registry / @mushi-mushi/cli / 0.35.2
@mushi-mushi/cli@0.35.2
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe scanner leads resolve to purpose-specific CLI behavior: store credentials are used for store listing retrieval, and worker persistence is initiated by an explicit command with confirmation by default. The manifest has no install lifecycle hook, and the inspected code does not show credentials sent to an unrelated host.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User invokes a relevant CLI command, such as store pull or worker install.
Impact
No malicious impact identified in the inspected source.
Mechanism
Store pull uses supplied Apple or Google credentials for listing retrieval. Worker install previews the planned writes and prompts before proceeding by default.
AI rationale
The scanner leads resolve to purpose-specific CLI behavior: store credentials are used for store listing retrieval, and worker persistence is initiated by an explicit command with confirmation by default. The manifest has no install lifecycle hook, and the inspected code does not show credentials sent to an unrelated host.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares build, lint, test, and typecheck scripts; it has no install lifecycle hook.
- The store pull command reads Apple and Google credentials from explicitly named options or environment variables and uses them to pull the configured app listings.
- Worker installation requires an explicit command and asks for confirmation before writing configuration or creating a worker key, unless the user passes --yes.
Evidence against
- The package describes itself as a CLI for SDK setup, MCP wiring, and bug triage.
- The flagged credential and persistence behaviors appear within purpose-specific commands rather than an install hook.
- No credential exfiltration, unrelated collector, or unrequested account action was identified in the inspected paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
10 flaggeddist/chunk-VAQTC77F.jsView file
21import { createHash } from "crypto";
L22: import { execFileSync } from "child_process";
L23: import { readFileSync, statfsSync } from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-VAQTC77F.jsView on unpkg · L21392}
L393: var COMMAND_LIKE = /\b(?:curl|wget|nc|bash -c|sh -c|python3? -c|node -e|base64 -d|rm -rf|printenv)\b|\|\s*(?:sh|bash)\b|ignore (?:all |previous )?instructions/i;
L394: function earlierAttemptsBlock(items) {
High
dist/index.jsView file
109import * as p from "@clack/prompts";
L110: import { spawn } from "child_process";
L111: import { randomUUID } from "crypto";
...
L115: // src/hosting-env-hint.ts
L116: var LOVABLE_BOLT_DOCS = "https://kensaur.us/mushi-mushi/docs/quickstart/lovable-bolt";
L117: function envVarNames(block) {
...
L139: let end = endpoint.length;
L140: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L141: return endpoint.slice(0, end);
...
L156: headers: { "Content-Type": "application/json" },
L157: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L158: });
Findings
2 Critical7 High4 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/chunk-VAQTC77F.js
HighShelldist/chunk-VAQTC77F.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.35.2.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.35.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.