registry / Data exfiltration / m9r-cli
m9r-cli
M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.
This report shows the evidence for m9r-cli@0.6.6. 1 of 11 known versions is blocked or flagged. The newest version, 0.6.16, is flagged. See all versions.
AI Security Review
scanned 3h ago · by lpm-firewall-aiSource inspection confirms automatic upload of repository file contents to the package’s default dashboard host, without an explicit submission gate. The behavior supports a malicious data-exfiltration verdict despite file-size and path exclusions.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting the local terminal runtime; subsequent repository file additions or changes trigger collection and upload when a connected provider token exists.
Impact
Repository source and other text in eligible files can be disclosed to the dashboard without an explicit submission action.
Mechanism
A persistent watcher reads eligible file contents and posts them with relative paths and event types to the configured file-watch endpoint, defaulting to the package dashboard.
Attack narrative
When the CLI starts the terminal bridge, it starts a persistent watcher over the repository. Added or changed eligible text files are read and, when a connected provider token exists, sent with their paths to the dashboard’s file-watch endpoint. The runtime message says raw terminal output stays local unless redacted evidence is explicitly submitted, but the watcher has no corresponding file-content consent check. This creates an automatic repository-content disclosure path.
AI rationale
Source inspection confirms automatic upload of repository file contents to the package’s default dashboard host, without an explicit submission gate. The behavior supports a malicious data-exfiltration verdict despite file-size and path exclusions.
Evidence
dist/m9r.jsdist/oathlock-terminal-bridge.js
Network endpoints1
m9r-dashboard.onrender.com/api/agent/file-watch
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes a CLI entrypoint, and the CLI loads the local terminal bridge.
- Starting the bridge starts a persistent watcher over the repository; added and changed files are read and queued automatically.
- The bridge reads text files up to 256 KiB and sends their contents in authenticated POST requests to the file-watch endpoint when a connected provider token is available.
- The bridge defaults to the package’s dashboard host, while the runtime message says raw terminal output stays local unless redacted evidence is explicitly submitted.
Evidence against
- The watcher ignores initial files, common generated and dependency directories, oversized files, and files with an early NUL byte.
- Requests require an existing connected provider token and failures are handled best-effort.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
7 flagged · loading sourcedist/resident-provider-adapters.jsView file
1import { spawn } from "node:child_process";
L2: import { isAbsolute, join, resolve } from "node:path";
High
Child Process
Package source references child process execution.
dist/resident-provider-adapters.jsView on unpkg · L1dist/acp-stdio-adapter.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = m9r-cli@0.6.3
matchedIdentity = npm:bTlyLWNsaQ:0.6.3
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/acp-stdio-adapter.jsView on unpkg612// Node deprecates (DEP0190) passing a separate args array alongside
L613: // shell: true -- with a shell, args are concatenated into the shell
L614: // command line unescaped, so a non-empty args array is a footgun even
Findings
1 Critical6 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/acp-stdio-adapter.js
HighChild Processdist/resident-provider-adapters.js
HighShelldist/acp-stdio-adapter.js
HighSame File Env Network Executiondist/oathlock-terminal-bridge.js
HighCommand Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/acp-stdio-adapter.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to m9r-cli@0.6.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing m9r-cli@0.6.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
11 known versions0.6.16latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 27, 2026, 12:12 AM0.6.15SuspiciousAgent extension lifecycle riskWarnPublishedSep 20, 2026, 3:33 PM0.6.14SuspiciousAI-agent capability abuseWarnPublishedSep 19, 2026, 3:19 PM0.6.13SuspiciousAgent extension lifecycle riskWarnPublishedSep 19, 2026, 5:32 AM