registry / @pmate/cli / 0.38.1
@pmate/cli@0.38.1
CLI utilities for the pMate project
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe flagged credential behavior is consistent with an OpenAI-compatible client using a user-configured key and optional destination, with ticket generation as its caller. The inspected manifest exposes the CLI entrypoint and has no lifecycle hooks; the scanner labels alone do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the ticket-generation feature, which requires an API key in the user's pMate configuration.
Impact
No package-selected credential recipient or credential-redirection persistence was established.
Mechanism
The CLI reads the configured key and optional base URL and passes them to the OpenAI client for a request based on the supplied notes and images.
AI rationale
The flagged credential behavior is consistent with an OpenAI-compatible client using a user-configured key and optional destination, with ticket generation as its caller. The inspected manifest exposes the CLI entrypoint and has no lifecycle hooks; the scanner labels alone do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the CLI and main entrypoint and declares no lifecycle scripts.
- The OpenAI helper reads an API key from ~/.pmate/config.yaml and uses an optional baseUrl from the same configuration; it does not set a package-fixed gateway.
- The OpenAI client is used to turn supplied chat notes and screenshots into Linear ticket content.
- The inspected chat SDK manifest exports its runtime through package-owned library files.
- The two SDK clients build product-specific API clients from supplied configuration and resolve service endpoints through Aliyun endpoint mappings.
- The shared model module exports generated API model definitions.
- The inspected DNS, CDN, GTM, recursion, tagging, and ATI model files define API request or response fields through `$dara.Model` name mappings.
- The first eight files define declarative API models mapping local properties to Alibaba field names, including agent registration metadata and GTM request and alert fields.
Evidence against
- The scanner's credential-redirection and persistence labels are not supported by the inspected path: the client destination is configurable and no persistence of a redirection was found there.
Source & flagged code
9 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090Trigger-reachable chain: scripts.start -> dist/index.js
L90: function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L90Findings
2 Critical7 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @pmate/cli@0.38.1.
See all versions of @pmate/cli for other recorded verdicts.
- Review the evidence and your use of @pmate/cli@0.38.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.