/autopilot-runner.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-runner.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-runner.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/diff-explain.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/diff-explain.mjs View on unpkg pipeline/scripts/diff-risk-score.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/diff-risk-score.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/diff-risk-score.mjs View on unpkg 141 patternName = generic_password
severity = medium
line = 141
Medium Secret Pattern
Hardcoded password in pipeline/scripts/keychain.py
pipeline/scripts/keychain.py View on unpkg · L141 157 patternName = generic_password
severity = medium
line = 157
Medium Secret Pattern
Hardcoded password in pipeline/scripts/keychain.py
pipeline/scripts/keychain.py View on unpkg · L157 230 patternName = generic_password
severity = medium
line = 230
Medium Secret Pattern
Hardcoded password in pipeline/scripts/usage-identity.mjs
pipeline/scripts/usage-identity.mjs View on unpkg · L230 Known Malware Source Similarity
pipeline/scripts/_autopilot-ops.mjs
High Known Malware Source Similarity pipeline/scripts/autopilot-arming.mjs
High Known Malware Source Similarity pipeline/scripts/autopilot-publish.mjs
High Known Malware Source Similarity pipeline/scripts/capture-evidence.sh
High Known Malware Source Similarity pipeline/scripts/doctor.mjs
High Known Malware Source Similarity pipeline/contract/build.mjs
High Known Malware Source Similarity pipeline/scripts/analysis-sources.mjs
High Known Malware Source Similarity pipeline/scripts/autopilot-intake.mjs
High Known Malware Source Similarity pipeline/scripts/autopilot-runner.mjs
High Known Malware Source Similarity pipeline/scripts/diff-explain.mjs
High Known Malware Source Similarity pipeline/scripts/diff-risk-score.mjs
Medium Dynamic Require pipeline/scripts/verify.mjs
Medium Install Persistence pipeline/scripts/autopilot-awake.mjs
Medium Ships Build Helper pipeline/scripts/github-ssh-setup.sh
Medium Structural Risk Force Deep Review
Medium Secret Pattern pipeline/scripts/keychain.py
Medium Secret Pattern pipeline/scripts/keychain.py
Medium Secret Pattern pipeline/scripts/usage-identity.mjs
Low Weak Crypto pipeline/scripts/build-stack-plugins.mjs
Runtime surface package.json Entrypoints main → index.js exports map bin → multi-agent-pipeline
Runtime node >=20.11.0 os darwin
Artifact 13.3 MB · 1,368 files 2 signature(s)
Install lifecycle No install hooks · other: format, format:check, gate, lint +8
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell HighEntropyStrings UrlStrings Manifest: clean
26 flagged pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View file Lines 67-107 markdown
69 Standards: MASTG-TEST-0300, MASTG-TEST-0302, MASWE-0006 (legacy MSTG-STORAGE-1).
71 Detection: case-insensitive search of `.swift` files for lines containing `UserDefaults` together with token, password, secret, credential, auth, session, api key, jwt or bearer.
74 grep -rniE 'UserDefaults.*(token|password|secret|credential|auth|session|api_?key|jwt|bearer)' --include='*.swift' .
77 ## 2. Hardcoded API keys
79 Severity: Critical. OWASP: M1. Fix effort: High.
81 A Swift string literal ends up in the binary's `__TEXT.__cstring` section, where `strings` prints it in seconds. Values in `.xcconfig` files or `Info.plist` ship inside the IPA just the same. The 2025 scan mentioned above found about 78,800 keys for a single cloud provider's APIs alone.
87 static let paymentsKey = "sk_live_EXAMPLEONLY000000000000"
Critical Critical Secret
Package contains a critical-looking secret pattern.
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View on unpkg · L87 88 static let backendKey = "AIzaEXAMPLEONLY00000000000000000"
90 request. setValue ( "Bearer \(Secrets. paymentsKey ) " , forHTTPHeaderField : "Authorization" )
91 let plistKey = Bundle.main.infoDictionary ? [ "API_KEY" ] as? String
94 Secure, in order of preference:
96 1. A server-side proxy holds the key and the app calls the proxy, so the key never reaches the device.
97 2. If the device genuinely needs a key, fetch it at runtime from your server after the user or device is authenticated and cache it in the keychain.
