motifcode@0.4.0
Unofficial coding agent harness built for Motif-3: a Claude Code-style terminal session over the hosted endpoint
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe apparent credential flow is part of the package’s stated purpose: an interactive client for Infron’s hosted Motif-3 service. The key is entered by the user and sent to the configured model endpoint and its billing API; the manifest has no install hooks.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts the CLI and provides an Infron API key; runtime requests use the configured endpoint.
Impact
No malicious impact identified; the key is used for the service the package describes.
Mechanism
The key is verified and sent as a bearer token to the model endpoint, and the billing client uses it for balance checks.
AI rationale
The apparent credential flow is part of the package’s stated purpose: an interactive client for Infron’s hosted Motif-3 service. The key is entered by the user and sent to the configured model endpoint and its billing API; the manifest has no install hooks.
Evidence
~/.motif/.env
Network endpoints2
llm.onerouter.pro/v1/chat/completionsapi.onerouter.pro/v1/balance
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The README directs users to create an Infron API key and paste it into the CLI; it says the key is checked and saved in ~/.motif/.env.
- The CLI’s default model endpoint is llm.onerouter.pro, and key verification sends the entered key as a bearer token to that configured endpoint.
- The billing client sends the key to api.onerouter.pro for balance checks, matching the package’s hosted model service.
- The manifest exposes the bundled CLI and has no lifecycle scripts.
Evidence against
- The CLI does transmit the entered bearer key to OneRouter hosts, including a separate balance API; this is disclosed as part of signing in to the hosted service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/motif.jsView file
2623if (typeof node_buffer.Buffer === "function") {
L2624: return node_buffer.Buffer.from(src, "base64");
L2625: } else if (typeof atob === "function") {
...
L5237: yield* this.next(token);
L5238: yield* this.end(forceDoc, endOffset);
L5239: }
...
L5241: *next(token) {
L5242: if (node_process.env.LOG_STREAM)
L5243: console.dir(token, { depth: null });
...
L7512: seen.add(lower);
L7513: if (!PUBLIC_HTTP_HEADERS.has(lower) && !hasEnvReference(value)) error3("plaintext_credential", "Private/custom headers must reference environment variables.", id, `${field}.${name}...
L7514: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/motif.jsView on unpkg · L26232623Trigger-reachable chain: manifest.bin -> dist/motif.js
L2623: if (typeof node_buffer.Buffer === "function") {
L2624: return node_buffer.Buffer.from(src, "base64");
L2625: } else if (typeof atob === "function") {
...
L5237: yield* this.next(token);
L5238: yield* this.end(forceDoc, endOffset);
L5239: }
...
L5241: *next(token) {
L5242: if (node_process.env.LOG_STREAM)
L5243: console.dir(token, { depth: null });
...
L7512: seen.add(lower);
L7513: if (!PUBLIC_HTTP_HEADERS.has(lower) && !hasEnvReference(value)) error3("plaintext_credential", "Private/custom headers must reference environment variables.", id, `${field}.${name}...
L7514: }
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/motif.jsView on unpkg · L2623Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationdist/motif.js
CriticalTrigger Reachable Dangerous Capabilitydist/motif.js
HighEvaldist/motif.js
HighCredential Redirect Persistencedist/motif.js
HighTrigger Reachable Credential Exfiltrationdist/motif.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review EvidenceREADME.md
Affected versions and remediation
This report applies to motifcode@0.4.0.
See all versions of motifcode for other recorded verdicts.
- Review the evidence and your use of motifcode@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.