registry / Credential exfiltration / @mutmutco/claude-plugin
@mutmutco/claude-plugin
MMI workflow skills and org gates delivery.
This report shows the evidence for @mutmutco/claude-plugin@4.5.157. 3 of 228 known versions are blocked or flagged. The newest version, 4.5.184, is allowed. See all versions.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe source verifies automatic disclosure of an existing GitHub credential to the publisher-selected default endpoint during ordinary Hub authentication. This supports blocking the package as credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A Hub-backed CLI command needs authentication, no usable Hub session is cached, and MMI_HUB_TOKEN is unset.
Impact
The Hub recipient receives the user's GitHub credential, which may permit account actions within that token's scopes.
Mechanism
The CLI reads a token from its environment or GitHub CLI login and posts it as a bearer credential to the Hub auth-session endpoint.
Attack narrative
When a Hub-backed command needs a new session, the CLI obtains a preexisting GitHub token from the environment or `gh auth token` and sends it to the bundled default Hub endpoint. The source shows no recipient-specific consent gate on that transfer. This exposes the GitHub credential to the package-selected Hub recipient.
AI rationale
The source verifies automatic disclosure of an existing GitHub credential to the publisher-selected default endpoint during ordinary Hub authentication. This supports blocking the package as credential exfiltration.
Evidence
cli/dist/main.cjs
Network endpoints1
tqxxwzftic.execute-api.eu-central-1.amazonaws.com/auth/session
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- cli/dist/main.cjs reads GitHub tokens from environment variables or runs gh auth token when those are absent.
- The CLI uses a bundled MMI Hub endpoint by default.
- When the session cache cannot be used, the CLI sends the GitHub token as a bearer credential to the Hub auth-session endpoint.
- Hub-backed requests obtain a Hub session through this helper without a recipient-specific disclosure prompt.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flagged · loading sourcecli/dist/main.cjsView file
39Source sends the broad process environment to a literal external destination.
L39: function globalDispatcher() {
L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
L41: }
...
L80: try {
L81: stream.write("", () => resolve8());
L82: } catch {
...
L88: await Promise.race([
L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
L90: new Promise((resolve8) => {
...
L140: CLI_EXIT_WATCHDOG_MS = (() => {
L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
cli/dist/main.cjsView on unpkg · L3939function globalDispatcher() {
L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
L41: }
...
L80: try {
L81: stream.write("", () => resolve8());
L82: } catch {
...
L88: await Promise.race([
L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
L90: new Promise((resolve8) => {
...
L140: CLI_EXIT_WATCHDOG_MS = (() => {
L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli/dist/main.cjsView on unpkg · L39Findings
2 Critical5 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli/dist/main.cjs
CriticalCredential Exfiltrationcli/dist/main.cjs
HighChild Processcli/dist/main.cjs
HighCommand Output Exfiltrationcli/dist/main.cjs
HighSemantic Analysis Limitedcli/dist/main.cjs
HighKnown Malware Source Similaritycli/dist/main.cjs
HighKnown Malware Source Fingerprint Signaturecli/dist/main.cjs
MediumDynamic Requirecli/dist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/mmi-cli.cmd
MediumStructural Risk Force Deep Review
LowFilesystem
Affected versions and remediation
This report applies to @mutmutco/claude-plugin@4.5.157.
The versions list below shows the verdict for each recorded version.
- Avoid installing @mutmutco/claude-plugin@4.5.157. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.