registry / @pmate/cli / 0.28.0
@pmate/cli@0.28.0
CLI utilities for the pMate project
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic inspection shows a broad but user-invoked administrative CLI, not an automatic malicious chain. Scanner hits arise from legitimate CLI capabilities, bundled dependencies, and fixed dynamic import compatibility code.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User invokes a relevant pmate command.
Impact
Can act on resources and data the user explicitly supplies or authorizes; no unconsented install-time behavior was found.
Mechanism
User-directed PMate CLI operations, including authenticated API, SSH, and local CDP access.
AI rationale
Static inspection shows a broad but user-invoked administrative CLI, not an automatic malicious chain. Scanner hits arise from legitimate CLI capabilities, bundled dependencies, and fixed dynamic import compatibility code.
Evidence
package.jsondist/index.js~/.pmate/session.json~/.pmate/collect/
Network endpoints6
agent-api.pmate.chathub.pmate.chatauth-api-v2.pmate.chatci.pmate.chatquiz-api.pmate.chatlocalhost:39223
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/index.js exposes explicit deploy, SSH, agent, and messaging commands.
- dist/index.js can send user-selected PR diffs or files to PMate agent services.
Evidence against
- package.json has only a prepare build hook; no preinstall/install/postinstall hook.
- dist/index.js runs main only when invoked as the pmate CLI.
- The only new Function usage dynamically imports the fixed @pmate/chat-sdk/runtime specifier.
- Network endpoints are named PMate service endpoints and are reached by explicit CLI commands.
- Session and collection writes are limited to ~/.pmate paths; no foreign agent-control-surface writes found.
- No hidden payload download, credential harvesting, or automatic exfiltration was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
9 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return import_node_path4.default.join(import_node_os3.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs3.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L6200: flush(true);
L6201: output.end();
L6202: } catch (error) {
...
L8542: static async toWire(msg, transport) {
L8543: if (transport === "websocket") {
L8544: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090function buildSessionStorePath() {
L91: return import_node_path4.default.join(import_node_os3.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs3.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L6200: flush(true);
L6201: output.end();
L6202: } catch (error) {
...
L8542: static async toWire(msg, transport) {
L8543: if (transport === "websocket") {
L8544: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L90Findings
3 Critical4 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighEvaldist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @pmate/cli@0.28.0.
See all versions of @pmate/cli for other recorded verdicts.
- Review the evidence and your use of @pmate/cli@0.28.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.