registry / m9r-cli / 0.6.3

m9r-cli@0.6.3

M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 748 KB of source, external domains: 127.0.0.1, m9r-mission-relay.onrender.com, m9r.vercel.app, oathlock.vercel.app, opencode.ai, www.apple.com

Source & flagged code

6 flagged

dist/resident-provider-adapters.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

3import { redactSession } from "./session-redaction.js";

4import { extractCost, extractTokenUsage } from "./usage-normalization.js";

5import { providerLabel } from "./provider-adapter-config.js";

6import { createGrantWorktree, quarantineGrantWorktree, removeGrantWorktree, worktreeHeadCommit } from "./resident-write-isolation.js";

7/**

8 * The provider CLI's stream-json events already carry usage/cost — Claude

9 * Code's final `result` event and Codex's `turn.completed`/`token_count`

10 * events. Scans every event and keeps the last reported usage block (later

11 * events report cumulative totals, so last-wins beats summing per-event

12 * deltas and risking double count).

13 */

14function extractProviderUsage(events) {

15 const merged = { inputTokens: null, outputTokens: null, totalTokens: null, costUsd: null };

16 let sawAny = false;

17 for (const event of events) {

18 const tokens = extractTokenUsage(event);

19 const cost = extractCost(event);

20 if (tokens.usage === null && cost.costUsd === null)

21 continue;

dist/acp-stdio-adapter.jsView file

Lines 592-632javascript

592 capabilities.usage_reporting = true;

593 capabilities.tool_event_reporting = true;

594 capabilities.approval_requests = true;

595 capabilities.repository_editing = true;

596 capabilities.file_event_reporting

dist/oathlock-terminal-bridge.jsView file

Lines 1-30javascript

1import { createServer } from "node:http";

2import { open, readFile, stat, mkdir } from "node:fs/promises";

3import { createWriteStream } from "node:fs";

4import { randomBytes } from "node:crypto";

dist/dev-mcp-server.js#virtual:normalized:round1View file

26* explicitly fails closed on any absolute/drive-letter path — the opposite L27: * of what"s needed here, where every candidate IS a real absolute\n * filesystem path that must be checked against a real absolute root.\n * containsPath below is the real-filesyst... L28: const MAX_RESULT_CHARS = 200_000; // Bounded tool output, consistent with this codebase"s evidence/message size limits elsewhere.\nconst GIT_READ_TIMEOUT_MS = 10_000;\nconst MAX_GI... L29: // transport layer -- generated once per call so a future retry of this ... L32: const idempotencyKey = crypto.randomUUID(); L33: const response = await fetch(`${channel.appUrl.replace(/\/$/, "")}/api/agent/conversations/${encodeURIComponent(conversationId)}/messages`, { L34: method: "POST", L35: headers: { authorization: `Bearer ${cha

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dev-mcp-server.js#virtual:normalized:round1View on unpkg · L26

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View file

18Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/m9r.js -> dist/oathlock-terminal-bridge.js L18: import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L23: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L24: // The hosted app never receives a terminal WebSocket. It embeds the local L25: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L26: server.once("error", (error) => { L27: if (error.code === "EADDRINUSE") { L28: process.stdout.write(`O

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View on unpkg · L18

Source & flagged code

6 flagged · loading source

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

612// Node deprecates (DEP0190) passing a separate args array alongside L613: // shell: true -- with a shell, args are concatenated into the shell L614: // command line unescaped, so a non-empty args array is a footgun even

High

Shell

Package source references shell execution.

dist/acp-stdio-adapter.jsView on unpkg · L612

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

6 High2 Medium4 Low

HighChild Processdist/resident-provider-adapters.js

HighShelldist/acp-stdio-adapter.js

HighSame File Env Network Executiondist/oathlock-terminal-bridge.js

HighCommand Output Exfiltrationdist/dev-mcp-server.js#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/acp-stdio-adapter.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to m9r-cli@0.6.3.

See all versions of m9r-cli for other recorded verdicts.

Review the evidence and your use of m9r-cli@0.6.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 23:43:18.333Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.