@pmate/cli@0.36.0
CLI utilities for the pMate project
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe inspected source supports conditional credential exposure through an unrestricted auth-base override, so a warning is appropriate. The scanner’s claim of a fixed unofficial gateway is not supported by the source.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs with HEBO_MEMORY_TOKEN set, or a user completes hosted or access-key login while an auth-base override is configured.
Impact
If the configured URL is untrusted, it can receive the credential; the inspected default does not send it to a fixed unrelated recipient.
Mechanism
The code places the token or access-key secret in an Authorization header and sends it through the configured auth URL.
AI rationale
The inspected source supports conditional credential exposure through an unrestricted auth-base override, so a warning is appropriate. The scanner’s claim of a fixed unofficial gateway is not supported by the source.
Evidence
package.jsondist/index.js
Network endpoints2
auth-api-v2.pmate.chatauth.pmate.chat
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes dist/index.js as the CLI executable and main entrypoint; its declared scripts contain no install hook.
- CLI startup invokes managed-session processing before parsing command arguments.
- When HEBO_MEMORY_TOKEN is set, the code sends it as a bearer token to AUTH_API_BASE_URL, which defaults to auth-api-v2.pmate.chat.
- The auth URL can be replaced through PMATE_AUTH_API_BASE_URL or AUTH_API_BASE_URL without a destination check.
- Interactive login sends its callback token to session exchange through the resolved auth URL.
- Access-key login sends its secret as a bearer token to the same resolved auth URL.
Evidence against
- The default auth destination is pMate’s auth service, and the inspected source shows no fixed unrelated credential recipient.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090Trigger-reachable chain: scripts.start -> dist/index.js
L90: function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L90Findings
2 Critical7 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @pmate/cli@0.36.0.
See all versions of @pmate/cli for other recorded verdicts.
- Review the evidence and your use of @pmate/cli@0.36.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.