multi-agent-pipeline setup allegedly sent GitHub CLI credentials to a registration endpoint

The LPM Firewall review of @mmerterden/multi-agent-pipeline identifies a credential boundary inside the package's setup flow. The reviewed code connects a first-run registration step to GitHub CLI credential lookup and a bearer-authenticated request to the package publisher's usage endpoint. LPM says the workflow may still run after a user skips a separate reporting-token prompt, provided its reporting opt-out has not been set. This is not an npm postinstall exfiltration claim: executing package setup or Phase 0 registration is a prerequisite. Source-linked package analysis.

A GitHub OAuth credential is not a neutral identifier for usage statistics. It carries permissions issued for GitHub activity, possibly including access to repositories, and the publisher's reporting endpoint is a different trust principal. The reported code path therefore matters even if the request is encrypted and directed to a fixed publisher host. Neither of those conditions by itself establishes that the end user explicitly approved sharing a reusable GitHub credential with the reporting service.

The source landing page was observed on October 25 describing version 20.30.0, whereas earlier checkpoint observations concerned older releases. Since scanner pages are mutable, this observation cannot establish a uniform affected range across all 109 versions or prove that historical installations sent a request. The current report traces a call path; independent evidence of successful transmission, server receipt, retention and downstream account misuse is still absent. LPM's automated classification score is a risk assessment, not a measured breach rate.

A decisive verification would install the exact tarball in a disposable profile, provide only a synthetic GitHub credential, exercise both the skip-reporting and opt-out paths, and record the outbound request. It should then distinguish a request constructed in code from one actually delivered, and account for removal or rotation of the disclosed credential. GitHub CLI is a credential source in this scenario, while the package project and LPM are different entities with different evidentiary roles.