registry / @mutmutco/claude-plugin / 4.5.174
@mutmutco/claude-plugin@4.5.174
MMI workflow skills and org gates delivery.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe scanner’s exfiltration and agent-configuration hints resolve to limited CLI telemetry, an explicit Hub authentication flow, and marketplace pin restoration after an explicit repair command. The manifest has no install-time lifecycle hook, and the inspected source does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
CLI telemetry runs when a CLI command is invoked; Hub authentication runs through the explicit whoami command; marketplace pin restoration follows a successful plugin repair.
Impact
No confirmed malicious effect or unrelated credential transfer was established.
Mechanism
The inspected network calls send limited command telemetry or exchange a GitHub token for a Hub session. Marketplace repair restores saved settings for the named MMI marketplaces.
AI rationale
The scanner’s exfiltration and agent-configuration hints resolve to limited CLI telemetry, an explicit Hub authentication flow, and marketplace pin restoration after an explicit repair command. The manifest has no install-time lifecycle hook, and the inspected source does not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json contains no lifecycle scripts; the package ships a CLI bundle.
- The cited marketplace code targets Claude’s known-marketplaces file and names the MMI marketplaces; it restores saved pins after a successful repair.
- Marketplace repair is exposed as an explicit CLI command.
- CLI telemetry runs on command invocation and sends the command, version, CI status, and operating system to the Hub endpoint.
- The explicit whoami command exchanges a GitHub token for a Hub session; the inspected source does not show unrelated credential collection or transfer.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcecli/dist/main.cjsView file
39Source sends the broad process environment to a literal external destination.
L39: function defaultHubUrl() {
L40: return process.env.MMI_HUB_URL || DEFAULT_HUB_URL;
L41: }
...
L45: "use strict";
L46: DEFAULT_HUB_URL = "https://tqxxwzftic.execute-api.eu-central-1.amazonaws.com";
L47: }
...
L73: // src/client-version.ts
L74: function [redacted](distDir = __dirname) {
L75: return [
L76: (0, import_node_path.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
L77: (0, import_node_path.join)(distDir, "..", "package.json")
L78: ];
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
cli/dist/main.cjsView on unpkg · L3939function defaultHubUrl() {
L40: return process.env.MMI_HUB_URL || DEFAULT_HUB_URL;
L41: }
...
L45: "use strict";
L46: DEFAULT_HUB_URL = "https://tqxxwzftic.execute-api.eu-central-1.amazonaws.com";
L47: }
...
L73: // src/client-version.ts
L74: function [redacted](distDir = __dirname) {
L75: return [
L76: (0, import_node_path.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
L77: (0, import_node_path.join)(distDir, "..", "package.json")
L78: ];
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli/dist/main.cjsView on unpkg · L39Findings
2 Critical3 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli/dist/main.cjs
CriticalCredential Exfiltrationcli/dist/main.cjs
HighChild Processcli/dist/main.cjs
HighCommand Output Exfiltrationcli/dist/main.cjs
HighSemantic Analysis Limitedcli/dist/main.cjs
MediumDynamic Requirecli/dist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/mmi-cli.cmd
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @mutmutco/claude-plugin@4.5.174.
See all versions of @mutmutco/claude-plugin for other recorded verdicts.
- Review the evidence and your use of @mutmutco/claude-plugin@4.5.174 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.