100 func quoteShipment ( _ order: ShipmentRequest) async throws -> Quote {
101 var request = URLRequest ( url : quotesEndpoint)
102 request.httpMethod = "POST"
103 request.httpBody = try JSONEncoder (). encode (order)
104 request. setValue ( "Bearer \( try await session. userAccessToken ()) " , forHTTPHeaderField : "Authorization" )
105 let (body, _ ) = try await URLSession.shared. data ( for : request)
106 return try JSONDecoder (). decode (Quote. self , from : body)
87 patternName = stripe_live_secret
severity = critical
line = 87
Critical Secret Pattern
Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View on unpkg · L87 pipeline/scripts/verify-citations.mjs View file Lines 46-86 javascript
46 * characters, or is the whole line. A line number with no quote only says
47 * the line exists; the quote says what the reviewer read on it;
48 * - every finding claimed pre - existing is checked against the base commit
49 * (_pre - existing.mjs);
Lines 205-245 javascript
205 * for commands / , where install.js rewrites each SKILL .md 's `description` int o
206 * the user 's outputLanguage - every file differs there BY DESIGN, so comparin g
207 * bytes would report 57 findings on a healthy machine and teach everyone to
208 * ignore the whole report.
pipeline/scripts/build-stack-plugins.mjs View file Lines 9-49 javascript
9 * pipeline is the single authoring source; the marketplace is a derived, versioned
12 * The authored lifecycle skills (index / reference / workflow / tools) live in the
pipeline/scripts/autopilot-awake.mjs View file Lines 2-42 javascript
3 * autopilot-awake.mjs - the launchd job that keeps the Mac awake while
6 * The schedule's StartInterval does not wake a sleeping Mac. The in-flight lock
7 * (`caffeinate -s -w <runner pid>`, _autopilot-ops.mjs) covers a run while it is
8 * going, and nothing covers the gap between ticks: the machine sleeps, the next
9 * tick never fires, and the queue stops with nothing to say so. This job closes
10 * that gap. It is a second, separate launchd agent that runs
pipeline/scripts/usage-register.mjs#virtual:normalized:round1 View file 11 *
L12: * `--login <name>` records the person"s GitHub username, for a machine that\n * proves no account (a work machine), and implies `--refresh`.\n *\n * Exit: always 0. `--json` says w...
L13: * name in `usageLog.trustedHosts`; http only to loopback (local development).
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
pipeline/scripts/usage-register.mjs#virtual:normalized:round1 View on unpkg · L11 • Runtime or CLI code links a write operation to an explicit external AI-agent control path:
import {
existssync,
readfilesync,
readdirsync,
mkdirsync,
writefilesync,
rmsync,
realpathsync,
} from "node:fs";
import { basename, join, dirname } from "node:path";
import { homedir } from "node:os";
import { execfilesync } from "node:child_process";
import { fileurltopath, pathtofileurl } from "node:url";
import { runmain } from "../lib/fatal.mjs";
import { hostcommand } from "../lib/user-facing.mjs";
import {
unattended_profile_install,
unattended_settings_file,
} from "../lib/unattended-settings-location.mjs";
import { prefshosts, profilegaps } from "../lib/unattended-profile-check.mjs";
import { xcodeskillsstatus } from "../lib/xcode-plugin.mjs";
const here = dirname(fileurlt
High External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
pipeline/scripts/doctor.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/doctor.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/doctor.mjs View on unpkg pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1 View file 52 contains invisible/control Unicode U+FEFF (zero width no-break space)
const src = text.replace(new RegExp(`^${"<U+FEFF>"}`), "");
Critical Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1 View on unpkg · L52 pipeline/scripts/github-ssh-setup.sh View file • path = pipeline/scripts/github-ssh-setup.sh
kind = build_helper
sizeBytes = 10099
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
pipeline/scripts/github-ssh-setup.sh View on unpkg install/_mcp-register.mjs#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
install/_mcp-register.mjs#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = install/_mcp-register.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
install/_mcp-register.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/_autopilot-ops.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/_autopilot-ops.mjs View on unpkg pipeline/scripts/autopilot-arming.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-arming.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-arming.mjs View on unpkg pipeline/scripts/autopilot-publish.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-publish.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-publish.mjs View on unpkg pipeline/scripts/capture-evidence.sh View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/capture-evidence.sh
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/capture-evidence.sh View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/contract/build.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/contract/build.mjs View on unpkg pipeline/scripts/analysis-sources.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/analysis-sources.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/analysis-sources.mjs View on unpkg pipeline/scripts/autopilot-intake.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-intake.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-intake.mjs View on unpkg pipeline/scripts/autopilot-runner.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-runner.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-runner.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/diff-explain.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/diff-explain.mjs View on unpkg pipeline/scripts/diff-risk-score.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/diff-risk-score.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/diff-risk-score.mjs View on unpkg Lines 121-161 python
122 if not info["backend_ok"]:
123 sys.stderr.write(f"keychain: backend unavailable on {info['platform']}\n")
124 if info["remediation"]:
125 sys.stderr.write(f"keychain: {info['remediation']}\n")
127 return info["platform"]
130 def _decode_security_password(stderr: bytes) -> Optional[str]:
131 """Pull the secret out of `security ... -g` stderr and decode it.
