registry / @mushi-mushi/cli / 0.28.0
@mushi-mushi/cli@0.28.0
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe credential sends inspected are part of the CLI’s Mushi setup and reporting flows and use its configured Mushi API endpoint. The package has no install lifecycle hook, and the inspected source does not establish an unrelated credential recipient or other concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI init wizard.
Impact
The SDK key is used to authenticate requests to the Mushi API; the inspected source does not show transfer to an unrelated recipient.
Mechanism
The wizard verifies credentials and sends setup telemetry or a test report to the configured API endpoint.
AI rationale
The credential sends inspected are part of the CLI’s Mushi setup and reporting flows and use its configured Mushi API endpoint. The package has no install lifecycle hook, and the inspected source does not establish an unrelated credential recipient or other concrete attack.
Evidence
package.jsondist/index.jsdist/init.jsdist/chunk-LDPFTQLE.jsdist/chunk-FJETUM25.jsdist/chunk-AV3RKAEE.js.lpm-dependency-evidence-18f41731-f0bd-4a90-83d2-cc6fffd17850/0/npm-linux/package.json.lpm-dependency-evidence-18f41731-f0bd-4a90-83d2-cc6fffd17850/0/npm-linux/dist/index.mjs.lpm-dependency-evidence-18f41731-f0bd-4a90-83d2-cc6fffd17850/1/npm-linux/package.json.lpm-dependency-evidence-18f41731-f0bd-4a90-83d2-cc6fffd17850/1/npm-linux/esm.mjs.lpm-dependency-evidence-18f41731-f0bd-4a90-83d2-cc6fffd17850/2/npm-linux/package.json.lpm-dependency-evidence-18f41731-f0bd-4a90-83d2-cc6fffd17850/2/npm-linux/index.js
Network endpoints1
/functions/v1/api
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json routes the CLI to dist/index.js and defines build, lint, test, and typecheck scripts, with no install lifecycle hook.
- The wizard takes its API endpoint from its options, environment, or saved configuration; its fallback is the Mushi API endpoint.
- The wizard sends its SDK key to that endpoint for a funnel event, and MUSHI_NO_TELEMETRY disables that event.
- Test-report sending requires an affirmative prompt, an explicit send option, or --yes; the request goes to the configured API endpoint.
- Credential callers are reached through the CLI init command, and browser sign-in and API-key checks use the same endpoint.
- The inspected prompt, command-parser, and optional keyring dependencies have ordinary CLI roles; no attack behavior was identified in their required source files.
Evidence against
- The wizard includes the SDK key in authentication headers for its funnel event and test-report request, but both requests target the configured Mushi API endpoint.
Behavioral surface
ChildProcessCrypto
Source & flagged code
5 flaggeddist/index.jsView file
81import * as p from "@clack/prompts";
L82: import { spawn } from "child_process";
L83: import { randomUUID } from "crypto";
...
L91: let end = endpoint.length;
L92: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L93: return endpoint.slice(0, end);
L94: }
L95: async function deviceFetch(url, init = {}) {
L96: const controller = new AbortController();
...
L108: headers: { "Content-Type": "application/json" },
L109: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L110: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L8181Trigger-reachable chain: manifest.exports -> dist/index.js
L81: import * as p from "@clack/prompts";
L82: import { spawn } from "child_process";
L83: import { randomUUID } from "crypto";
...
L91: let end = endpoint.length;
L92: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L93: return endpoint.slice(0, end);
L94: }
L95: async function deviceFetch(url, init = {}) {
L96: const controller = new AbortController();
...
L108: headers: { "Content-Type": "application/json" },
L109: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L110: });
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L81Findings
3 Critical2 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/chunk-AV3RKAEE.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.28.0.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.28.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.