Loading npm security reports…
@mmerterden/multi-agent-pipeline@20.25.0: Agent extension | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
@mmerterden/multi-agent-pipeline@20.25.0 6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase c
scanned 6d ago · by lpm-firewall-ai The source supports a warning for the persistent, unpinned first-party MCP extension configured by the explicit installer. No install-time attack or concrete malicious behavior was identified, so this does not warrant a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user invokes the package installer for Claude Code, Codex CLI, or Copilot CLI; the configured host later starts the MCP server.
Impact
Future package releases may run with the agent's available capabilities without a version pin.
Mechanism
The installer writes an MCP registration that runs npx with the companion package at @latest, resolving it from the npm registry when needed.
AI rationale
The source supports a warning for the persistent, unpinned first-party MCP extension configured by the explicit installer. No install-time attack or concrete malicious behavior was identified, so this does not warrant a publish block.
Evidence
package.json index.js install/index.mjs install/claude.mjs install/codex.mjs install/copilot.mjs install/_mcp-register.mjs ~/.codex/config.toml ~/.copilot/mcp-config.json
public snapshot AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
The manifest exposes a CLI and has no preinstall, install, or postinstall hook; the CLI dispatches to the installer when invoked. The installer defaults to Claude Code and registers the companion MCP server for each selected agent CLI. Registration configures npx to run the first-party MCP package at @latest, which can resolve newer code when the server starts. The MCP registration is stored in user-level agent configuration; this creates a persistent extension that can run with agent capabilities. Installer telemetry requires MULTI_AGENT_TELEMETRY=1 and sends package and runtime metadata to the package publisher. Other flagged agent-integration locations resolve to local cache, template, status, or directly invoked preference helpers; they do not establish a separate attack. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell
26 flagged · loading source pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View file 87 patternName = stripe_live_secret
severity = critical
line = 87
Critical Critical Secret
Package contains a critical-looking secret pattern.
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View on unpkg · L87 87 patternName = stripe_live_secret
severity = critical
line = 87
Critical Secret Pattern
Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View on unpkg · L87 pipeline/scripts/edit-syntax-gate.mjs View file 3 Critical 17 High 9 Medium 5 Low
Critical Critical Secret pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
Critical Trojan Source Unicode pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1
Critical Secret Pattern pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
High Child Process pipeline/scripts/edit-syntax-gate.mjs
High Shell
High Same File Env Network Execution pipeline/scripts/usage-register.mjs#virtual:normalized:round1
High External Ai Agent Control Surface Mutation pipeline/scripts/doctor.mjs
High Semantic Analysis Limited install/_mcp-register.mjs#virtual:normalized:round1
High Known Malware Source Similarity install/_mcp-register.mjs
High
Affected versions and remediation This report applies to @mmerterden/multi-agent-pipeline@20.25.0 .
See all versions of @mmerterden/multi-agent-pipeline for other recorded verdicts.
Review the evidence and your use of @mmerterden/multi-agent-pipeline@20.25.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-16 22:32:37.120Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
84% Suspicious
AI assessment confidence
Package metadata npm Author Mert Erden
Maintainers mmerterden
Version 20.25.0
Latest on npm 20.27.2
Published Oct 14, 2026
License MIT
Dependencies 0
Integrity verified
Package size 4.51 MB
Files 1,396
Keywords multi-agent pipeline development-workflow tdd code-review claude-code copilot-cli copilot
Supply chain
HighEntropyStrings UrlStrings
Manifest No manifest risk signals triggered.
scanned 217 file(s), 2.61 MB of source, external domains: 127.0.0.1, api.appstoreconnect.apple.com, api.figma.com, api.github.com, console.groq.com, dl.google.com, github.com, mmerterden.com, mmerterden.vercel.app, oauth2.googleapis.com, playdeveloperreporting.googleapis.com, pypi.org, registry.npmjs.org, repo.maven.apache.org, www.googleapis.com
49 L50: import { spawnSync } from "node:child_process";
L51: import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
High Child Process
Package source references child process execution.
pipeline/scripts/edit-syntax-gate.mjs View on unpkg · L49 225 try {
L226: const mod = await import(new URL("../../install/_dev-only-files.mjs", import.meta.url).href);
L227: return mod.isDevOnlyScript;
Medium Dynamic Require
Package source references dynamic require/import behavior.
pipeline/scripts/verify.mjs View on unpkg · L225 pipeline/scripts/build-stack-plugins.mjs View file 29 *
L30: * Exit code 0 on a build, 1 when the attribution check fails or a --check-* mode
L31: * finds a problem; prints a JSON-ish summary + per-plugin diff.
