@mushi-mushi/cli@0.27.1
CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's credential-exfiltration and install-persistence claims are not supported: there are no lifecycle hooks, and authenticated network calls serve the configured Mushi API. The package nevertheless explicitly mutates AI-agent control-surface files, so policy calls for a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `mushi setup`, `mushi connect`, or `mushi project create`.
Impact
Adds a Mushi MCP server and optional coding instructions; local stdio configurations may invoke the Mushi MCP package.
Mechanism
User-invoked MCP and agent-rule configuration writes.
AI rationale
The scanner's credential-exfiltration and install-persistence claims are not supported: there are no lifecycle hooks, and authenticated network calls serve the configured Mushi API. The package nevertheless explicitly mutates AI-agent control-surface files, so policy calls for a warning rather than a block.
Evidence
package.jsondist/index.jsdist/chunk-NNB2NONG.jsdist/chunk-LDPFTQLE.jsdist/connect-5EQA7G3U.js~/.config/mushi/config.json.env.local.cursor/mcp.json.claude/mcp.json.continue/mcp.json~/.config/zed/settings.json.cursorrules.claude/rules/mushi.md.gitignore
Network endpoints1
dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `mushi setup` writes MCP entries for Cursor, Claude, Continue, or Zed.
- `mushi setup --with-rules` writes `.cursorrules` or `.claude/rules/mushi.md`.
- Explicit `mushi connect` writes `.env.local`, `.cursor/mcp.json`, and may amend `.gitignore`.
- Generated MCP entries can invoke `npx -y @mushi-mushi/mcp`.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- All configuration mutations are reached through named CLI commands, not import/install time.
- API keys are sent as authentication headers only to the configured Mushi API endpoint.
- Source uses secure config permissions and warns/gitignores key-bearing MCP config.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
65import * as p from "@clack/prompts";
L66: import { spawn } from "child_process";
L67: import { randomUUID } from "crypto";
...
L75: let end = endpoint.length;
L76: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L77: return endpoint.slice(0, end);
L78: }
L79: async function deviceFetch(url, init = {}) {
L80: const controller = new AbortController();
...
L92: headers: { "Content-Type": "application/json" },
L93: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L94: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L6565Trigger-reachable chain: manifest.exports -> dist/index.js
L65: import * as p from "@clack/prompts";
L66: import { spawn } from "child_process";
L67: import { randomUUID } from "crypto";
...
L75: let end = endpoint.length;
L76: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L77: return endpoint.slice(0, end);
L78: }
L79: async function deviceFetch(url, init = {}) {
L80: const controller = new AbortController();
...
L92: headers: { "Content-Type": "application/json" },
L93: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L94: });
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L65Findings
2 Critical2 High4 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.27.1.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.27.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.