registry / @pmate/cli / 0.25.0
@pmate/cli@0.25.0
⚠ Under reviewCLI utilities for the pMate project
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return import_node_path3.default.join(import_node_os2.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs2.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5792: flush(true);
L5793: output.end();
L5794: } catch (error) {
...
L7720: static async toWire(msg, transport) {
L7721: if (transport === "websocket") {
L7722: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090Trigger-reachable chain: manifest.main -> dist/index.js
L90: function buildSessionStorePath() {
L91: return import_node_path3.default.join(import_node_os2.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs2.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5792: flush(true);
L5793: output.end();
L5794: } catch (error) {
...
L7720: static async toWire(msg, transport) {
L7721: if (transport === "websocket") {
L7722: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L90Findings
2 Critical1 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighEvaldist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @pmate/cli@0.25.0.
See all versions of @pmate/cli for other recorded verdicts.
- Review the evidence and your use of @pmate/cli@0.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.