registry / Data exfiltration / m9r-cli / 0.6.11

m9r-cli@0.6.11

M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The runtime automatically sends eligible repository file contents to the configured M9R service. Because this requires explicit runtime activation and the source does not establish malicious intent, classify it as suspicious and warn.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user starts `oathlock terminal runtime` or `oathlock terminal bridge` without local-only mode, then a repository file is added or changed.

Impact

Project source text can leave the local machine and reach the configured M9R API endpoint.

Mechanism

The bridge reads eligible text files up to 256 KiB, queues their content with the relative path, and posts the events using a connected provider token.

AI rationale

Evidence

dist/oathlock.jsdist/oathlock-terminal-bridge.js

Network endpoints1

m9r-web-staging.m9r.workers.dev/api/agent/file-watch

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI starts the terminal runtime through an explicit terminal command, with a local-only option.
The runtime reads text from repository files up to 256 KiB and ignores selected directories.
Added or changed file contents are queued and sent in an authenticated request when a connected provider token is available.
The default recipient is M9R's staging service; local-only mode disables hosted API polling.
The other inspected runtime hints concern a bridge status report and local cron text handling.

Evidence against

The transfer requires the user to start the terminal runtime; local-only mode is available.
The default endpoint is M9R's own service, and the inspected code does not establish malicious intent.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

8 flagged

dist/resident-provider-adapters.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

3import { redactSession } from "./session-redaction.js";

4import { extractCost, extractTokenUsage } from "./usage-normalization.js";

5import { providerLabel } from "./provider-adapter-config.js";

6import { createGrantWorktree, quarantineGrantWorktree, removeGrantWorktree, worktreeHeadCommit } from "./resident-write-isolation.js";

7/**

8 * The provider CLI's stream-json events already carry usage/cost — Claude

9 * Code's final `result` event and Codex's `turn.completed`/`token_count`

10 * events. Scans every event and keeps the last reported usage block (later

11 * events report cumulative totals, so last-wins beats summing per-event

12 * deltas and risking double count).

13 */

14function extractProviderUsage(events) {

15 const merged = { inputTokens: null, outputTokens: null, totalTokens: null, costUsd: null };

16 let sawAny = false;

17 for (const event of events) {

18 const tokens = extractTokenUsage(event);

19 const cost = extractCost(event);

20 if (tokens.usage === null && cost.costUsd === null)

21 continue;

dist/acp-stdio-adapter.jsView file

Lines 592-632javascript

592 capabilities.usage_reporting = true;

593 capabilities.tool_event_reporting = true;

594 capabilities.approval_requests = true;

595 capabilities.repository_editing = true;

596 capabilities.file_event_reporting

dist/oathlock-terminal-bridge.jsView file

Lines 1-30javascript

1import { createServer } from "node:http";

2import { open, readFile, stat, mkdir } from "node:fs/promises";

3import { createWriteStream } from "node:fs";

4import { randomBytes } from "node:crypto"

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View file

18import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M9R local runtime is already running on ${host}:${port}.\n`); L30: process.exit(0);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View on unpkg · L18

18Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/m9r.js -> dist/oathlock-terminal-bridge.js L18: import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M

High

dist/cross-agent-capture-setup-core.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rately minimal: no dependencies, no network, one append, exit. // never throws into the caller -- claude code/codex treat this hook as // advisory and non-blocking, but a stack trace on stderr would still be // a needless surprise in someone's terminal on session exit. import { appendfile, mkdir } from "node:fs/promises"; import { dirname, join } from "node:path"; const provider = process.argv[2] === "codex" ? "codex" : "claude-code"; function readstdin() { return new promise((resolve) => { let data = ""; process.stdin.setencoding("utf8"); process.stdin.on("data", (chunk) => { data += chunk; }); process.stdin.on("end", () => resolve(data)); process.stdin.on("err

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cross-agent-capture-setup-core.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = m9r-cli@0.6.3 matchedIdentity = npm:bTlyLWNsaQ:0.6.3 similarity = 0.680 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/acp-stdio-adapter.jsView on unpkg

612// Node deprecates (DEP0190) passing a separate args array alongside L613: // shell: true -- with a shell, args are concatenated into the shell L614: // command line unescaped, so a non-empty args array is a footgun even

Findings

1 Critical7 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/acp-stdio-adapter.js

HighChild Processdist/resident-provider-adapters.js

HighShelldist/acp-stdio-adapter.js

HighSame File Env Network Executiondist/oathlock-terminal-bridge.js

HighCommand Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationdist/cross-agent-capture-setup-core.js

HighTrigger Reachable Command Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/acp-stdio-adapter.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to m9r-cli@0.6.11.

See all versions of m9r-cli for other recorded verdicts.

Review the evidence and your use of m9r-cli@0.6.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 21:53:03.601Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.