registry / Credential exfiltration / @pmate/cli
@pmate/cli
CLI utilities for the pMate project
This report shows the evidence for @pmate/cli@0.44.6. 2 of 68 known versions are blocked or flagged. The newest version, 0.46.2, is allowed. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe CLI automatically sends a HEBO-labeled credential to the PMate authentication service before handling any command, then persists the returned session token. This is credential exfiltration triggered by CLI startup.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting the CLI while HEBO_MEMORY_TOKEN is set, even when requesting help or version output.
Impact
A credential associated with another service is disclosed to PMate without an explicit login command, and the resulting session token is stored locally until process cleanup.
Mechanism
The CLI sends the environment token as a Bearer credential to auth-api-v2.pmate.chat, retrieves a PMate session, and writes its token to a temporary session file.
Attack narrative
On every CLI start, before parsing the requested command, the package checks for HEBO_MEMORY_TOKEN. If present, it sends that credential to auth-api-v2.pmate.chat as a Bearer token and writes the returned PMate session token to a temporary file. This forwards a credential from another service without an explicit login request.
AI rationale
The CLI automatically sends a HEBO-labeled credential to the PMate authentication service before handling any command, then persists the returned session token. This is credential exfiltration triggered by CLI startup.
Evidence
package.jsondist/index.jsos.tmpdir()/pmate-delegated-*/session.json
Network endpoints1
auth-api-v2.pmate.chat
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes dist/index.js as its CLI entrypoint.
- CLI startup calls ensureManagedSession before parsing arguments, including help and version requests.
- When HEBO_MEMORY_TOKEN is set, the code sends it as a Bearer token to auth-api-v2.pmate.chat.
- The returned session token is written to a temporary pmate-delegated session file.
Evidence against
- The credential flow only runs when HEBO_MEMORY_TOKEN is present.
- The manifest declares no install lifecycle scripts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090Trigger-reachable chain: scripts.start -> dist/index.js
L90: function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L909292// [redacted].ts
L9293: var import_node_child_process = require("child_process");
L9294: var import_node_path6 = __toESM(require("path"));
High
21330stdio: "inherit",
L21331: shell: true,
L21332: env: { ...process.env, ...env ?? {} }
High
16844async function loadChatSdk() {
L16845: const dynamicImport = new Function("specifier", "return import(specifier)");
L16846: return await dynamicImport("@pmate/chat-sdk/runtime");
High
16844async function loadChatSdk() {
L16845: const dynamicImport = new Function("specifier", "return import(specifier)");
L16846: return await dynamicImport("@pmate/chat-sdk/runtime");
...
L16856: const singular = args.type === "function" ? "Function" : "Worker";
L16857: const baseUrl2 = (args.baseUrl || process.env.PMATE_AGENT_API_BASE_URL || "https://agent-api.pmate.chat").replace(/\/+$/, "");
L16858: const token = readRequiredSession({ preferredApp: DEFAULT_APP_ID }).token;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L16844•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
(0, import_node_fs4.writeFileSync)(sessionPath, JSON.stringify(store, null, 2), {
function ensureWsProtocol(baseUrl2) {
if (/^wss?:\/\//i.test(baseUrl2))
return baseUrl2;
if (/^https:\/\//i.test(baseUrl2))
return baseUrl2.replace(/^https:/i, "wss:");
if (/^http:\/\//i.test(baseUrl2))
return baseUrl2.replace(/^http:/i, "ws:");
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg90function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L9090Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js
L90: function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/index.jsView on unpkg · L90•matchType = normalized_sha256
matchedPackage = @pmate/cli@0.42.2
matchedPath = dist/index.js
matchedIdentity = npm:QHBtYXRlL2NsaQ:0.42.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkgdist/templates/electron/agent-runtime.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @pmate/cli@0.44.5
