registry / @mushi-mushi/cli / 0.30.4
@mushi-mushi/cli@0.30.4
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe package has no npm install hook, and the credential sends inspected are directed to the configured Mushi API, whose default is the package's service endpoint. Agent configuration changes occur through CLI setup/connect flows, and the wizard's additional connect step is prompted; no concrete attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs `mushi setup` or `mushi connect`; the wizard's follow-on connect action requires confirmation.
Impact
No unauthorized credential disclosure, agent control change, or persistent payload behavior was established.
Mechanism
The CLI sends project SDK credentials to its configured Mushi API and can write MCP entries for the selected client.
AI rationale
The package has no npm install hook, and the credential sends inspected are directed to the configured Mushi API, whose default is the package's service endpoint. Agent configuration changes occur through CLI setup/connect flows, and the wizard's additional connect step is prompted; no concrete attack behavior was found.
Network endpoints1
dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and has no npm install lifecycle hook.
- The CLI uses a Mushi API endpoint by default; alternate endpoints come from CLI options, environment settings, or saved configuration.
- The setup flow sends SDK credentials to that endpoint; sending a test report requires confirmation or an explicit noninteractive option.
- Agent configuration checks and writes are part of setup or connect commands; the wizard's follow-on connect action asks before proceeding.
- Inspected child-process calls support package installation or upgrades and local key-permission handling; no malicious execution chain was found.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/chunk-SV6HHYWE.jsView file
54import { randomUUID } from "crypto";
L55: import { spawnSync } from "child_process";
L56: import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-SV6HHYWE.jsView on unpkg · L54dist/index.jsView file
84import * as p from "@clack/prompts";
L85: import { spawn } from "child_process";
L86: import { randomUUID } from "crypto";
...
L94: let end = endpoint.length;
L95: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L96: return endpoint.slice(0, end);
L97: }
L98: async function deviceFetch(url, init = {}) {
L99: const controller = new AbortController();
...
L111: headers: { "Content-Type": "application/json" },
L112: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L113: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L84Findings
3 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/chunk-26JWYLCK.js
HighChild Processdist/chunk-SV6HHYWE.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.30.4.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.30.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.