registry / @mushi-mushi/cli / 0.34.0
@mushi-mushi/cli@0.34.0
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection shows normal CLI setup and Mushi API authentication, with explicit endpoint configuration for self-hosting and a prompt or explicit option for the test report. Scanner hints about credential transfer and command execution did not establish an unrelated recipient or another concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running setup or login activates credential checks and setup requests; sending the test report requires an affirmative prompt, an explicit send option, or --yes.
Impact
The inspected source did not establish an unrelated credential recipient, covert command-output transfer, install hook, or unrequested account action.
Mechanism
Browser sign-in obtains a CLI token through device authorization, and supplied API keys are checked for ingest-only scope. Requests use the resolved API endpoint, with custom endpoints explicitly supported for self-hosting.
AI rationale
Source inspection shows normal CLI setup and Mushi API authentication, with explicit endpoint configuration for self-hosting and a prompt or explicit option for the test report. Scanner hints about credential transfer and command execution did not establish an unrelated recipient or another concrete attack.
Evidence
package.jsondist/index.jsdist/init.jsdist/chunk-LGGE3LH7.jsdist/chunk-VECP4KOK.jsdist/chunk-OS2ZLURO.js
Network endpoints1
dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI binary and defines no preinstall, install, or postinstall hook.
- The default API is Mushi’s cloud endpoint; custom endpoints can be supplied for self-hosting, and nonlocal endpoints must use HTTPS.
- Browser sign-in uses device authorization to obtain a CLI token and mint project keys; manually supplied API keys are checked for ingest-only scope.
- The test report is sent only after an affirmative prompt, an explicit send option, or --yes, and goes to the resolved API endpoint with the project SDK key.
- The setup funnel event goes to that same resolved endpoint and can be disabled with MUSHI_NO_TELEMETRY.
- The inspected prompt, command parser, and keyring dependency files show ordinary UI, argument parsing, and local keychain behavior.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
9 flaggeddist/index.jsView file
87import * as p from "@clack/prompts";
L88: import { spawn } from "child_process";
L89: import { randomUUID } from "crypto";
...
L97: let end = endpoint.length;
L98: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L99: return endpoint.slice(0, end);
L100: }
L101: async function deviceFetch(url, init = {}) {
L102: const controller = new AbortController();
...
L114: headers: { "Content-Type": "application/json" },
L115: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L116: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L877198if (!/^[A-Za-z0-9._-]{1,64}$/.test(safe)) {
L7199: process.stderr.write("error: profile name must be 1\u201364 chars of [A-Za-z0-9._-]\n");
L7200: process.exit(2);
...
L7209: // src/commands/radar.ts
L7210: import { execFileSync } from "child_process";
L7211: import { resolve as resolve4 } from "path";
L7212:
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L719887Trigger-reachable chain: manifest.exports -> dist/index.js
L87: import * as p from "@clack/prompts";
L88: import { spawn } from "child_process";
L89: import { randomUUID } from "crypto";
...
L97: let end = endpoint.length;
L98: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L99: return endpoint.slice(0, end);
L100: }
L101: async function deviceFetch(url, init = {}) {
L102: const controller = new AbortController();
...
L114: headers: { "Content-Type": "application/json" },
L115: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L116: });
Findings
4 Critical5 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/chunk-VECP4KOK.js
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.34.0.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.34.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.