registry / @mutmutco/cli / 4.5.89

@mutmutco/cli@4.5.89

⚠ Under review

MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 2.47 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.hetzner.cloud, api.vercel.com, cli.github.com, github.com, registry.npmjs.org, strategy.mutmut.work, tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Source & flagged code

5 flagged

dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/cli@4.3.36 matchedIdentity = npm:QG11dG11dGNvL2NsaQ:4.3.36 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main.cjsView on unpkg

1109if (process.platform === "win32") { L1110: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1111: } else {

High

Child Process

Package source references child process execution.

dist/main.cjsView on unpkg · L1109

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.cjsView on unpkg · L39

dist/index.cjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

4// src/client-version.ts

5var import_node_fs = require("node:fs");

6var import_node_path = require("node:path");

Source & flagged code

5 flagged · loading source

dist/main.cjsView file

@mutmutco/cli@4.5.89

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code