@mushi-mushi/cli@0.35.3
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package sends runtime funnel telemetry during setup by default, and the inspected README does not disclose it; MUSHI_NO_TELEMETRY provides an opt-out. The event payload is limited to event, source, and metadata sent to the configured Mushi endpoint, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The setup wizard sends a funnel event by default; it can be disabled with MUSHI_NO_TELEMETRY.
- The event contains an event name, source, and metadata, and is sent to the configured Mushi endpoint.
- The manifest has no install, preinstall, or postinstall hook.
- The reported worker persistence is part of an explicit `worker install` command that previews the changes and asks for confirmation unless `--yes` is passed.
- The setup wizard's test report is prompted by default and supports disabling it.
Source & flagged code
11 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-AWAWVAQN.jsView on unpkgPackage source references child process execution.
dist/chunk-AWAWVAQN.jsView on unpkg · L21Package source references shell execution.
dist/chunk-AWAWVAQN.jsFindings
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.35.3.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.35.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.