registry / Data exfiltration / m9r-cli / 0.6.8

m9r-cli@0.6.8

M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The bridge automatically uploads eligible repository file contents after terminal runtime startup, without per-file consent or repository ignore handling. The default destination is package-aligned and the behavior requires a started runtime and connected provider, so the evidence supports a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user starts the terminal runtime; a connected provider is present and a repository file is added or changed.

Impact

Project file contents may be disclosed to the configured service without separate approval for each file.

Mechanism

The bridge reads eligible file text, batches file events, and posts them with a saved provider token to the configured API.

AI rationale

Evidence

dist/m9r.jsdist/oathlock-terminal-bridge.jsdist/oathlock-cli-core.js

Network endpoints1

m9r-dashboard.onrender.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes dist/m9r.js as the m9r-cli command.
Starting the terminal runtime imports oathlock-terminal-bridge.js, which starts the file watcher.
The watcher reads added or changed files and queues their text for a later batch.
The bridge reads a saved connected-provider token and sends queued events to the configured API, which defaults to the M9R dashboard.
The watcher excludes a fixed set of directories and files over 256 KiB or detected as binary; it does not apply repository ignore rules.
The inspected autostart location only builds a cron-entry string; the declared default connection capabilities are rules:read, session:submit, and instructions:read.

Evidence against

The upload runs only after the user starts the terminal runtime and a connected-provider token is available.
The default recipient is the package’s M9R dashboard, and the watcher limits file size and filters common directories.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

7 flagged

dist/resident-provider-adapters.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

3import { redactSession } from "./session-redaction.js";

4import { extractCost, extractTokenUsage } from "./usage-normalization.js";

5import { providerLabel } from "./provider-adapter-config.js";

6import { createGrantWorktree, quarantineGrantWorktree, removeGrantWorktree, worktreeHeadCommit } from "./resident-write-isolation.js";

7/**

8 * The provider CLI's stream-json events already carry usage/cost — Claude

9 * Code's final `result` event and Codex's `turn.completed`/`token_count`

10 * events. Scans every event and keeps the last reported usage block (later

11 * events report cumulative totals, so last-wins beats summing per-event

12 * deltas and risking double count).

13 */

14function extractProviderUsage(events) {

15 const merged = { inputTokens: null, outputTokens: null, totalTokens: null, costUsd: null };

16 let sawAny = false;

17 for (const event of events) {

18 const tokens = extractTokenUsage(event);

19 const cost = extractCost(event);

20 if (tokens.usage === null && cost.costUsd === null)

21 continue;

dist/acp-stdio-adapter.jsView file

Lines 592-632javascript

592 capabilities.usage_reporting = true;

593 capabilities.tool_event_reporting = true;

594 capabilities.approval_requests = true;

595 capabilities.repository_editing = true;

596 capabilities.file_event_reporting

dist/oathlock-terminal-bridge.jsView file

Lines 1-30javascript

1import { createServer } from "node:http";

2import { open, readFile, stat, mkdir } from "node:fs/promises";

3import { createWriteStream } from "node:fs";

4import { randomBytes } from "node:crypto";

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View file

18import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L23: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L24: // The hosted app never receives a terminal WebSocket. It embeds the local L25: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L26: server.once("error", (error) => { L27: if (error.code === "EADDRINUSE") { L28: process.stdout.write(`OathLock local runtime is already running on ${host}:${port}.\n`); L29: process.exit(0);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View on unpkg · L18

18Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/m9r.js -> dist/oathlock-terminal-bridge.js L18: import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L23: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L24: // The hosted app never receives a terminal WebSocket. It embeds the local L25: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L26: server.once("error", (error) => { L27: if (error.code === "EADDRINUSE") { L28: process.stdout.write(`O

High

Source & flagged code

7 flagged · loading source

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = m9r-cli@0.6.3 matchedIdentity = npm:bTlyLWNsaQ:0.6.3 similarity = 0.780 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/acp-stdio-adapter.jsView on unpkg

612// Node deprecates (DEP0190) passing a separate args array alongside L613: // shell: true -- with a shell, args are concatenated into the shell L614: // command line unescaped, so a non-empty args array is a footgun even

Findings

1 Critical6 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/acp-stdio-adapter.js

HighChild Processdist/resident-provider-adapters.js

HighShelldist/acp-stdio-adapter.js

HighSame File Env Network Executiondist/oathlock-terminal-bridge.js

HighCommand Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/acp-stdio-adapter.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Low

Affected versions and remediation

This report applies to m9r-cli@0.6.8.

See all versions of m9r-cli for other recorded verdicts.

Review the evidence and your use of m9r-cli@0.6.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 21:53:20.909Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.