registry / @mutmutco/claude-plugin / 4.5.184
@mutmutco/claude-plugin@4.5.184
MMI workflow skills and org gates delivery.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the flagged runtime behaviors are bounded product operations: Hub authentication, limited CLI telemetry, explicit marketplace repair, and a caller-selected artifact upload. The inspected source does not establish credential theft, unrelated data exfiltration, or unconsented agent configuration abuse.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Telemetry runs with a CLI command; marketplace repair and artifact upload require their respective CLI commands.
Impact
No confirmed malicious impact was established from these package-aligned and user-invoked operations.
Mechanism
Telemetry posts command, version, CI status, and operating system to the Hub, with an opt-out. Artifact upload streams only the caller-supplied path to a Hub-issued HTTPS grant.
AI rationale
The manifest has no install lifecycle hooks, and the flagged runtime behaviors are bounded product operations: Hub authentication, limited CLI telemetry, explicit marketplace repair, and a caller-selected artifact upload. The inspected source does not establish credential theft, unrelated data exfiltration, or unconsented agent configuration abuse.
Evidence
.claude/plugins/known_marketplaces.json
Network endpoints2
tqxxwzftic.execute-api.eu-central-1.amazonaws.com/telemetry/cli-calltqxxwzftic.execute-api.eu-central-1.amazonaws.com/auth/session
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest names this release and contains no lifecycle scripts.
- The flagged Claude marketplace path is used to preserve marketplace settings during plugin repair; repair is exposed through the explicit plugin-heal command.
- GitHub credentials are used to request a session from the configured MMI Hub endpoint, whose default is the package's Hub service.
- CLI telemetry sends the command path, version, CI status, and operating system to the Hub when a CLI command runs; MMI_TELEMETRY=off disables it.
- File upload requires the explicit tenant artifact put command and streams the supplied path to a Hub-issued HTTPS upload grant.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcecli/dist/main.cjsView file
39Source sends the broad process environment to a literal external destination.
L39: function defaultHubUrl() {
L40: return process.env.MMI_HUB_URL || DEFAULT_HUB_URL;
L41: }
...
L45: "use strict";
L46: DEFAULT_HUB_URL = "https://tqxxwzftic.execute-api.eu-central-1.amazonaws.com";
L47: }
...
L73: // src/client-version.ts
L74: function [redacted](distDir = __dirname) {
L75: return [
L76: (0, import_node_path.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
L77: (0, import_node_path.join)(distDir, "..", "package.json")
L78: ];
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
cli/dist/main.cjsView on unpkg · L3939function defaultHubUrl() {
L40: return process.env.MMI_HUB_URL || DEFAULT_HUB_URL;
L41: }
...
L45: "use strict";
L46: DEFAULT_HUB_URL = "https://tqxxwzftic.execute-api.eu-central-1.amazonaws.com";
L47: }
...
L73: // src/client-version.ts
L74: function [redacted](distDir = __dirname) {
L75: return [
L76: (0, import_node_path.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
L77: (0, import_node_path.join)(distDir, "..", "package.json")
L78: ];
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli/dist/main.cjsView on unpkg · L39Findings
2 Critical4 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli/dist/main.cjs
CriticalCredential Exfiltrationcli/dist/main.cjs
HighChild Processcli/dist/main.cjs
HighCommand Output Exfiltrationcli/dist/main.cjs
HighSemantic Analysis Limitedcli/dist/main.cjs
HighKnown Malware Source Similaritycli/dist/main.cjs
MediumDynamic Requirecli/dist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/mmi-cli.cmd
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mutmutco/claude-plugin@4.5.184.
See all versions of @mutmutco/claude-plugin for other recorded verdicts.
- Review the evidence and your use of @mutmutco/claude-plugin@4.5.184 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.