registry / @mushi-mushi/cli / 0.30.3
@mushi-mushi/cli@0.30.3
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource inspection found no install lifecycle hooks or confirmed malicious behavior. Agent configuration changes are part of an explicitly confirmed CLI setup flow, so the scanner hints do not establish an attack surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the CLI setup flow and confirms the offered connect operation.
Impact
The user-requested setup adds the package's MCP server to project configuration; no unconsented install-time agent mutation was found.
Mechanism
The connect flow writes the MCP server entry; the inspected agent configuration checks are read-only.
AI rationale
Source inspection found no install lifecycle hooks or confirmed malicious behavior. Agent configuration changes are part of an explicitly confirmed CLI setup flow, so the scanner hints do not establish an attack surface.
Evidence
.cursor/mcp.json
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entrypoint and declares no install lifecycle hooks.
- The MCP inspection code only checks for existing agent configuration files.
- MCP configuration writing belongs to the connect flow; setup offers that flow behind a confirmation prompt.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/chunk-ZRDGR4TV.jsView file
25import { randomUUID } from "crypto";
L26: import { spawnSync } from "child_process";
L27: import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-ZRDGR4TV.jsView on unpkg · L25dist/index.jsView file
82import * as p from "@clack/prompts";
L83: import { spawn } from "child_process";
L84: import { randomUUID } from "crypto";
...
L92: let end = endpoint.length;
L93: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L94: return endpoint.slice(0, end);
L95: }
L96: async function deviceFetch(url, init = {}) {
L97: const controller = new AbortController();
...
L109: headers: { "Content-Type": "application/json" },
L110: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L111: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L82Findings
2 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/chunk-ZRDGR4TV.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.30.3.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.30.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.