@mushi-mushi/cli@0.35.6
Mushi Mushi CLI: SDK setup, MCP wiring, triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source shows opt-out runtime telemetry sent to the package’s service without disclosure in the README, which warrants a warning. The credential and test-report flows inspected are consistent with user-run setup and do not establish malicious exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Successful CLI setup; a separate funnel event also follows successful MCP setup.
Impact
The service receives project-scoped setup activity. No exfiltration of project files or unrelated credentials was established.
Mechanism
POSTs to `/v1/cli/funnel` with the Mushi API key and project ID in headers and event/source metadata in the body; the wizard event includes the framework.
AI rationale
The source shows opt-out runtime telemetry sent to the package’s service without disclosure in the README, which warrants a warning. The credential and test-report flows inspected are consistent with user-run setup and do not establish malicious exfiltration.
Evidence
dist/index.jsdist/chunk-LGGE3LH7.js
Network endpoints2
dxptnwrhwsqckaftyymj.supabase.co/functions/v1/apiMUSHI_API_ENDPOINT (when configured)
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After setup, the CLI sends a `wizard_env_written` funnel event with framework metadata to the configured Mushi API.
- The funnel event is on by default and has a `MUSHI_NO_TELEMETRY` opt-out; the README describes the wizard but does not disclose this event.
- The separate test report is prompted for during interactive setup, and the README says the wizard offers it.
- An explicitly supplied Anthropic key is passed to `supabase secrets set`, consistent with setting a secret in the user’s Supabase project.
- The manifest exposes a CLI and lists build, lint, test and typecheck scripts; it declares no install lifecycle hook.
Evidence against
- The observed funnel event contains an event name, source and framework metadata; the inspected code does not show it collecting project files or unrelated credentials.
- The test report is sent only after confirmation, or when the user selects the noninteractive `--yes` path.
- The credential flows inspected are tied to the relevant services and user-run setup or account commands.
Behavioral surface
Source & flagged code
10 flaggeddist/chunk-VL5G2VOL.jsView file
224import { randomUUID } from "crypto";
L225: import { spawnSync } from "child_process";
L226: import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
High
Child Process
Package source references child process execution.
dist/chunk-VL5G2VOL.jsView on unpkg · L224dist/chunk-BFFT5ZV4.jsView file
392}
L393: var COMMAND_LIKE = /\b(?:curl|wget|nc|bash -c|sh -c|python3? -c|node -e|base64 -d|rm -rf|printenv)\b|\|\s*(?:sh|bash)\b|ignore (?:all |previous )?instructions/i;
L394: function earlierAttemptsBlock(items) {
High
dist/index.jsView file
Findings
2 Critical7 High4 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/chunk-VL5G2VOL.js
HighShelldist/chunk-BFFT5ZV4.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @mushi-mushi/cli@0.35.6.
See all versions of @mushi-mushi/cli for other recorded verdicts.
- Review the evidence and your use of @mushi-mushi/cli@0.35.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.