registry / m9r-cli / 0.6.15

m9r-cli@0.6.15

M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The source supports a guarded, package-owned agent capture integration that installs hooks and processes session transcripts when explicitly enabled. This warrants a capability warning, but the inspected code does not establish an unconsented install-time change or a confirmed malicious transfer.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user enables capture during connection or runs the capture installation command.

Impact

Session content may be captured for later shared-memory use when the feature is enabled; the inspected evidence does not establish an unrelated recipient.

Mechanism

Provider integration records session data to a local spool; the runtime processes it into local memory files.

AI rationale

Evidence

dist/oathlock-cli-core.jsdist/cross-agent-capture-setup-core.jsdist/cross-agent-capture-core.js

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest defines build and prepack scripts but no install lifecycle hook.
The CLI installs session capture only when the user enables it; otherwise capture is reported as off.
The capture installer adds provider hook or plugin configuration for supported agents.
The generated hook records session event data in a repository-local spool, and the drain writes captured summaries to local memory files.
The cited runtime locations parse, fingerprint, redact, and render session content; they do not establish an unrelated account action.

Evidence against

Capture is off unless explicitly enabled or installed with a CLI command.
The inspected capture path writes to repository-local storage; it does not establish an unrelated recipient or confirmed attack.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

8 flagged

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = m9r-cli@0.6.3 matchedIdentity = npm:bTlyLWNsaQ:0.6.3 similarity = 0.640 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/acp-stdio-adapter.jsView on unpkg

620// Node deprecates (DEP0190) passing a separate args array alongside L621: // shell: true -- with a shell, args are concatenated into the shell L622: // command line unescaped, so a non-empty args array is a footgun even

High

Shell

Package source references shell execution.

dist/acp-stdio-adapter.jsView on unpkg · L620

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/acp-stdio-adapter.jsView on unpkg

dist/oathlock-terminal-bridge.jsView file

10import chokidar from "chokidar"; L11: import { WebSocket, WebSocketServer } from "ws"; L12: import { BRIDGE_PROTOCOL_VERSION, DEFAULT_BRIDGE_HOST, DEFAULT_BRIDGE_PORT, MAX_BRIDGE_MESSAGE_BYTES, authorizeUpgrade, parseClientMessage } from "./local-terminal-bridge-core.js"; ... L18: import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); L21: const localOnlyRuntime = process.env.M9R_LOCAL_ONLY === "1"; L22: const host = DEFAULT_BRIDGE_HOST;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/oathlock-terminal-bridge.jsView on unpkg · L10

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View file

18import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M9R local runtime is already running on ${host}:${port}.\n`); L30: process.exit(0);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View on unpkg · L18

18Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/m9r.js -> dist/oathlock-terminal-bridge.js L18: import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M

High

dist/cross-agent-capture-setup-core.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rately minimal: no dependencies, no network, one append, exit. // never throws into the caller -- claude code/codex treat this hook as // advisory and non-blocking, but a stack trace on stderr would still be // a needless surprise in someone's terminal on session exit. import { appendfile, mkdir } from "node:fs/promises"; import { dirname, join } from "node:path"; const provider = process.argv[2] === "codex" ? "codex" : "claude-code"; function readstdin() { return new promise((resolve) => { let data = ""; process.stdin.setencoding("utf8"); process.stdin.on("data", (chunk) => { data += chunk; }); process.stdin.on("end", () => resolve(data)); process.stdin.on("err

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cross-agent-capture-setup-core.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/acp-stdio-adapter.jsView on unpkg

Findings

1 Critical7 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/acp-stdio-adapter.js

HighChild Processdist/resident-provider-adapters.js

HighShelldist/acp-stdio-adapter.js

HighSame File Env Network Executiondist/oathlock-terminal-bridge.js

HighCommand Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationdist/cross-agent-capture-setup-core.js

HighTrigger Reachable Command Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/acp-stdio-adapter.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to m9r-cli@0.6.15.

See all versions of m9r-cli for other recorded verdicts.

Review the evidence and your use of m9r-cli@0.6.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 09:52:00.065Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.