@mushi-mushi/cli@0.30.2
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource confirms conditional forwarding of the saved API key to an unrestricted operator-configured HTTPS endpoint. The endpoint is explicitly configurable for self-hosted use, so this is a credential exposure risk rather than evidence of covert theft or malicious intent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A CLI operation makes an API request after an endpoint and API key have been configured.
Impact
A wrongly configured or malicious endpoint can receive the Mushi API key.
Mechanism
Endpoint configuration accepts an environment-provided or explicit URL; API requests attach the configured key in authentication headers.
AI rationale
Source confirms conditional forwarding of the saved API key to an unrestricted operator-configured HTTPS endpoint. The endpoint is explicitly configurable for self-hosted use, so this is a credential exposure risk rather than evidence of covert theft or malicious intent.
Evidence
dist/chunk-AHDD44WU.jsdist/chunk-LDPFTQLE.js
Network endpoints1
dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI accepts an API endpoint from environment configuration alongside the API key and project ID.
- Requests send the configured endpoint the API key in authentication headers.
- The endpoint check permits any HTTPS host, without restricting it to the Mushi service.
- Agent integration setup is exposed as an explicit CLI command; the inspected target locations do not show an install hook.
Evidence against
- The package has no preinstall, install, or postinstall lifecycle hook.
- Endpoint selection is configurable for self-hosted use, and the package also provides a default service endpoint.
- The inspected agent target locations concern setup or detection; they do not establish an automatic foreign agent configuration mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/chunk-AJ6TRLJX.jsView file
54import { randomUUID } from "crypto";
L55: import { spawnSync } from "child_process";
L56: import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-AJ6TRLJX.jsView on unpkg · L54dist/index.jsView file
82import * as p from "@clack/prompts";
L83: import { spawn } from "child_process";
L84: import { randomUUID } from "crypto";
...
L92: let end = endpoint.length;
L93: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L94: return endpoint.slice(0, end);
L95: }
L96: async function deviceFetch(url, init = {}) {
L97: const controller = new AbortController();
...
L109: headers: { "Content-Type": "application/json" },
L110: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L111: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L82Findings
2 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/chunk-AJ6TRLJX.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.30.2.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.30.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.