@mutmutco/codex-plugin@4.5.156
MMI workflow skills and org gates delivery.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThis is a conditional credential-exposure risk because the CLI sends a locally available GitHub token to a Hub endpoint that is not bound to GitHub and has no visible recipient-specific confirmation. The Hub-login flow and session cache provide product context, but do not resolve the token’s exposure to the default or overridden destination.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user invokes `whoami` or a Hub-backed CLI feature when no valid session is cached.
Impact
The receiving endpoint gets the GitHub token, which may grant access beyond the Hub session; the source shows no recipient-specific confirmation or destination allowlist.
Mechanism
The CLI obtains a GitHub token and posts it as a Bearer credential to the Hub session endpoint, using a publisher-selected default URL or an MMI_HUB_URL override.
AI rationale
This is a conditional credential-exposure risk because the CLI sends a locally available GitHub token to a Hub endpoint that is not bound to GitHub and has no visible recipient-specific confirmation. The Hub-login flow and session cache provide product context, but do not resolve the token’s exposure to the default or overridden destination.
Evidence
cli/dist/main.cjs
Network endpoints1
tqxxwzftic.execute-api.eu-central-1.amazonaws.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json contains no lifecycle scripts; it lists plugin and CLI files for distribution.
- The flagged .codex path is used to classify agent-config paths, and only untracked paths are exempted from a cleanliness check; this code does not edit agent settings.
- The CLI can read GitHub credentials from environment variables or `gh auth token`.
- The Hub URL defaults to a package-selected endpoint and accepts an MMI_HUB_URL override without a visible destination allowlist.
- On a cache miss, the CLI sends the GitHub token as a Bearer credential to the Hub session endpoint.
- The `whoami` command and Hub-backed request wrapper can reach this exchange; returned sessions are cached against the Hub URL and token fingerprint.
Evidence against
- The exchange is structured as a Hub session login, and a valid cached session can avoid another token transfer.
- The package has no npm install hook, and the flagged agent-config code does not mutate agent settings.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
9 flagged · loading sourcecli/dist/main.cjsView file
39Source sends the broad process environment to a literal external destination.
L39: function globalDispatcher() {
L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
L41: }
...
L80: try {
L81: stream.write("", () => resolve8());
L82: } catch {
...
L88: await Promise.race([
L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
L90: new Promise((resolve8) => {
...
L140: CLI_EXIT_WATCHDOG_MS = (() => {
L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
cli/dist/main.cjsView on unpkg · L3939function globalDispatcher() {
L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
L41: }
...
L80: try {
L81: stream.write("", () => resolve8());
L82: } catch {
...
L88: await Promise.race([
L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
L90: new Promise((resolve8) => {
...
L140: CLI_EXIT_WATCHDOG_MS = (() => {
L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli/dist/main.cjsView on unpkg · L39Findings
2 Critical5 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli/dist/main.cjs
CriticalCredential Exfiltrationcli/dist/main.cjs
HighChild Processcli/dist/main.cjs
HighCommand Output Exfiltrationcli/dist/main.cjs
HighSemantic Analysis Limitedcli/dist/main.cjs
HighKnown Malware Source Similaritycli/dist/main.cjs
HighKnown Malware Source Fingerprint Signaturecli/dist/main.cjs
MediumDynamic Requirecli/dist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/mmi-cli.cmd
MediumStructural Risk Force Deep Review
LowFilesystem
Affected versions and remediation
This report applies to @mutmutco/codex-plugin@4.5.156.
See all versions of @mutmutco/codex-plugin for other recorded verdicts.
- Review the evidence and your use of @mutmutco/codex-plugin@4.5.156 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.