motifcode@0.4.3
Unofficial coding agent harness built for Motif-3: a Claude Code-style terminal session over the hosted endpoint
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe bundle sends a prompted key to the endpoint configured for the selected provider, as the login flow discloses, and saves it locally. The separate balance request is limited to the Infron endpoint and uses its related API host; no unrelated credential theft or automatic install behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user starts a session or explicitly enters a provider API key.
Impact
The provider endpoint receives the key for model access; the source does not show unrelated credential collection or transmission.
Mechanism
The CLI checks the key against the selected model endpoint, saves it locally, and uses the Infron key for balance checks only with the Infron endpoint.
AI rationale
The bundle sends a prompted key to the endpoint configured for the selected provider, as the login flow discloses, and saves it locally. The separate balance request is limited to the Infron endpoint and uses its related API host; no unrelated credential theft or automatic install behavior was found.
Evidence
~/.motif/.env
Network endpoints3
llm.onerouter.proapi-cbt.morphfactory.ioapi.onerouter.pro
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI through dist/motif.js and declares no lifecycle scripts.
- The Infron preset pairs the Infron API key with the fixed model endpoint llm.onerouter.pro.
- The login prompt identifies the provider and key page, says the key is checked against the endpoint, and says it is saved locally.
- Key verification sends the bearer key to the selected endpoint's chat completions route.
- The balance request uses api.onerouter.pro, and the code limits it to the Infron endpoint.
Evidence against
- The key is sent to a host different from the Infron key page's host.
- The package stores the entered key in ~/.motif/.env.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/motif.jsView file
2623if (typeof node_buffer.Buffer === "function") {
L2624: return node_buffer.Buffer.from(src, "base64");
L2625: } else if (typeof atob === "function") {
...
L5237: yield* this.next(token);
L5238: yield* this.end(forceDoc, endOffset);
L5239: }
...
L5241: *next(token) {
L5242: if (node_process.env.LOG_STREAM)
L5243: console.dir(token, { depth: null });
...
L7512: seen.add(lower);
L7513: if (!PUBLIC_HTTP_HEADERS.has(lower) && !hasEnvReference(value)) error3("plaintext_credential", "Private/custom headers must reference environment variables.", id, `${field}.${name}...
L7514: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/motif.jsView on unpkg · L26232623Trigger-reachable chain: manifest.bin -> dist/motif.js
L2623: if (typeof node_buffer.Buffer === "function") {
L2624: return node_buffer.Buffer.from(src, "base64");
L2625: } else if (typeof atob === "function") {
...
L5237: yield* this.next(token);
L5238: yield* this.end(forceDoc, endOffset);
L5239: }
...
L5241: *next(token) {
L5242: if (node_process.env.LOG_STREAM)
L5243: console.dir(token, { depth: null });
...
L7512: seen.add(lower);
L7513: if (!PUBLIC_HTTP_HEADERS.has(lower) && !hasEnvReference(value)) error3("plaintext_credential", "Private/custom headers must reference environment variables.", id, `${field}.${name}...
L7514: }
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/motif.jsView on unpkg · L2623Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationdist/motif.js
CriticalTrigger Reachable Dangerous Capabilitydist/motif.js
HighEvaldist/motif.js
HighCredential Redirect Persistencedist/motif.js
HighTrigger Reachable Credential Exfiltrationdist/motif.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to motifcode@0.4.3.
See all versions of motifcode for other recorded verdicts.
- Review the evidence and your use of motifcode@0.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.