@pmate/cli@0.44.6
CLI utilities for the pMate project
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe CLI automatically sends a HEBO-labeled credential to the PMate authentication service before handling any command, then persists the returned session token. This is credential exfiltration triggered by CLI startup.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting the CLI while HEBO_MEMORY_TOKEN is set, even when requesting help or version output.
Impact
A credential associated with another service is disclosed to PMate without an explicit login command, and the resulting session token is stored locally until process cleanup.
Mechanism
The CLI sends the environment token as a Bearer credential to auth-api-v2.pmate.chat, retrieves a PMate session, and writes its token to a temporary session file.
Attack narrative
On every CLI start, before parsing the requested command, the package checks for HEBO_MEMORY_TOKEN. If present, it sends that credential to auth-api-v2.pmate.chat as a Bearer token and writes the returned PMate session token to a temporary file. This forwards a credential from another service without an explicit login request.
AI rationale
The CLI automatically sends a HEBO-labeled credential to the PMate authentication service before handling any command, then persists the returned session token. This is credential exfiltration triggered by CLI startup.
Evidence
package.jsondist/index.jsos.tmpdir()/pmate-delegated-*/session.json
Network endpoints1
auth-api-v2.pmate.chat
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes dist/index.js as its CLI entrypoint.
- CLI startup calls ensureManagedSession before parsing arguments, including help and version requests.
- When HEBO_MEMORY_TOKEN is set, the code sends it as a Bearer token to auth-api-v2.pmate.chat.
- The returned session token is written to a temporary pmate-delegated session file.
Evidence against
- The credential flow only runs when HEBO_MEMORY_TOKEN is present.
- The manifest declares no install lifecycle scripts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggeddist/index.jsView file
90function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L9090Trigger-reachable chain: scripts.start -> dist/index.js
L90: function buildSessionStorePath() {
L91: return process.env.PMATE_SESSION_FILE?.trim() || import_node_path5.default.join(import_node_os4.default.homedir(), ".pmate", "session.json");
L92: }
...
L178: const raw = (0, import_node_fs4.readFileSync)(sessionPath, "utf8");
L179: const parsed = JSON.parse(raw);
L180: const store = normalizeStore(parsed);
...
L5816: flush(true);
L5817: output.end();
L5818: } catch (error) {
...
L7692: static async toWire(msg, transport) {
L7693: if (transport === "websocket") {
L7694: const normalized2 = await _Msg.normalizeForWire(msg);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L90Findings
3 Critical8 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/templates/electron/agent-runtime.cjs
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighKnown Malware Source Similaritydist/index.js
MediumNetwork
Affected versions and remediation
This report applies to @pmate/cli@0.44.6.
See all versions of @pmate/cli for other recorded verdicts.
- Avoid installing @pmate/cli@0.44.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.