...
L44: import { fileURLToPath } from "node:url";
L45: import { spawnSync } from "node:child_process";
L46: import { createHash } from "node:crypto";
...
L68: // Checked up front so join() never throws a raw TypeError before any diagnostic.
L69: const HOME = process.env.HOME;
L70: if (!HOME) {
...
L300: // regenerate plugin.json skills[]: keep non-knowledge entries, rebuild knowledge set
L301: const pj = JSON.parse(readFileSync(pjPath, "utf8"));
L302: const nonKnowledge = (pj.skills || []).filter((s) => !s.startsWith("./skills/knowledge/"));
Low Weak Crypto
Package source references weak cryptographic algorithms.
pipeline/scripts/build-stack-plugins.mjs View on unpkg · L29 pipeline/scripts/autopilot-awake.mjs View file 22 * Injectable for tests: MA_AP_LAUNCH_AGENTS (the LaunchAgents dir),
L23: * MA_AP_LAUNCHCTL_BIN, MA_AP_PS_BIN, MA_AP_AWAKE_TEMPLATE, MA_AUTOPILOT_ROOT.
L24: *
...
L27:
L28: import { spawnSync } from "node:child_process";
L29: import {
...
L49: function home(env) {
L50: return env.HOME || homedir();
L51: }
...
L54: try {
L55: return JSON.parse(readFileSync(p, "utf-8"));
L56: } catch {
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
pipeline/scripts/autopilot-awake.mjs View on unpkg · L22 pipeline/scripts/usage-register.mjs#virtual:normalized:round1 View file 11 *
L12: * `--login <name>` records the person"s GitHub username, for a machine that\n * proves no account (a work machine), and implies `--refresh`.\n *\n * Exit: always 0. `--json` says w...
L13: * name in `usageLog.trustedHosts`; http only to loopback (local development).
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
pipeline/scripts/usage-register.mjs#virtual:normalized:round1 View on unpkg · L11 • Runtime or CLI code links a write operation to an explicit external AI-agent control path:
import {
existssync,
readfilesync,
readdirsync,
mkdirsync,
writefilesync,
rmsync,
realpathsync,
} from "node:fs";
import { basename, join, dirname } from "node:path";
import { homedir } from "node:os";
import { execfilesync } from "node:child_process";
import { fileurltopath, pathtofileurl } from "node:url";
import { runmain } from "../lib/fatal.mjs";
import { hostcommand } from "../lib/user-facing.mjs";
import {
unattended_profile_install,
unattended_settings_file,
} from "../lib/unattended-settings-location.mjs";
import { prefshosts, profilegaps } from "../lib/unattended-profile-check.mjs";
import { xcodeskillsstatus } from "../lib/xcode-plugin.mjs";
const here = dirname(fileurlt
High External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
pipeline/scripts/doctor.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/doctor.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/doctor.mjs View on unpkg pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1 View file 52 contains invisible/control Unicode U+FEFF (zero width no-break space)
const src = text.replace(new RegExp(`^${"<U+FEFF>"}`), "");
Critical Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1 View on unpkg · L52 pipeline/scripts/github-ssh-setup.sh View file • path = pipeline/scripts/github-ssh-setup.sh
kind = build_helper
sizeBytes = 10099
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
pipeline/scripts/github-ssh-setup.sh View on unpkg install/_mcp-register.mjs#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
install/_mcp-register.mjs#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = install/_mcp-register.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
install/_mcp-register.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/_autopilot-ops.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/_autopilot-ops.mjs View on unpkg pipeline/scripts/autopilot-arming.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-arming.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-arming.mjs View on unpkg pipeline/scripts/capture-evidence.sh View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/capture-evidence.sh
