LPM static security assessment of multi-agent-pipeline setup

Evidence record

Source-linked scanner report on retrieving and sending developer GitHub credentials in setup registration.

Read the original source ↗

Claim-level citations (3)

• supportsmulti-agent-pipeline setup allegedly sent GitHub CLI credentials to a registration endpoint: LPM associates the GitHub CLI token forwarding path with multi-agent-pipeline usage registration during setup, rather than asserting token transmission on npm installation alone.

  Package source analysis, pipeline/scripts/usage-register.mjs and setup route

• supportsmulti-agent-pipeline setup allegedly sent GitHub CLI credentials to a registration endpoint: LPM identifies scripts/usage-register.mjs as an optional setup step accessing GitHub CLI credentials and sending a request to a publisher-bound usage ingestion endpoint.

  Source inspection; usage-register.mjs findings

• supportsmulti-agent-pipeline setup allegedly sent GitHub CLI credentials to a registration endpoint: The documented behavior is not triggered by package installation alone, and the security assessment does not establish a completed attacker account compromise.

  Trigger conditions and evidence limitations