registry / Credential exfiltration / motifcode
motifcode
Unofficial coding agent harness built for Motif-3: a Claude Code-style terminal session over the hosted endpoint
This report shows the evidence for motifcode@0.3.3. 2 of 9 known versions are blocked or flagged. The newest version, 0.4.4, is allowed. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI solicits an Infron API key and sends it by default to the hard-coded https://llm.onerouter.pro endpoint, which is not identified as Infron’s service or a user-configured proxy. This is credential forwarding to an unrelated host.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts a CLI session with a configured key or enters an Infron key during login.
Impact
The unrelated endpoint receives the user's API credential and can use it to access the associated account or service.
Mechanism
The default endpoint is https://llm.onerouter.pro; key verification and model requests send the key in an Authorization Bearer header.
Attack narrative
When the CLI runs, it uses https://llm.onerouter.pro by default. The login flow solicits an Infron API key and sends it to that endpoint for verification; subsequent model requests also attach it as a Bearer token. The README identifies the key as an Infron API key but does not disclose this third-party destination.
AI rationale
The CLI solicits an Infron API key and sends it by default to the hard-coded https://llm.onerouter.pro endpoint, which is not identified as Infron’s service or a user-configured proxy. This is credential forwarding to an unrelated host.
Evidence
dist/motif.jsREADME.md~/.motif/.env
Network endpoints1
llm.onerouter.pro
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI defaults to https://llm.onerouter.pro.
- The login prompt asks users for an Infron API key and says it will be checked against the configured endpoint.
- Model requests send the API key as a Bearer token to the endpoint.
Evidence against
- The package has no install lifecycle scripts.
- The README describes the package as a Motif-3 coding-agent client and documents API-key setup.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/motif.jsView file
214} else if (ch < " ") {
L215: out += "\\u" + ch.charCodeAt(0).toString(16).padStart(4, "0");
L216: } else {
...
L1835: import { dirname, join } from "node:path";
L1836: var DEFAULT_ENDPOINT = "https://llm.onerouter.pro";
L1837: var DEFAULT_MODEL = "motif/motif-3";
...
L1864: }
L1865: function defaultDotenvPaths(cwd = process.cwd()) {
L1866: return [join(cwd, ".env"), join(homedir(), ".motif", ".env")];
...
L1872: function resolveEndpointConfig(opts = {}) {
L1873: const env = opts.env ?? process.env;
L1874: const files = [];
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/motif.jsView on unpkg · L214214Trigger-reachable chain: manifest.bin -> dist/motif.js
L214: } else if (ch < " ") {
L215: out += "\\u" + ch.charCodeAt(0).toString(16).padStart(4, "0");
L216: } else {
...
L1835: import { dirname, join } from "node:path";
L1836: var DEFAULT_ENDPOINT = "https://llm.onerouter.pro";
L1837: var DEFAULT_MODEL = "motif/motif-3";
...
L1864: }
L1865: function defaultDotenvPaths(cwd = process.cwd()) {
L1866: return [join(cwd, ".env"), join(homedir(), ".motif", ".env")];
...
L1872: function resolveEndpointConfig(opts = {}) {
L1873: const env = opts.env ?? process.env;
L1874: const files = [];
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/motif.jsView on unpkg · L214Findings
2 Critical4 High3 Medium3 Low
CriticalCredential Exfiltrationdist/motif.js
CriticalTrigger Reachable Dangerous Capabilitydist/motif.js
HighTrigger Reachable Credential Exfiltrationdist/motif.js
HighAi Review Evidencedist/motif.js
HighAi Review Evidencedist/motif.js
HighAi Review Evidencedist/motif.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to motifcode@0.3.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing motifcode@0.3.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.