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/capture-evidence.sh View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/contract/build.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/contract/build.mjs View on unpkg pipeline/scripts/analysis-sources.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/analysis-sources.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/analysis-sources.mjs View on unpkg pipeline/scripts/autopilot-intake.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-intake.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-intake.mjs View on unpkg pipeline/scripts/autopilot-runner.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-runner.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-runner.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/diff-explain.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/diff-explain.mjs View on unpkg pipeline/scripts/diff-risk-score.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/diff-risk-score.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/diff-risk-score.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/feedback-send.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/feedback-send.mjs View on unpkg 141 patternName = generic_password
severity = medium
line = 141
Medium Secret Pattern
Hardcoded password in pipeline/scripts/keychain.py
pipeline/scripts/keychain.py View on unpkg · L141 157 patternName = generic_password
severity = medium
line = 157
Medium Secret Pattern
Hardcoded password in pipeline/scripts/keychain.py
pipeline/scripts/keychain.py View on unpkg · L157 230 patternName = generic_password
severity = medium
line = 230
Medium Secret Pattern
Hardcoded password in pipeline/scripts/usage-identity.mjs
pipeline/scripts/usage-identity.mjs View on unpkg · L230 Known Malware Source Similarity
pipeline/scripts/_autopilot-ops.mjs
High Known Malware Source Similarity pipeline/scripts/autopilot-arming.mjs
High Known Malware Source Similarity pipeline/scripts/capture-evidence.sh
High Known Malware Source Similarity pipeline/scripts/doctor.mjs
High Known Malware Source Similarity pipeline/contract/build.mjs
High Known Malware Source Similarity pipeline/scripts/analysis-sources.mjs
High Known Malware Source Similarity pipeline/scripts/autopilot-intake.mjs
High Known Malware Source Similarity pipeline/scripts/autopilot-runner.mjs
High Known Malware Source Similarity pipeline/scripts/diff-explain.mjs
High Known Malware Source Similarity pipeline/scripts/diff-risk-score.mjs
High Known Malware Source Similarity pipeline/scripts/feedback-send.mjs
Medium Dynamic Require pipeline/scripts/verify.mjs
Medium Install Persistence pipeline/scripts/autopilot-awake.mjs
Medium Ships Build Helper pipeline/scripts/github-ssh-setup.sh
Medium Structural Risk Force Deep Review
Medium Secret Pattern pipeline/scripts/keychain.py
Medium Secret Pattern pipeline/scripts/keychain.py
Medium Secret Pattern pipeline/scripts/usage-identity.mjs
Low Weak Crypto pipeline/scripts/build-stack-plugins.mjs
Runtime surface package.json Entrypoints main → index.js exports map bin → multi-agent-pipeline
Runtime node >=20.11.0 os darwin
Artifact 13.7 MB · 1,396 files 2 signature(s)
Install lifecycle No install hooks · other: format, format:check, gate, lint +8
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell HighEntropyStrings UrlStrings Manifest: clean
26 flagged pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View file Lines 67-107 markdown
69 Standards: MASTG-TEST-0300, MASTG-TEST-0302, MASWE-0006 (legacy MSTG-STORAGE-1).
71 Detection: case-insensitive search of `.swift` files for lines containing `UserDefaults` together with token, password, secret, credential, auth, session, api key, jwt or bearer.
74 grep -rniE 'UserDefaults.*(token|password|secret|credential|auth|session|api_?key|jwt|bearer)' --include='*.swift' .
77 ## 2. Hardcoded API keys
79 Severity: Critical. OWASP: M1. Fix effort: High.
81 A Swift string literal ends up in the binary's `__TEXT.__cstring` section, where `strings` prints it in seconds. Values in `.xcconfig` files or `Info.plist` ship inside the IPA just the same. The 2025 scan mentioned above found about 78,800 keys for a single cloud provider's APIs alone.
87 static let paymentsKey = "sk_live_EXAMPLEONLY000000000000"
Critical Critical Secret
Package contains a critical-looking secret pattern.
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View on unpkg · L87 88 static let backendKey = "AIzaEXAMPLEONLY00000000000000000"
90 request. setValue ( "Bearer \(Secrets. paymentsKey ) " , forHTTPHeaderField : "Authorization" )
91 let plistKey = Bundle.main.infoDictionary ? [ "API_KEY" ] as? String
94 Secure, in order of preference:
96 1. A server-side proxy holds the key and the app calls the proxy, so the key never reaches the device.
97 2. If the device genuinely needs a key, fetch it at runtime from your server after the user or device is authenticated and cache it in the keychain.
