motifcode@0.4.4
Unofficial coding agent harness built for Motif-3: a Claude Code-style terminal session over the hosted endpoint
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential flows match the package’s documented hosted model providers and GitHub integration. Login is user initiated, and the inspected code shows no unrelated credential destination.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the CLI; entering a key requires an interactive login. A configured key may be used for a balance lookup during session startup.
Impact
Expected provider authentication and account lookup; no unrelated credential collection or exfiltration was identified.
Mechanism
The CLI sends the selected provider key to its model endpoint for verification and requests balance information from the provider API. GitHub authentication is checked against GitHub.
AI rationale
The flagged credential flows match the package’s documented hosted model providers and GitHub integration. Login is user initiated, and the inspected code shows no unrelated credential destination.
Evidence
.env~/.motif/.env
Network endpoints5
llm.onerouter.pro/v1/chat/completionsapi.onerouter.pro/v1/balanceapi-cbt.morphfactory.ioapi.github.com/userapi.githubcopilot.com/mcp/
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/motif.js as the CLI and declares no lifecycle scripts or runtime dependencies.
- The README describes choosing Infron or Morphfactory and entering that provider’s API key.
- Login sends the entered key as a bearer token to the selected endpoint to verify it.
- The balance lookup sends the key to the provider’s balance API; GitHub CLI tokens are sent to api.github.com.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/motif.jsView file
2623if (typeof node_buffer.Buffer === "function") {
L2624: return node_buffer.Buffer.from(src, "base64");
L2625: } else if (typeof atob === "function") {
...
L5237: yield* this.next(token);
L5238: yield* this.end(forceDoc, endOffset);
L5239: }
...
L5241: *next(token) {
L5242: if (node_process.env.LOG_STREAM)
L5243: console.dir(token, { depth: null });
...
L7512: seen.add(lower);
L7513: if (!PUBLIC_HTTP_HEADERS.has(lower) && !hasEnvReference(value)) error3("plaintext_credential", "Private/custom headers must reference environment variables.", id, `${field}.${name}...
L7514: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/motif.jsView on unpkg · L26232623Trigger-reachable chain: manifest.bin -> dist/motif.js
L2623: if (typeof node_buffer.Buffer === "function") {
L2624: return node_buffer.Buffer.from(src, "base64");
L2625: } else if (typeof atob === "function") {
...
L5237: yield* this.next(token);
L5238: yield* this.end(forceDoc, endOffset);
L5239: }
...
L5241: *next(token) {
L5242: if (node_process.env.LOG_STREAM)
L5243: console.dir(token, { depth: null });
...
L7512: seen.add(lower);
L7513: if (!PUBLIC_HTTP_HEADERS.has(lower) && !hasEnvReference(value)) error3("plaintext_credential", "Private/custom headers must reference environment variables.", id, `${field}.${name}...
L7514: }
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/motif.jsView on unpkg · L2623Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationdist/motif.js
CriticalTrigger Reachable Dangerous Capabilitydist/motif.js
HighEvaldist/motif.js
HighCredential Redirect Persistencedist/motif.js
HighTrigger Reachable Credential Exfiltrationdist/motif.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to motifcode@0.4.4.
See all versions of motifcode for other recorded verdicts.
- Review the evidence and your use of motifcode@0.4.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.