@pmate/cli@0.42.2
CLI utilities for the pMate project
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI automatically sends HEBO_MEMORY_TOKEN to the pMate auth service on startup, before the user’s command is parsed, and stores it in a temporary session file. This is credential forwarding without a dedicated sign-in action, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the pmate CLI when HEBO_MEMORY_TOKEN is set; this occurs before command arguments are parsed.
Impact
The pMate service receives the environment credential without a dedicated login action, and the token is available in a temporary file during the process.
Mechanism
ensureManagedSession() uses the environment token as a Bearer credential for requests to auth-api-v2.pmate.chat, then writes it into a temporary session file.
Attack narrative
When the CLI starts, it checks for HEBO_MEMORY_TOKEN before parsing the requested command. If present, it sends the token as a Bearer credential to auth-api-v2.pmate.chat for the pmate:factory app, then writes the token into a temporary session.json file. This makes credential transfer automatic on CLI startup rather than dependent on an explicit login command.
AI rationale
The CLI automatically sends HEBO_MEMORY_TOKEN to the pMate auth service on startup, before the user’s command is parsed, and stores it in a temporary session file. This is credential forwarding without a dedicated sign-in action, so the package should be blocked.
Evidence
dist/index.jsos.tmpdir()/pmate-delegated-*/session.json
Network endpoints2
auth-api-v2.pmate.chat/session?app=pmate%3Afactoryauth-api-v2.pmate.chat/profiles?app=pmate%3Afactory&account=<accountId>
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes dist/index.js as both its CLI and main entry point.
- On CLI startup, before argument parsing, main() calls ensureManagedSession().
- ensureManagedSession() reads HEBO_MEMORY_TOKEN and sends it as a Bearer token to auth-api-v2.pmate.chat.
- The function writes that token into a temporary pmate-delegated session.json file.
Evidence against
- The destination is the package vendor's own authentication API, and the code treats the token as a delegated pMate session.
- The package has no install lifecycle script; the credential flow runs when the CLI starts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090Trigger-reachable chain: scripts.start -> dist/index.js
L90: function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L90Findings
2 Critical7 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @pmate/cli@0.42.2.
See all versions of @pmate/cli for other recorded verdicts.
- Avoid installing @pmate/cli@0.42.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.