100 func quoteShipment ( _ order: ShipmentRequest) async throws -> Quote {
101 var request = URLRequest ( url : quotesEndpoint)
102 request.httpMethod = "POST"
103 request.httpBody = try JSONEncoder (). encode (order)
104 request. setValue ( "Bearer \( try await session. userAccessToken ()) " , forHTTPHeaderField : "Authorization" )
105 let (body, _ ) = try await URLSession.shared. data ( for : request)
106 return try JSONDecoder (). decode (Quote. self , from : body)
87 patternName = stripe_live_secret
severity = critical
line = 87
Critical Secret Pattern
Stripe live secret key in pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md
pipeline/skills/shared/external/swift-security/references/common-anti-patterns.md View on unpkg · L87 pipeline/scripts/edit-syntax-gate.mjs View file Lines 29-69 javascript
31 * Kotlin has no parser that answers inside the deadline (kotlinc starts a JVM ),
32 * so .kt / .kts are skipped, as is
Lines 205-245 javascript
205 * for commands / , where install.js rewrites each SKILL .md 's `description` int o
206 * the user 's outputLanguage - every file differs there BY DESIGN, so comparin g
207 * bytes would report 57 findings on a healthy machine and teach everyone to
208 * ignore the whole report.
pipeline/scripts/build-stack-plugins.mjs View file Lines 9-49 javascript
9 * pipeline is the single authoring source; the marketplace is a derived, versioned
12 * The authored lifecycle skills (index / reference / workflow / tools) live in the
pipeline/scripts/autopilot-awake.mjs View file Lines 2-42 javascript
3 * autopilot-awake.mjs - the launchd job that keeps the Mac awake while
6 * The schedule's StartInterval does not wake a sleeping Mac. The in-flight lock
7 * (`caffeinate -s -w <runner pid>`, _autopilot-ops.mjs) covers a run while it is
8 * going, and nothing covers the gap between ticks: the machine sleeps, the next
9 * tick never fires, and the queue stops with nothing to say so. This job closes
10 * that gap. It is a second, separate launchd agent that runs
pipeline/scripts/usage-register.mjs#virtual:normalized:round1 View file 11 *
L12: * `--login <name>` records the person"s GitHub username, for a machine that\n * proves no account (a work machine), and implies `--refresh`.\n *\n * Exit: always 0. `--json` says w...
L13: * name in `usageLog.trustedHosts`; http only to loopback (local development).
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
pipeline/scripts/usage-register.mjs#virtual:normalized:round1 View on unpkg · L11 • Runtime or CLI code links a write operation to an explicit external AI-agent control path:
import {
existssync,
readfilesync,
readdirsync,
mkdirsync,
writefilesync,
rmsync,
realpathsync,
} from "node:fs";
import { basename, join, dirname } from "node:path";
import { homedir } from "node:os";
import { execfilesync } from "node:child_process";
import { fileurltopath, pathtofileurl } from "node:url";
import { runmain } from "../lib/fatal.mjs";
import { hostcommand } from "../lib/user-facing.mjs";
import {
unattended_profile_install,
unattended_settings_file,
} from "../lib/unattended-settings-location.mjs";
import { prefshosts, profilegaps } from "../lib/unattended-profile-check.mjs";
import { xcodeskillsstatus } from "../lib/xcode-plugin.mjs";
const here = dirname(fileurlt
High External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
pipeline/scripts/doctor.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/doctor.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/doctor.mjs View on unpkg pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1 View file 52 contains invisible/control Unicode U+FEFF (zero width no-break space)
const src = text.replace(new RegExp(`^${"<U+FEFF>"}`), "");
Critical Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
pipeline/scripts/scenario-audit.mjs#virtual:normalized:round1 View on unpkg · L52 pipeline/scripts/github-ssh-setup.sh View file • path = pipeline/scripts/github-ssh-setup.sh
kind = build_helper
sizeBytes = 10099
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
pipeline/scripts/github-ssh-setup.sh View on unpkg install/_mcp-register.mjs#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
install/_mcp-register.mjs#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = install/_mcp-register.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
install/_mcp-register.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/_autopilot-ops.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/_autopilot-ops.mjs View on unpkg pipeline/scripts/autopilot-arming.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-arming.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-arming.mjs View on unpkg pipeline/scripts/capture-evidence.sh View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/capture-evidence.sh
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/capture-evidence.sh View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/contract/build.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/contract/build.mjs View on unpkg pipeline/scripts/analysis-sources.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/analysis-sources.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/analysis-sources.mjs View on unpkg pipeline/scripts/autopilot-intake.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-intake.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-intake.mjs View on unpkg pipeline/scripts/autopilot-runner.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/autopilot-runner.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/autopilot-runner.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/diff-explain.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/diff-explain.mjs View on unpkg pipeline/scripts/diff-risk-score.mjs View file • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/diff-risk-score.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/diff-risk-score.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = @mmerterden/multi-agent-pipeline@20.22.0
matchedPath = pipeline/scripts/feedback-send.mjs
matchedIdentity = npm:[redacted]:20.22.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
pipeline/scripts/feedback-send.mjs View on unpkg Lines 121-161 python
122 if not info["backend_ok"]:
123 sys.stderr.write(f"keychain: backend unavailable on {info['platform']}\n")
124 if info["remediation"]:
125 sys.stderr.write(f"keychain: {info['remediation']}\n")
127 return info["platform"]
130 def _decode_security_password(stderr: bytes) -> Optional[str]:
131 """Pull the secret out of `security ... -g` stderr and decode it.
