Skip to content
Open-Source Registry

npm / @muggleai/works

@muggleai/works 5.35.0-staging.316

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsmedium
processes
714
operations
187K
packages
314
compiler runs
0
connections
5
build time
1m 09s
job time
1m 09s
capture
3.3 MB
records
340K
bytes / record
9.8

13 years of Microsoft hyperscale engineering, packaged as a harness for your AI coding agent.

11,934 downloads · published 2026-11-06 · source · home page mcpmodel-context-protocolmuggle-aie2e-testingtestingautomationlocalhostai-codinguser-experiencecursorclaude-codevibe-coding View on npm

Graph

secret-exfil · critical
8

Checks

14 of 17 clear Network activity Sensitive data access and transfer +1 more
Build behavior▲▲✓✓✓✓✓✓✓✓
Supply chain▲✓✓✓✓✓
Pipeline✓

Detections

6
  • Credential store contents reached a network peer
    github.com:443 › github.com:443
    critical
  • Credential store contents reached a network peer
    release-assets.githubusercontent.com:443 › release-assets.githubusercontent.com:443
    critical
  • Credential store contents reached a network peer
    tuf-repo-cdn.sigstore.dev:443 › tuf-repo-cdn.sigstore.dev:443
    critical
  • Credential store read by build-time code
    @muggleai/works 5.35.0-staging.316
    high
  • Package code dialled an undeclared host, and nothing answered
    169.254.169.254:80 › 169.254.169.254:80, registry.npmjs.org, registry.npmmirror.com, registry.yarnpkg.com
    medium
  • Build script reached github.com +2
    @muggleai/works 5.35.0-staging.316 › github.com:443, release-assets.githubusercontent.com:443, tuf-repo-cdn.sigstore.dev:443
    medium

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
github.com:443
Destination
github.com:443
Jobs
install
Rule
secret-exfil · consumer

Witness chain

  1. /home/runner/.cursor/mcp.json
    source
  2. github.com:443via node scripts/postinstall.mjs
    • Sensitive-file read linked to a network connectionfrom /home/runner/.cursor/mcp.json

      Credential store contents linked to this connection through build-time code: /home/runner/.cursor/mcp.json

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.cursor/mcp.json

What came before it

Loading the graph

Processes

install

env›node›sh›node

Ran
node scripts/postinstall.mjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline1381
  2. nodenode /usr/local/bin/npm install --foreground-scripts --prefer-offline1381
  3. shsh -c node scripts/postinstall.mjs1393
  4. nodenode scripts/postinstall.mjs1394

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
release-assets.githubusercontent.com:443
Destination
release-assets.githubusercontent.com:443
Jobs
install
Rule
secret-exfil · consumer

Witness chain

  1. /home/runner/.cursor/mcp.json
    source
  2. release-assets.githubusercontent.com:443via node scripts/postinstall.mjs
    • Sensitive-file read linked to a network connectionfrom /home/runner/.cursor/mcp.json

      Credential store contents linked to this connection through build-time code: /home/runner/.cursor/mcp.json

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.cursor/mcp.json

What came before it

Loading the graph

Processes

install

env›node›sh›node

Ran
node scripts/postinstall.mjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline1381
  2. nodenode /usr/local/bin/npm install --foreground-scripts --prefer-offline1381
  3. shsh -c node scripts/postinstall.mjs1393
  4. nodenode scripts/postinstall.mjs1394

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
tuf-repo-cdn.sigstore.dev:443
Destination
tuf-repo-cdn.sigstore.dev:443
Jobs
install
Rule
secret-exfil · consumer

Witness chain

  1. /home/runner/.cursor/mcp.json
    source
  2. tuf-repo-cdn.sigstore.dev:443via node scripts/postinstall.mjs
    • Sensitive-file read linked to a network connectionfrom /home/runner/.cursor/mcp.json

      Credential store contents linked to this connection through build-time code: /home/runner/.cursor/mcp.json

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.cursor/mcp.json

What came before it

Loading the graph

Processes

install

env›node›sh›node

Ran
node scripts/postinstall.mjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline1381
  2. nodenode /usr/local/bin/npm install --foreground-scripts --prefer-offline1381
  3. shsh -c node scripts/postinstall.mjs1393
  4. nodenode scripts/postinstall.mjs1394

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

highwitnessed

Credential store read by build-time code

Subject
@muggleai/works 5.35.0-staging.316
Jobs
install
Rule
credential-read · consumer-upgrade

