registry / @mushi-mushi/cli / 0.35.4
@mushi-mushi/cli@0.35.4
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the inspected credential flow validates a prompted Mushi key before using it with the resolved Mushi API. The flagged persistence and process execution are part of explicit CLI commands; no unrelated credential exfiltration or automatic malicious action was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when a user invokes it; onboarding and setup actions occur through its commands.
Impact
No automatic collection or transmission of unrelated credentials or project data was found in the inspected flows.
Mechanism
Credential verification uses the resolved endpoint, which defaults to the Mushi Supabase API and can be overridden through MUSHI_API_ENDPOINT. Setup telemetry is sent to that endpoint and has an opt-out.
AI rationale
The manifest has no install lifecycle hooks, and the inspected credential flow validates a prompted Mushi key before using it with the resolved Mushi API. The flagged persistence and process execution are part of explicit CLI commands; no unrelated credential exfiltration or automatic malicious action was found.
Network endpoints2
dxptnwrhwsqckaftyymj.supabase.cokensaur.us
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install, preinstall, or postinstall hook; its scripts are build, lint, test, and typecheck.
- Onboarding prompts for a Mushi-formatted API key and validates its format.
- Credential verification sends the Mushi SDK key and project ID to the resolved Mushi API endpoint.
- The setup funnel event is sent to the configured Mushi endpoint and can be disabled with MUSHI_NO_TELEMETRY.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/chunk-ED3OCCXS.jsView file
224import { randomUUID } from "crypto";
L225: import { spawnSync } from "child_process";
L226: import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-ED3OCCXS.jsView on unpkg · L224dist/chunk-VZIANKUF.jsView file
392}
L393: var COMMAND_LIKE = /\b(?:curl|wget|nc|bash -c|sh -c|python3? -c|node -e|base64 -d|rm -rf|printenv)\b|\|\s*(?:sh|bash)\b|ignore (?:all |previous )?instructions/i;
L394: function earlierAttemptsBlock(items) {
High
dist/index.jsView file
Findings
2 Critical7 High4 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/chunk-ED3OCCXS.js
HighShelldist/chunk-VZIANKUF.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.35.4.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.35.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.