230 patternName = generic_password
severity = medium
line = 230
Medium Secret Pattern
Hardcoded password in pipeline/scripts/usage-identity.mjs
pipeline/scripts/usage-identity.mjs View on unpkg · L230 every
other
extension
(.
jsx
and
.
jsonc
35 * Silent on : the gate switched off ( `editSyntaxGate.enabled` not true ), a parser
36 * not installed, a parser that runs past the deadline, a file that is gone or
37 * too large, an unreadable payload. A missing tool is the user 's toolchain, no t
38 * the edit 's fault, and a false alarm costs more than a missed one: the buil d
39 * still catches what this lets through.
41 * One hook call checks at most 8 files within about 8 s overall (the hook is
42 * killed at 10 s); files past either limit are not checked, and their count
43 * is added to a message that reports an error.
47 * @ module pipeline / scripts / edit - syntax - gate
50 import { spawnSync } from "node:child_process" ;
51 import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "node:fs" ;
High Child Process
Package source references child process execution.
pipeline/scripts/edit-syntax-gate.mjs View on unpkg · L49 52 import { homedir, tmpdir } from "node:os" ;
53 import { basename, extname, join, resolve, sep } from "node:path" ;
55 import { invokedDirectly } from "../lib/invoked-directly.mjs" ;
57 const CLAUDE_EDIT_TOOLS = new Set ([ "Edit" , "Write" , "MultiEdit" ]);
58 const COPILOT_EDIT_TOOLS = new Set ([ "edit" , "create" ]);
59 const CODEX_PATCH_TOOL = "apply_patch" ;
60 const DEADLINE_MS = 2000 ;
61 const BUDGET_MS = 8000 ;
63 const MAX_BYTES = 5 * 1024 * 1024 ;
66 const NODE_INTERNAL_FRAME = / ^ \s * at . * \( ? node:internal [/:] / ;
67 const PREF = "editSyntaxGate.enabled" ;
69 function prefsCandidates () {
210 const CLAUDE_TREES = [
211 [ "scripts" , "scripts" , "bytes" ],
212 [ "lib" , "lib" , "bytes" ],
213 [ "multi-agent-refs" , "multi-agent-refs" , "bytes" ],
214 [ "agents" , "agents" , "bytes" ],
215 [ "commands/multi-agent" , "commands/multi-agent" , "presence" ],
219 * Files the package carries but the installer deliberately does not write:
220 * smokes, linters, fixtures and the rest of the maintainer surface. Without
221 * this filter every one of them reads as "the installer skipped a file", which
222 * is 251 false findings on a correct install.
224 async function devOnly () {
226 const mod = await import ( new URL ( "../../install/_dev-only-files.mjs" , import . meta .url).href);
227 return mod.isDevOnlyScript;
Medium Dynamic Require
Package source references dynamic require/import behavior.
pipeline/scripts/verify.mjs View on unpkg · L225 229 // No filter available: say so by filtering nothing, and let the counts be
230 // wrong loudly rather than silently.
235 async function verifyInstall () {
236 const home = homedir ();
237 const claude = join (home, ".claude" );
238 if ( ! existsSync (claude)) {
239 return { present: false , reason: "no ~/.claude on this machine" , ok: true , trees: [] };
242 const isDevOnly = await devOnly ();
13
* plugin repo and are NEVER touched here - only the `knowledge/` layer + plugin.json
14 * knowledge entries are regenerated.