Evidence

  1. Credential store read by build-time codecause

    Credential store read by build-time code that does not own it: /home/runner/.cursor/mcp.json

    source /home/runner/.cursor/mcp.json

    by node scripts/postinstall.mjs

What came before it

Loading the graph

Processes

install

node›env›node›sh›node

Ran
node scripts/postinstall.mjs
Invoked by
node /home/runner/work/_temp/upgrade.js @muggleai/works 5.35.0-staging.316 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js @muggleai/works 5.35.0-staging.316 consumer-upgrade http://registry.npmjs.org:8080/1738
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline --save-exact @muggleai/works@5.35.0-staging.3161785
  3. nodenode /usr/local/bin/npm install --foreground-scripts --prefer-offline --save-exact @muggleai/works@5.35.0-staging.3161785
  4. shsh -c node scripts/postinstall.mjs1797
  5. nodenode scripts/postinstall.mjs1798

Remediation

Build-time code has no business reading a credential store it does not own. Review the build script or compiler plugin that read it, and rotate the credential if the read is not explained.

Detection

mediumwitnessed

Package code dialled an undeclared host, and nothing answered

Unexpected network connection

Subject
169.254.169.254:80
Destination
169.254.169.254:80, registry.npmjs.org, registry.npmmirror.com, registry.yarnpkg.com
Jobs
install
Rule
egress · consumer

Evidence

  1. Connection outside the process’s allowed destinationscause

    opened by node

    subject 169.254.169.254:80

    by node node_modules/.bin/muggle serve

  2. Allowed hostssupport

    Declared or allowed hosts: registry.npmjs.org, registry.npmmirror.com, registry.yarnpkg.com

  3. Connected; nothing answeredsupport

    node connected to 169.254.169.254:80 and nothing answered: no byte crossed the connection either way

    subject 169.254.169.254:80

    by node node_modules/.bin/muggle serve

  4. Why it matterscontext

    The package's own code dialled this host while the release ran and nothing answered; no manifest, tool profile, network allowlist entry or accepted download covers it.

What came before it

Loading the graph

Processes

install

node›env›node

Ran
node node_modules/.bin/muggle serve
Invoked by
node /home/runner/work/_temp/run.js @muggleai/works
Lineage · 3 processes
  1. nodenode /home/runner/work/_temp/run.js @muggleai/works1553
  2. env/usr/bin/env node node_modules/.bin/muggle serve1584
  3. nodenode node_modules/.bin/muggle serve1584

Remediation

Identify the request. If required, declare the host in the relevant manifest or tool profile, or add a reviewed allow_hosts entry. Otherwise remove it.

Detection

mediumwitnessed

Build script reached github.com +2

Unexpected network connection

Subject
@muggleai/works 5.35.0-staging.316
Destination
github.com:443, release-assets.githubusercontent.com:443, tuf-repo-cdn.sigstore.dev:443
Jobs
install
Rule
egress · consumer

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by node

    subject github.com:443

    by node scripts/postinstall.mjs

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by node

    subject release-assets.githubusercontent.com:443

    by node scripts/postinstall.mjs

  3. Connection outside the process’s allowed destinationscause

    connection to tuf-repo-cdn.sigstore.dev:443, opened by node

    subject tuf-repo-cdn.sigstore.dev:443

    by node scripts/postinstall.mjs

  4. What a build script's fetch becamesupport

    13 files came down, reaching 197 more; nothing the build compiled, linked or ran

  5. Connection opened by a build script or child processsupport

    the opener descends from the build script at sh -c node scripts/postinstall.mjs

  6. Tool commandsupport

    Command: node scripts/postinstall.mjs

    by node scripts/postinstall.mjs

What came before it

Loading the graph

Processes

install

env›node›sh›node

Ran
node scripts/postinstall.mjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --prefer-offline1381
  2. nodenode /usr/local/bin/npm install --foreground-scripts --prefer-offline1381
  3. shsh -c node scripts/postinstall.mjs1393
  4. nodenode scripts/postinstall.mjs1394

Remediation

The build script or a dependency connected to the network during the build. Nothing it downloaded was compiled, linked or run. Build the package from what the registry ships, or accept the download after reviewing it.

