registry / AI-agent capability abuse / m9r-cli / 0.6.14

m9r-cli@0.6.14

M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The flagged behavior is an explicit, user-invoked agent capture capability that can retain sensitive session content locally, with best-effort redaction. Source inspection did not establish an active malicious transfer or unconsented install-time behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user enables memory capture during connection setup or runs the capture installation command.

Impact

Captured conversations may include sensitive content; redaction is best effort. No confirmed malicious effect was identified.

Mechanism

Provider session hooks append session events to a local spool, which the resident drain processes into redacted Markdown files.

AI rationale

Evidence

dist/oathlock-cli-core.jsdist/cross-agent-capture-setup-core.jsdist/cross-agent-capture-core.js.oathlock/capture/pending.jsonl.oathlock/memory/local

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI exposes session capture as an explicit option; otherwise it reports capture is off.
Capture setup writes a provider session hook that appends session data to a local spool.
The drain path turns transcript content into redacted Markdown in the project’s local memory directory.
The package has no install lifecycle hook; its scripts are build and prepack only.

Evidence against

The inspected capture flow requires explicit setup and stores captured content locally; it does not establish a malicious transfer.
The terminal bridge sends authenticated polling requests to the configured M9R API.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 1.02 MB of source, external domains: 127.0.0.1, m9r-dashboard.onrender.com, m9r-relay.m9r.workers.dev, m9r-web-staging.m9r.workers.dev, oathlock.vercel.app, opencode.ai, www.apple.com

Source & flagged code

8 flagged

dist/resident-provider-adapters.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

3import { redactSession } from "./session-redaction.js";

4import { extractCost, extractTokenUsage } from "./usage-normalization.js";

5import { providerLabel } from "./provider-adapter-config.js";

6import { createGrantWorktree, quarantineGrantWorktree, removeGrantWorktree, worktreeHeadCommit } from "./resident-write-isolation.js";

7/**

8 * The provider CLI's stream-json events already carry usage/cost — Claude

9 * Code's final `result` event and Codex's `turn.completed`/`token_count`

10 * events. Scans every event and keeps the last reported usage block (later

11 * events report cumulative totals, so last-wins beats summing per-event

12 * deltas and risking double count).

13 */

14function extractProviderUsage(events) {

15 const merged = { inputTokens: null, outputTokens: null, totalTokens: null, costUsd: null };

16 let sawAny = false;

17 for (const event of events) {

18 const tokens = extractTokenUsage(event);

19 const cost = extractCost(event);

20 if (tokens.usage === null && cost.costUsd === null)

21 continue;

dist/acp-stdio-adapter.jsView file

Lines 600-640javascript

600 capabilities.usage_reporting = true;

601 capabilities.tool_event_reporting = true;

602 capabilities.approval_requests = true;

603 capabilities.repository_editing = true;

604 capabilities.file_event_reporting

dist/oathlock-terminal-bridge.jsView file

Lines 1-30javascript

1import { createServer } from "node:http";

2import { open, readFile, stat, mkdir } from "node:fs/promises";

3import { createWriteStream } from "node:fs";

4import { randomBytes } from "node:crypto"

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View file

18import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M9R local runtime is already running on ${host}:${port}.\n`); L30: process.exit(0);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View on unpkg · L18

18Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/m9r.js -> dist/oathlock-terminal-bridge.js L18: import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M

High

dist/cross-agent-capture-setup-core.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rately minimal: no dependencies, no network, one append, exit. // never throws into the caller -- claude code/codex treat this hook as // advisory and non-blocking, but a stack trace on stderr would still be // a needless surprise in someone's terminal on session exit. import { appendfile, mkdir } from "node:fs/promises"; import { dirname, join } from "node:path"; const provider = process.argv[2] === "codex" ? "codex" : "claude-code"; function readstdin() { return new promise((resolve) => { let data = ""; process.stdin.setencoding("utf8"); process.stdin.on("data", (chunk) => { data += chunk; }); process.stdin.on("end", () => resolve(data)); process.stdin.on("err

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cross-agent-capture-setup-core.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = m9r-cli@0.6.3 matchedIdentity = npm:bTlyLWNsaQ:0.6.3 similarity = 0.640 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/acp-stdio-adapter.jsView on unpkg

620// Node deprecates (DEP0190) passing a separate args array alongside L621: // shell: true -- with a shell, args are concatenated into the shell L622: // command line unescaped, so a non-empty args array is a footgun even

Findings

1 Critical7 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/acp-stdio-adapter.js

HighChild Processdist/resident-provider-adapters.js

HighShelldist/acp-stdio-adapter.js

HighSame File Env Network Executiondist/oathlock-terminal-bridge.js

HighCommand Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationdist/cross-agent-capture-setup-core.js

HighTrigger Reachable Command Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/acp-stdio-adapter.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to m9r-cli@0.6.14.

See all versions of m9r-cli for other recorded verdicts.

Review the evidence and your use of m9r-cli@0.6.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 09:48:27.699Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.