230 patternName = generic_password
severity = medium
line = 230
Medium Secret Pattern
Hardcoded password in pipeline/scripts/usage-identity.mjs
pipeline/scripts/usage-identity.mjs View on unpkg · L230 50 * - the verdict is appended to state.gates[] as `verify-citations`
51 * (gate - ledger.mjs), `not-applicable` when there was nothing to check.
53 * An attended run resolves `file:line` as it always did : flat findings only,
57 * 0 - every citation resolved, or there were none to resolve
58 * 1 - at least one citation did not resolve
59 * 2 - the input could not be read or is not a repository
62 * @ module pipeline / scripts / verify - citations
65 import { readFileSync, realpathSync, statSync } from "node:fs" ;
66 import { dirname, resolve as resolvePath, sep } from "node:path" ;
67 import { spawnSync } from "node:child_process" ;
68 import { runMain } from "../lib/fatal.mjs" ;
High Child Process
Package source references child process execution.
pipeline/scripts/verify-citations.mjs View on unpkg · L66 69 import { invokedDirectly } from "../lib/invoked-directly.mjs" ;
70 import { checkPreExisting, resolveBase } from "./_pre-existing.mjs" ;
71 import { gateContext, recordQuietly } from "./gate-ledger.mjs" ;
74 * Reject a path before it reaches git.
76 * `git show <rev>:<path>` happily resolves `../` out of the tree and an
77 * absolute path against the filesystem, so a citation could name something the
78 * repository does not contain and still "resolve". The guard is here rather
79 * than in the caller because every caller would otherwise need it.
82 * @returns {string|null} the reason it is unsafe, or null
84 export function unsafePath ( p ) {
85 if ( ! p) return "empty path" ;
86 if (p. startsWith ( "/" )) return "absolute path" ;
210 const CLAUDE_TREES = [
211 [ "scripts" , "scripts" , "bytes" ],
212 [ "lib" , "lib" , "bytes" ],
213 [ "multi-agent-refs" , "multi-agent-refs" , "bytes" ],
214 [ "agents" , "agents" , "bytes" ],
215 [ "commands/multi-agent" , "commands/multi-agent" , "presence" ],
219 * Files the package carries but the installer deliberately does not write:
220 * smokes, linters, fixtures and the rest of the maintainer surface. Without
221 * this filter every one of them reads as "the installer skipped a file", which
222 * is 251 false findings on a correct install.
224 async function devOnly () {
226 const mod = await import ( new URL ( "../../install/_dev-only-files.mjs" , import . meta .url).href);
227 return mod.isDevOnlyScript;
Medium Dynamic Require
Package source references dynamic require/import behavior.
pipeline/scripts/verify.mjs View on unpkg · L225 229 // No filter available: say so by filtering nothing, and let the counts be
230 // wrong loudly rather than silently.
235 async function verifyInstall () {
236 const home = homedir ();
237 const claude = join (home, ".claude" );
238 if ( ! existsSync (claude)) {
239 return { present: false , reason: "no ~/.claude on this machine" , ok: true , trees: [] };
242 const isDevOnly = await devOnly ();
13
* plugin repo and are NEVER touched here - only the `knowledge/` layer + plugin.json
14 * knowledge entries are regenerated.
16 * Routing uses the per - stack skill patterns (formerly carried by stack - swap.sh). Genuinely cross - stack
17 * skills go to ai - common - toolkit, and outside - fact skills for analysis work go to
18 * ai - analyst - toolkit (neither is copied into each stack plugin). Apple /
19 * Xcode - only vendored skills that match no stack pattern belong to iOS only.
