registry / @mushi-mushi/cli / 0.35.5
@mushi-mushi/cli@0.35.5
Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential flows use the configured Mushi service endpoint, and the reviewed wizard report contains generic setup-test data. The manifest has no install lifecycle hook, and report sending is prompted unless explicitly enabled.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs a CLI command such as setup or a workflow task.
Impact
Expected setup and bug-triage behavior; no unrelated credential transfer or harmful automatic action was identified.
Mechanism
The CLI uses its configured Mushi endpoint for service requests; optional wizard telemetry can be disabled, and test-report sending is prompted unless explicitly enabled.
AI rationale
The flagged credential flows use the configured Mushi service endpoint, and the reviewed wizard report contains generic setup-test data. The manifest has no install lifecycle hook, and report sending is prompted unless explicitly enabled.
Network endpoints1
dxptnwrhwsqckaftyymj.supabase.co
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest lists only build, lint, test, and typecheck scripts; it has no install lifecycle hook.
- The init flow resolves its API endpoint from a command option, MUSHI_API_ENDPOINT, or saved config before acquiring and verifying credentials.
- Wizard funnel events go to that resolved endpoint, carry event metadata, and can be disabled with MUSHI_NO_TELEMETRY.
- The setup wizard asks before sending its generic test report unless the user explicitly sets sendTestReport or uses --yes.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/chunk-WFZTXEP3.jsView file
59import { randomUUID } from "crypto";
L60: import { spawnSync } from "child_process";
L61: import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-WFZTXEP3.jsView on unpkg · L59dist/index.jsView file
109import * as p from "@clack/prompts";
L110: import { spawn } from "child_process";
L111: import { randomUUID } from "crypto";
...
L115: // src/hosting-env-hint.ts
L116: var LOVABLE_BOLT_DOCS = "https://kensaur.us/mushi-mushi/docs/quickstart/lovable-bolt";
L117: function envVarNames(block) {
...
L139: let end = endpoint.length;
L140: while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
L141: return endpoint.slice(0, end);
...
L156: headers: { "Content-Type": "application/json" },
L157: body: JSON.stringify(clientId ? { client_id: clientId } : {})
L158: });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L109Findings
2 Critical7 High4 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/chunk-WFZTXEP3.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Medium
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.35.5.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.35.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.