Network

6 peers
  • github.com:443 @muggleai/works's own build code · git-remote-http via GitHub Runner profile (git-remote-https → github.com); node (consumer) · GitHub, Inc. · 1 file infrastructure
  • github.com:443 build code of @muggleai/works · node · 13 files undeclared
  • release-assets.githubusercontent.com:443 build code of @muggleai/works · node (consumer) · Fastly, Inc. · 13 files undeclared
  • tuf-repo-cdn.sigstore.dev:443 build code of @muggleai/works · node (consumer) · Google LLC · 8 files undeclared
  • registry.npmjs.org:8080 the package manager · node (consumer) · 59,016 files ecosystem
  • 169.254.169.254:80 @muggleai/works's own build code · node (consumer) unjudged
Vulnerabilities2FixSeverity
Dependencies
glob 13.0.7>=14.0.2
CVE-2026-118773Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalmedium
minimatch 10.2.6>=11.0.1
CVE-2026-118764minimatch has potential denial of service via globparts amplificationmedium

Dependencies

338
Dependencies338Build behaviour
@azure-rest/core-client2.9.0
@azure/abort-controller2.2.0
@azure/core-auth1.11.0
@azure/core-client1.11.1
@azure/core-process1.0.0
@azure/core-rest-pipeline1.25.0
@azure/core-tracing1.4.0
@azure/core-util1.14.0
@azure/functions4.17.0
@azure/functions-extensions-base0.3.0
@azure/identity4.14.1
@azure/logger1.4.0
@azure/monitor-opentelemetry1.21.0
@azure/monitor-opentelemetry-exporter1.0.0-beta.47
@azure/msal-browser5.29.0
@azure/msal-common16.16.1
@azure/msal-node7.2.1
@azure/opentelemetry-instrumentation-azure-sdk1.0.0
@azure/opentelemetry-instrumentation-azure-sdk1.1.0-beta.1
@colors/colors1.6.0
@colors/colors1.6.1
@dabh/diagnostics2.0.9
@gar/promise-retry1.0.3
@grpc/grpc-js1.14.7
@grpc/proto-loader0.8.1
@hono/node-server2.1.6
@js-sdsl/ordered-map4.4.2
@microsoft/applicationinsights-web-snippet1.2.3
@modelcontextprotocol/sdk1.32.2
@npmcli/agent5.0.2
@npmcli/fs6.0.0
@npmcli/redact5.0.0
@opentelemetry/api1.9.1
@opentelemetry/api-logs0.211.0
@opentelemetry/api-logs0.221.0
@opentelemetry/configuration0.221.0
@opentelemetry/context-async-hooks2.10.0
@opentelemetry/context-async-hooks2.12.0
@opentelemetry/core2.10.0
@opentelemetry/core2.12.0
@opentelemetry/exporter-logs-otlp-grpc0.221.0
@opentelemetry/exporter-logs-otlp-http0.221.0
@opentelemetry/exporter-logs-otlp-proto0.221.0
@opentelemetry/exporter-metrics-otlp-grpc0.221.0
@opentelemetry/exporter-metrics-otlp-http0.221.0
@opentelemetry/exporter-metrics-otlp-proto0.221.0
@opentelemetry/exporter-prometheus0.221.0
@opentelemetry/exporter-trace-otlp-grpc0.221.0
@opentelemetry/exporter-trace-otlp-http0.221.0
@opentelemetry/exporter-trace-otlp-proto0.221.0
@opentelemetry/exporter-zipkin2.10.0
@opentelemetry/instrumentation0.211.0
@opentelemetry/instrumentation0.221.0
@opentelemetry/instrumentation-bunyan0.66.0
@opentelemetry/instrumentation-console0.3.0
@opentelemetry/instrumentation-http0.221.0
@opentelemetry/instrumentation-mongodb0.74.0
@opentelemetry/instrumentation-mysql0.67.0
@opentelemetry/instrumentation-pg0.73.0
@opentelemetry/instrumentation-redis0.69.0
@opentelemetry/instrumentation-winston0.65.0
@opentelemetry/otlp-exporter-base0.221.0