21 * A vendored skill ships beside its upstream 's NOTICE-*.md. Before anything i s
22 * written, every NOTICE 's `## Skills (N)` list is checked against the skills'
23 * `metadata.source` lines (_notices.mjs); a vendored skill no NOTICE lists stops
24 * the build, so an unattributed copy is never published.
27 * node build - stack - plugins.mjs [ -- plugins - repo < path > ] [ -- pipeline < path > ] [ -- dry - run]
28 * node build - stack - plugins.mjs -- check - routing | -- check - notices
30 * Exit code 0 on a build, 1 when the attribution check fails or a -- check -* mode
31 * finds a problem; prints a JSON - ish summary + per - plugin diff.
43 import { dirname, join } from "node:path" ;
44 import { fileURLToPath } from "node:url" ;
45 import { spawnSync } from "node:child_process" ;
46 import { createHash } from "node:crypto" ;
Low Weak Crypto
Package source references weak cryptographic algorithms.
pipeline/scripts/build-stack-plugins.mjs View on unpkg · L29 48 const args = process.argv. slice ( 2 );
49 // Accepts both `--key value` and `--key=value`. The `=` form used to fall through to
* `/usr/bin/caffeinate -s -i` (plus `-d` with `awake.display: true`) for as long
12 * as it is loaded, and it is loaded exactly while the mode is on.
14 * render [--display|--no-display] print the plist
15 * install [--display|--no-display] write it into LaunchAgents and load it;
16 * without a flag, awake.display from the
17 * config decides. awake.enabled: false
18 * removes the job instead.
19 * remove unload it and delete the plist
20 * status [--json] { held, display }
22 * Injectable for tests: MA_AP_LAUNCH_AGENTS (the LaunchAgents dir),
23 * MA_AP_LAUNCHCTL_BIN, MA_AP_PS_BIN, MA_AP_AWAKE_TEMPLATE, MA_AUTOPILOT_ROOT.
25 * Exit: 0 on success, 1 when launchd refused the job, 2 on usage.
28 import { spawnSync } from "node:child_process" ;
29 import {
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
pipeline/scripts/autopilot-awake.mjs View on unpkg · L22 38 import { homedir } from "node:os" ;
39 import { dirname, join } from "node:path" ;
40 import { fileURLToPath } from "node:url" ;
41 import { invokedDirectly } from "../lib/invoked-directly.mjs" ;
133 `-w` cannot be used to read a secret this store may hold. It prints any value
134 containing a byte outside plain printable ASCII as BARE HEX with no marker,
135 which is indistinguishable from a secret that is itself hex - and 40-character
136 hex API tokens are exactly what lives here. Guessing from the shape would
137 corrupt them. `-g` marks the encoded form with an `0x` prefix, so the decision
138 is read off the output instead of inferred:
140 multi-line value -> password: 0x6C696E65310A6C696E6532 "line1\\012line2"
141 hex-looking value -> password: "deadbeefcafe1234"
Medium Secret Pattern
Hardcoded password in pipeline/scripts/keychain.py
pipeline/scripts/keychain.py View on unpkg · L141 143 Two shapes, measured rather than assumed:
144 - `0x<HEX>` present -> the hex is authoritative; a quoted trailer may follow
145 or may be absent entirely (an all-non-ASCII value prints hex only).
146 - no `0x` -> the value sits between the first and last double quote. Inner
147 quotes are NOT escaped by `security` (`he"llo` prints as `"he"llo"`), so
148 first-to-last is the correct span and unescaping would be wrong.
150 The secret is parsed in-process and returned to the caller. It is never
151 logged, never placed in an exception message, and never passed as an argv
154 for raw in stderr.split(b"\n"):
155 if not raw.startswith(b"password: "):
157 body = raw[len(b"password: "):].rstrip(b"\r")
158 if body.startswith(b"0x"):
159 hex_digits = body[2:].split(b" ", 1)[0]
161 return bytes.fromhex(hex_digits.decode("ascii")).decode("utf-8", errors="replace")
157 patternName = generic_password
severity = medium
line = 157
Medium Secret Pattern
Hardcoded password in pipeline/scripts/keychain.py
pipeline/scripts/keychain.py View on unpkg · L157