16 * Routing uses the per - stack skill patterns (formerly carried by stack - swap.sh). Genuinely cross - stack
17 * skills go to ai - common - toolkit, and outside - fact skills for analysis work go to
18 * ai - analyst - toolkit (neither is copied into each stack plugin). Apple /
19 * Xcode - only vendored skills that match no stack pattern belong to iOS only.
21 * A vendored skill ships beside its upstream 's NOTICE-*.md. Before anything i s
22 * written, every NOTICE 's `## Skills (N)` list is checked against the skills'
23 * `metadata.source` lines (_notices.mjs); a vendored skill no NOTICE lists stops
24 * the build, so an unattributed copy is never published.
27 * node build - stack - plugins.mjs [ -- plugins - repo < path > ] [ -- pipeline < path > ] [ -- dry - run]
28 * node build - stack - plugins.mjs -- check - routing | -- check - notices
30 * Exit code 0 on a build, 1 when the attribution check fails or a -- check -* mode
31 * finds a problem; prints a JSON - ish summary + per - plugin diff.
43 import { dirname, join } from "node:path" ;
44 import { fileURLToPath } from "node:url" ;
45 import { spawnSync } from "node:child_process" ;
46 import { createHash } from "node:crypto" ;
Low Weak Crypto
Package source references weak cryptographic algorithms.
pipeline/scripts/build-stack-plugins.mjs View on unpkg · L29 48 const args = process.argv. slice ( 2 );
49 // Accepts both `--key value` and `--key=value`. The `=` form used to fall through to
* `/usr/bin/caffeinate -s -i` (plus `-d` with `awake.display: true`) for as long
12 * as it is loaded, and it is loaded exactly while the mode is on.
14 * render [--display|--no-display] print the plist
15 * install [--display|--no-display] write it into LaunchAgents and load it;
16 * without a flag, awake.display from the
17 * config decides. awake.enabled: false
18 * removes the job instead.
19 * remove unload it and delete the plist
20 * status [--json] { held, display }
22 * Injectable for tests: MA_AP_LAUNCH_AGENTS (the LaunchAgents dir),
23 * MA_AP_LAUNCHCTL_BIN, MA_AP_PS_BIN, MA_AP_AWAKE_TEMPLATE, MA_AUTOPILOT_ROOT.
25 * Exit: 0 on success, 1 when launchd refused the job, 2 on usage.
28 import { spawnSync } from "node:child_process" ;
29 import {
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
pipeline/scripts/autopilot-awake.mjs View on unpkg · L22 38 import { homedir } from "node:os" ;
39 import { dirname, join } from "node:path" ;
40 import { fileURLToPath } from "node:url" ;
41 import { invokedDirectly } from "../lib/invoked-directly.mjs" ;
133 `-w` cannot be used to read a secret this store may hold. It prints any value
134 containing a byte outside plain printable ASCII as BARE HEX with no marker,
135 which is indistinguishable from a secret that is itself hex - and 40-character
136 hex API tokens are exactly what lives here. Guessing from the shape would
137 corrupt them. `-g` marks the encoded form with an `0x` prefix, so the decision
138 is read off the output instead of inferred:
140 multi-line value -> password: 0x6C696E65310A6C696E6532 "line1\\012line2"
141 hex-looking value -> password: "deadbeefcafe1234"
Medium Secret Pattern
Hardcoded password in pipeline/scripts/keychain.py
pipeline/scripts/keychain.py View on unpkg · L141 143 Two shapes, measured rather than assumed:
144 - `0x<HEX>` present -> the hex is authoritative; a quoted trailer may follow
145 or may be absent entirely (an all-non-ASCII value prints hex only).
146 - no `0x` -> the value sits between the first and last double quote. Inner
147 quotes are NOT escaped by `security` (`he"llo` prints as `"he"llo"`), so
148 first-to-last is the correct span and unescaping would be wrong.
150 The secret is parsed in-process and returned to the caller. It is never
151 logged, never placed in an exception message, and never passed as an argv
154 for raw in stderr.split(b"\n"):
155 if not raw.startswith(b"password: "):
157 body = raw[len(b"password: "):].rstrip(b"\r")
158 if body.startswith(b"0x"):
159 hex_digits = body[2:].split(b" ", 1)[0]
161 return bytes.fromhex(hex_digits.decode("ascii")).decode("utf-8", errors="replace")
157 patternName = generic_password
severity = medium
line = 157
Medium Secret Pattern
Hardcoded password in pipeline/scripts/keychain.py
pipeline/scripts/keychain.py View on unpkg · L157