@opentelemetry/otlp-grpc-exporter-base0.221.0
@opentelemetry/otlp-transformer0.221.0
@opentelemetry/propagator-b32.10.0
@opentelemetry/propagator-jaeger2.10.0
@opentelemetry/redis-common0.38.3
@opentelemetry/resource-detector-azure0.29.0
@opentelemetry/resources2.10.0
@opentelemetry/resources2.12.0
@opentelemetry/sdk-logs0.221.0
@opentelemetry/sdk-metrics2.10.0
@opentelemetry/sdk-metrics2.12.0
@opentelemetry/sdk-node0.221.0
@opentelemetry/sdk-trace2.10.0
@opentelemetry/sdk-trace2.12.0
@opentelemetry/sdk-trace-base2.10.0
@opentelemetry/sdk-trace-base2.12.0
@opentelemetry/sdk-trace-node2.10.0
@opentelemetry/sdk-trace-node2.12.0
@opentelemetry/sdk-trace-web2.12.0
@opentelemetry/semantic-conventions1.45.0
@opentelemetry/sql-common0.42.0
@opentelemetry/winston-transport0.31.0
@protobufjs/aspromise1.1.2
@protobufjs/base641.1.2
@protobufjs/codegen2.0.5
@protobufjs/eventemitter1.1.1
@protobufjs/fetch1.1.1
@protobufjs/float1.0.2
@protobufjs/path1.1.2
@protobufjs/pool1.1.0
@protobufjs/utf81.1.2
@sigstore/bundle5.0.1
@sigstore/core4.0.1
@sigstore/protobuf-specs0.5.2
@sigstore/sign5.1.0
@sigstore/tuf5.0.1
@sigstore/verify4.1.3
@so-ric/colorspace1.1.6
@tufjs/canonical-json2.0.0
@tufjs/models5.0.2
@types/bunyan1.8.11
@types/mysql2.15.27
@types/node26.6.6
@types/pg8.15.6
@types/pg-pool2.0.7
@types/triple-beam1.3.5
@typespec/ts-http-runtime0.3.9
accepts2.0.0
acorn8.19.0
acorn-import-attributes1.9.5
agent-base6.0.2
agent-base7.1.4
agent-base9.0.0
ajv8.20.0
ajv-formats3.0.1
ansi-regex5.0.1
ansi-styles4.3.0
applicationinsights3.17.0
async3.2.6
asynckit0.4.0
axios1.21.0
balanced-match4.0.4
body-parser2.4.0
brace-expansion5.0.12
buffer-equal-constant-time1.0.1
bundle-name4.1.1
bytes3.1.2
cacache21.0.1
call-bind-apply-helpers1.0.2
call-bound1.0.4
cjs-module-lexer2.3.0
cliui8.0.1
color5.0.3
color-convert2.0.1
color-convert3.1.3
color-name1.1.4
color-name2.1.1
color-string2.1.4
combined-stream1.0.8
commander14.0.3
content-disposition2.0.1
content-type1.0.5
content-type2.1.0
cookie0.7.2
cookie-signature1.2.2
cors2.8.6
cross-spawn7.0.6
debug4.4.3
default-browser5.5.1
default-browser-id5.0.1
define-lazy-prop3.0.0
delayed-stream1.0.0
depd2.0.0
dunder-proto1.0.1
ecdsa-sig-formatter1.0.11
ee-first1.1.1
emoji-regex8.0.0
enabled2.0.0
encodeurl2.0.1
es-define-property1.0.1
es-errors1.3.0
es-module-lexer3.0.4
es-object-atoms1.1.2
es-set-tostringtag2.1.0
escalade3.2.0
escape-html1.0.3
etag1.8.1
eventsource3.0.7
eventsource-parser3.1.1
express5.3.0
express-rate-limit8.7.3
fast-deep-equal3.1.3
fast-uri3.1.9
fecha4.2.3
finalhandler2.1.1
fn.name1.1.0
follow-redirects1.16.2
form-data4.0.6
forwarded0.2.0
forwarded-parse2.1.2
fresh2.0.0
fs-minipass3.0.3
function-bind1.1.2
get-caller-file2.0.5
get-intrinsic1.3.0
get-proto1.0.1
glob13.0.7
gopd1.2.0
has-symbols1.1.0
has-tostringtag1.0.2
hasown2.0.4
hono4.13.16
http-cache-semantics4.3.0
http-errors2.0.1
http-proxy-agent7.0.2
http-proxy-agent9.1.0
https-proxy-agent5.0.1
https-proxy-agent7.0.6
https-proxy-agent9.1.0
iconv-lite0.7.3
import-in-the-middle2.0.6
import-in-the-middle3.6.0
inherits2.0.4
ip-address10.7.6
ipaddr.js1.9.1
is-docker3.0.0
