@mutmutco/claude-plugin@4.5.140
MMI workflow skills and org gates delivery.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe GitHub token exchange is ordinary authentication when sent to the product Hub, but the unrestricted `MMI_HUB_URL` override can redirect that credential without recipient-specific consent. This supports a warning for conditional credential exposure, not a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A CLI command that requests Hub authentication, such as `whoami`, when no matching cached session is available and `MMI_HUB_URL` is set.
Impact
A configured recipient could receive the GitHub credential; the default URL is the product Hub, so the risk depends on the override’s destination.
Mechanism
The CLI obtains a GitHub token from the environment or `gh auth token` and sends it as a bearer credential to the selected URL’s `/auth/session` endpoint.
AI rationale
The GitHub token exchange is ordinary authentication when sent to the product Hub, but the unrestricted `MMI_HUB_URL` override can redirect that credential without recipient-specific consent. This supports a warning for conditional credential exposure, not a publish block.
Evidence
cli/dist/main.cjs
Network endpoints1
tqxxwzftic.execute-api.eu-central-1.amazonaws.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package manifest has no lifecycle scripts; the CLI package exposes a command entrypoint and lists only build, test, and typecheck scripts.
- The CLI reads GitHub credentials from environment variables or `gh auth token`.
- The Hub URL can be overridden with `MMI_HUB_URL`; its default is the product Hub.
- On a cache miss, Hub session authentication sends the GitHub token as a bearer credential to the selected URL’s `/auth/session` endpoint.
- The `whoami` command invokes this authentication flow, and Hub API calls use the same URL selection and session helper.
- The flagged agent configuration location only defines path classifications; it does not itself write agent configuration.
Evidence against
- The session exchange is an explicit Hub authentication flow, and the default recipient is the product Hub.
- The inspected telemetry payload contains command, version, CI status, and operating system, with an environment variable that disables it.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
7 flagged · loading sourcecli/dist/main.cjsView file
39function globalDispatcher() {
L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
L41: }
...
L80: try {
L81: stream.write("", () => resolve8());
L82: } catch {
...
L88: await Promise.race([
L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
L90: new Promise((resolve8) => {
...
L140: CLI_EXIT_WATCHDOG_MS = (() => {
L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli/dist/main.cjsView on unpkg · L39•matchType = previous_version_dangerous_delta
matchedPackage = @mutmutco/claude-plugin@4.5.84
matchedIdentity = npm:QG11dG11dGNvL2NsYXVkZS1wbHVnaW4:4.5.84
similarity = 1.000
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli/dist/main.cjsView on unpkg1115if (process.platform === "win32") {
L1116: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
L1117: } else {
Findings
2 Critical3 High5 Medium4 Low
CriticalCredential Exfiltrationcli/dist/main.cjs
CriticalPrevious Version Dangerous Deltacli/dist/main.cjs
HighChild Processcli/dist/main.cjs
HighCommand Output Exfiltrationcli/dist/main.cjs
HighSemantic Analysis Limitedcli/dist/main.cjs
MediumDynamic Requirecli/dist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/mmi-cli.cmd
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @mutmutco/claude-plugin@4.5.140.
See all versions of @mutmutco/claude-plugin for other recorded verdicts.
- Review the evidence and your use of @mutmutco/claude-plugin@4.5.140 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.