registry / @pmate/cli / 0.38.0
@pmate/cli@0.38.0
CLI utilities for the pMate project
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection did not confirm the scanner's alleged fixed gateway or credential redirection. The manifest has no install hook, and the inspected API key path uses the user's configured endpoint.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes a CLI function that uses the OpenAI client.
Impact
No unconsented credential transfer to a publisher-selected recipient or other confirmed attack impact was established.
Mechanism
The client reads openAI.apiKey and optional openAI.baseUrl from the user's configuration to create the service client.
AI rationale
Source inspection did not confirm the scanner's alleged fixed gateway or credential redirection. The manifest has no install hook, and the inspected API key path uses the user's configured endpoint.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the CLI and main entrypoint and defines no install lifecycle hook.
- The OpenAI client requires a key from the user's configuration and uses only an optional configured base URL; no publisher-selected gateway default was found.
- The inspected dependency entrypoints are generated SDK clients, while the PMate chat runtime re-exports its chat and protocol modules.
- The listed files export named generated API request and response model classes; these excerpts show model exports, not credential transfer or network calls.
- The cited declarations in these eight update model files are `$dara.Model` classes with `static names()` field mappings.
- The cited declarations in these eight verification and response model files are `$dara.Model` classes with `static names()` field mappings or response-body model references.
- The cited declarations in these eight response and domain model files are `$dara.Model` classes with `static names()` field mappings or response-body model references.
- These excerpts show generated API request and response body model declarations, with response files importing the corresponding response body model.
Source & flagged code
9 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090Trigger-reachable chain: scripts.start -> dist/index.js
L90: function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L90Findings
2 Critical7 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @pmate/cli@0.38.0.
See all versions of @pmate/cli for other recorded verdicts.
- Review the evidence and your use of @pmate/cli@0.38.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.