matchedIdentity = npm:QHBtYXRlL2NsaQ:0.44.5
similarity = 0.947
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/templates/electron/agent-runtime.cjsView on unpkgFindings
3 Critical8 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/templates/electron/agent-runtime.cjs
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighKnown Malware Source Similaritydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @pmate/cli@0.44.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing @pmate/cli@0.44.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
68 known versions0.46.2latestClean—AllowPublishedNov 4, 2026, 10:22 AM0.46.1Clean—AllowPublishedNov 4, 2026, 10:17 AM0.46.0Clean—AllowPublishedNov 4, 2026, 10:05 AM0.45.4SuspiciousAI-agent capability abuseWarnPublishedNov 4, 2026, 8:19 AM0.45.3Clean—AllowPublishedNov 4, 2026, 4:23 AM0.45.2Clean—AllowPublishedNov 4, 2026, 4:19 AM0.45.1Clean—AllowPublishedNov 4, 2026, 3:53 AM0.45.0SuspiciousAI-agent capability abuseWarnPublishedNov 4, 2026, 3:33 AM0.44.11Clean—AllowPublishedNov 4, 2026, 3:13 AM0.44.10Clean—AllowPublishedNov 4, 2026, 3:05 AM0.44.9Clean—AllowPublishedNov 4, 2026, 2:50 AM0.44.7Clean—AllowPublishedNov 3, 2026, 10:39 AM0.44.6shownMaliciousCredential ExfiltrationBlockPublishedNov 3, 2026, 10:21 AM0.44.5Clean—AllowPublishedNov 3, 2026, 10:10 AM0.44.4Clean—AllowPublishedNov 3, 2026, 8:50 AM0.44.3Clean—AllowPublishedNov 3, 2026, 8:42 AM0.44.1Clean—AllowPublishedNov 3, 2026, 4:32 AM0.44.0Clean—AllowPublishedNov 3, 2026, 2:45 AM0.43.0Clean—AllowPublishedNov 3, 2026, 2:10 AM0.42.7Clean—AllowPublishedNov 2, 2026, 7:37 AM0.42.6Clean—AllowPublishedNov 2, 2026, 3:48 AM0.42.5Clean—AllowPublishedNov 2, 2026, 3:41 AM0.42.3Clean—AllowPublishedNov 1, 2026, 1:12 PM0.42.2MaliciousCredential ExfiltrationBlockPublishedNov 1, 2026, 12:27 PM0.42.0Clean—AllowPublishedOct 29, 2026, 2:42 AM0.41.1Scan Failed—AllowUnder ReviewOct 29, 2026, 1:54 AM0.41.0Clean—AllowPublishedOct 29, 2026, 1:47 AM0.40.0Scan Failed—AllowUnder ReviewOct 28, 2026, 5:03 PM0.39.0Scan Failed—AllowUnder ReviewOct 28, 2026, 4:23 PM0.38.6Scan Failed—AllowUnder ReviewOct 28, 2026, 12:33 PM0.38.5Scan Failed—AllowUnder ReviewOct 28, 2026, 12:30 PM0.38.4Scan Failed—AllowUnder ReviewOct 28, 2026, 12:26 PM0.38.1Clean—AllowPublishedOct 28, 2026, 10:53 AM0.38.0Clean—AllowPublishedOct 27, 2026, 10:09 AM0.37.2Manual Review—AllowUnder ReviewOct 23, 2026, 2:40 AM0.36.0SuspiciousCredential ExfiltrationWarnPublishedOct 15, 2026, 3:50 AM0.35.13Clean—AllowPublishedOct 15, 2026, 2:12 AM0.35.12Clean—AllowPublishedOct 14, 2026, 3:00 PM0.35.11Clean—AllowPublishedOct 13, 2026, 4:29 PM0.35.10Clean—AllowPublishedOct 13, 2026, 10:27 AM0.35.9Clean—AllowPublishedOct 12, 2026, 6:13 PM0.35.8Clean—AllowPublishedOct 12, 2026, 12:03 PM0.35.6SuspiciousCredential ExfiltrationWarnPublishedOct 11, 2026, 3:36 PM0.35.5SuspiciousCredential ExfiltrationWarnPublishedOct 11, 2026, 3:23 PM0.35.4Clean—AllowPublishedOct 11, 2026, 2:55 PM0.35.1Clean—AllowPublishedOct 9, 2026, 9:19 AM0.35.0Clean—AllowPublishedOct 8, 2026, 6:06 AM0.33.1Clean—AllowPublishedOct 7, 2026, 2:15 AM0.30.2SuspiciousCredential ExfiltrationWarnPublishedSep 29, 2026, 8:32 AM0.30.0SuspiciousCredential ExfiltrationWarnPublishedSep 29, 2026, 3:55 AM0.29.11Clean—AllowPublishedSep 29, 2026, 3:28 AM0.29.9SuspiciousCredential ExfiltrationWarnPublishedSep 26, 2026, 7:24 AM0.29.8Scan Failed—AllowUnder ReviewSep 16, 2026, 2:10 AM0.29.7Clean—AllowPublishedSep 5, 2026, 8:52 AM0.29.6Clean—AllowPublishedSep 3, 2026, 5:21 AM0.29.4Clean—AllowPublishedAug 30, 2026, 3:56 PM0.29.2Clean—AllowPublishedAug 27, 2026, 9:12 AM0.29.1Suspicious—WarnUnder ReviewAug 27, 2026, 7:15 AM0.29.0Suspicious—WarnUnder ReviewAug 27, 2026, 7:02 AM0.28.8Clean—AllowPublishedAug 26, 2026, 8:15 AM0.28.7Suspicious—WarnUnder ReviewAug 26, 2026, 6:20 AM0.28.3Clean—AllowPublishedAug 7, 2026, 8:31 AM0.28.0Clean—AllowPublishedAug 6, 2026, 2:45 AM0.27.0Clean—AllowPublishedAug 5, 2026, 5:09 PM0.25.5Suspicious—WarnUnder ReviewJul 4, 2026, 4:32 AM0.25.0Suspicious—WarnUnder ReviewJun 30, 2026, 11:22 PM0.24.44Suspicious—WarnUnder ReviewJun 30, 2026, 11:12 PM0.24.43Suspicious—WarnUnder ReviewJun 30, 2026, 11:06 PM