software_project · DiggingBeagle record
@mmerterden/multi-agent-pipeline
Agent pipeline package flagged for sending a GitHub CLI token during setup.
- Entity kind
- software_project
Record description
@mmerterden/multi-agent-pipeline is an npm-based multi-agent development workflow that integrates coding assistants and includes a first-run usage-registration component. An LPM Firewall source inspection reports that the registration routine may retrieve a GitHub credential associated with the developer environment and supply it as a bearer credential to the publisher's usage service. The reviewed October 25 landing page described version 20.30.0, later than earlier checkpoint examples. Version-specific code paths must not be generalized to every historical release.
The project identity is distinct from the LPM scanner that reported the behavior and from GitHub, whose CLI token may be reused. The claimed behavior requires setup or Phase 0 registration, not a package download alone. The scanner's visible static trace supports the existence of a potentially sensitive call path, while successful transport, storage, user disclosure, malicious intent and downstream credential misuse require separate runtime evidence. The relevant dossier is the registration investigation.