@mutmutco/codex-plugin@4.5.90
MMI workflow skills and org gates delivery.
AI Security Review
scanned 5d ago · by lpm-firewall-aiSource inspection confirms an existing GitHub credential is sent to a package-selected Hub endpoint without recipient-specific consent or destination validation. This is a credential disclosure risk and supports blocking publication, although it is triggered by CLI authentication rather than package installation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A Hub-authenticated CLI operation runs, no MMI_HUB_TOKEN or valid cached session is available, and a GitHub token can be read.
Impact
The endpoint operator can receive the GitHub credential and the access permitted by its scopes.
Mechanism
The CLI obtains a token from GH_TOKEN, GITHUB_TOKEN, or the GitHub CLI, then sends it as a bearer credential to the configured Hub session endpoint.
Attack narrative
During Hub authentication, the CLI reads a saved GitHub credential and sends it to the Hub session endpoint as a bearer token. The default endpoint is selected by the package, and MMI_HUB_URL can redirect the transfer without an origin check or recipient-specific confirmation. The receiving endpoint can obtain the GitHub credential and any access its scopes allow.
AI rationale
Source inspection confirms an existing GitHub credential is sent to a package-selected Hub endpoint without recipient-specific consent or destination validation. This is a credential disclosure risk and supports blocking publication, although it is triggered by CLI authentication rather than package installation.
Evidence
cli/dist/main.cjs
Network endpoints2
tqxxwzftic.execute-api.eu-central-1.amazonaws.com/auth/sessionMMI_HUB_URL/auth/session
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI reads existing GitHub credentials from environment variables or the GitHub CLI.
- The Hub URL defaults to the product backend, but MMI_HUB_URL can redirect it; URL normalization only removes a trailing slash.
- When creating a Hub session, the CLI sends the GitHub token as a bearer credential to the configured endpoint’s session path.
- The whoami command reaches this session flow, and shared Hub requests use the same authentication helper.
- The package manifest declares no lifecycle scripts, so this exposure occurs when CLI authentication runs.
- The flagged agent-configuration path is used to classify untracked paths in clean-tree logic, not to write agent configuration.
Evidence against
- The credential transfer is part of runtime Hub authentication rather than an automatic npm install hook.
- The inspected agent-configuration path does not establish a separate attack surface.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
7 flagged · loading sourcecli/dist/main.cjsView file
39function globalDispatcher() {
L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
L41: }
...
L80: try {
L81: stream.write("", () => resolve7());
L82: } catch {
...
L88: await Promise.race([
L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
L90: new Promise((resolve7) => {
...
L140: CLI_EXIT_WATCHDOG_MS = (() => {
L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli/dist/main.cjsView on unpkg · L39•matchType = previous_version_dangerous_delta
matchedPackage = @mutmutco/codex-plugin@4.5.84
matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84
similarity = 1.000
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli/dist/main.cjsView on unpkg1111if (process.platform === "win32") {
L1112: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
L1113: } else {
Findings
2 Critical3 High5 Medium4 Low
CriticalCredential Exfiltrationcli/dist/main.cjs
CriticalPrevious Version Dangerous Deltacli/dist/main.cjs
HighChild Processcli/dist/main.cjs
HighCommand Output Exfiltrationcli/dist/main.cjs
HighSemantic Analysis Limitedcli/dist/main.cjs
MediumDynamic Requirecli/dist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/mmi-cli.cmd
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @mutmutco/codex-plugin@4.5.90.
See all versions of @mutmutco/codex-plugin for other recorded verdicts.
- Avoid installing @mutmutco/codex-plugin@4.5.90. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.