@mutmutco/claude-plugin@4.5.104: Clean npm security report

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The manifest declares no lifecycle hooks. Inspected bundled behavior is consistent with CLI telemetry and a user-invoked update flow, and the agent-path finding concerns filtering untracked paths rather than changing agent settings.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Telemetry runs when a CLI command is invoked; self-update runs when a train command detects a stale CLI.

Impact

The inspected flows do not establish credential theft, unconsented install-time mutation, or agent configuration changes.

Mechanism

Telemetry sends command and basic runtime metadata to the configured MMI Hub. The update flow installs a versioned @mutmutco/cli release and resumes the invoked command.

AI rationale

The manifest declares no lifecycle hooks. Inspected bundled behavior is consistent with CLI telemetry and a user-invoked update flow, and the agent-path finding concerns filtering untracked paths rather than changing agent settings.

Network endpoints1

tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json contains no lifecycle scripts and ships the plugin and CLI files.
The agent configuration paths are used to exempt untracked agent settings from a Git cleanliness check; the inspected code does not modify them.
CLI telemetry sends the invoked command, version, CI status, and operating system to the configured MMI Hub, with an environment opt-out.
The CLI self-update flow installs @mutmutco/cli only when a user-invoked train command finds the CLI stale.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 5 file(s), 2.56 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.hetzner.cloud, api.vercel.com, cli.github.com, github.com, npm.pkg.github.com, registry.npmjs.org, strategy.mutmut.work, tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Source & flagged code

7 flagged

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/claude-plugin@4.5.160 matchedIdentity = npm:QG11dG11dGNvL2NsYXVkZS1wbHVnaW4:4.5.160 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1111if (process.platform === "win32") { L1112: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1113: } else {

High

Child Process

Package source references child process execution.

cli/dist/main.cjsView on unpkg · L1111

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/dist/main.cjsView on unpkg · L39

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/dist/main.cjsView on unpkg

cli/dist/index.cjsView file

4// src/client-version.ts L5: var import_node_fs = require("node:fs"); L6: var import_node_path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/dist/index.cjsView on unpkg · L4

bin/mmi-cli.cmdView file

•path = bin/mmi-cli.cmd kind = build_helper sizeBytes = 150 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/mmi-cli.cmdView on unpkg

Source & flagged code

7 flagged · loading source

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/claude-plugin@4.5.160 matchedIdentity = npm:QG11dG11dGNvL2NsYXVkZS1wbHVnaW4:4.5.160 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1111if (process.platform === "win32") { L1112: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1113: } else {

Findings

2 Critical3 High5 Medium4 Low

CriticalCredential Exfiltrationcli/dist/main.cjs

CriticalPrevious Version Dangerous Deltacli/dist/main.cjs

HighChild Processcli/dist/main.cjs

HighCommand Output Exfiltrationcli/dist/main.cjs

HighSemantic Analysis Limitedcli/dist/main.cjs

MediumDynamic Requirecli/dist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/mmi-cli.cmd

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mutmutco

Behavioral surface

Related packages

More from @mutmutco

Source & flagged code