is-fullwidth-code-point3.0.0
is-in-ssh1.0.0
is-inside-container1.0.0
is-promise4.0.0
is-stream2.0.1
is-wsl3.1.1
isexe2.0.0
jose6.2.15
json-schema-traverse1.0.0
json-schema-typed8.0.2
jsonwebtoken9.0.3
jwa2.0.1
jws4.0.1
kuler2.0.0
lodash.camelcase4.3.0
lodash.includes4.3.0
lodash.isboolean3.0.3
lodash.isinteger4.0.4
lodash.isnumber3.0.3
lodash.isplainobject4.0.6
lodash.isstring4.0.1
lodash.once4.1.1
logform2.7.0
long5.3.2
lru-cache11.5.3
make-fetch-happen16.0.1
math-intrinsics1.1.0
media-typer1.1.1
merge-descriptors2.0.0
mime-db1.52.0
mime-db1.54.0
mime-types2.1.35
mime-types3.0.2
minimatch10.2.6
minipass3.3.6
minipass7.1.3
minipass-collect2.0.1
minipass-fetch6.0.0
minipass-flush1.0.7
minipass-pipeline1.2.4
minipass-sized2.0.0
minizlib3.1.0
module-details-from-path1.0.4
ms2.1.3
negotiator1.1.0
object-assign4.1.1
object-inspect1.13.4
on-finished2.4.2
once1.4.0
one-time1.0.0
open11.0.4
p-map7.1.1
parseurl1.3.3
path-key3.1.1
path-scurry2.0.2
path-to-regexp8.4.2
pg-int81.0.1
pg-protocol1.16.1
pg-types2.2.0
pkce-challenge5.0.1
postgres-array2.0.0
postgres-bytea1.0.1
postgres-date1.0.7
postgres-interval1.2.0
powershell-utils0.2.1
proc-log7.0.0
protobufjs7.6.6
proxy-addr2.0.8
proxy-agent-negotiate1.1.0
proxy-from-env2.1.0
qs6.17.1
range-parser1.3.0
raw-body3.0.2
readable-stream3.6.2
require-directory2.1.1
require-from-string2.0.2
require-in-the-middle8.0.1
router2.2.0
run-applescript7.1.0
safe-buffer5.2.1
safe-stable-stringify2.5.0
safer-buffer2.1.2
semver7.8.6
send1.2.1
serve-static2.2.1
setprototypeof1.2.0
shebang-command2.0.0
shebang-regex3.0.0
side-channel1.1.1
side-channel-list1.0.1
side-channel-map1.0.1
side-channel-weakmap1.0.2
sigstore5.0.1
smart-buffer4.2.0
socks2.8.10
socks-proxy-agent10.1.0
ssri14.0.0
stack-trace0.0.10
statuses2.0.2
string-width4.2.3
string_decoder1.3.0
strip-ansi6.0.1
text-hex1.0.0
toidentifier1.0.1
triple-beam1.4.1
tslib2.9.1
tuf-js6.0.2
type-is2.1.0
ulid3.0.2
undici-types8.9.0
unpipe1.0.0
util-deprecate1.0.2
uuid14.0.3
vary1.1.2
which2.0.2
winston3.19.0
winston-transport4.9.0
wrap-ansi7.0.0
wrappy1.0.2
wsl-utils1.0.1
xtend4.0.2
y18n5.0.8
yallist4.0.0
yaml2.9.1
yargs17.7.3
yargs-parser21.1.1
zod4.6.7
zod-to-json-schema3.25.2
consumer1.0.0
consumer-upgrade1.0.0

Versions306

Raw data

capture
3.3 MB
records
339,515
bytes per record
9.8

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: install success · Generated 2026-11-07 · run 4f10694b-a37b-483b-945d-0a74a4d2ec4f

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2

Bitbison's review

@muggleai/works sends usage telemetry to Azure Application Insights by default

Conclusion
phone-home
Covers
5.34.0
Reviewed by
Bitbison
Updated
2026-11-06

Its `muggle serve` MCP server starts Microsoft Application Insights and reports usage events with an install ID, account ID and IP to a hardcoded Azure endpoint; the package is otherwise an ordinary AI-coding-agent toolkit.

Indicators

hosts
westus3-1.in.applicationinsights.azure.com169.254.169.254github.comrelease-assets.githubusercontent.comtuf-repo-cdn.sigstore.dev
files
~/.cursor/mcp.json~/.muggle-ai/install-id.json~/.muggle-ai/preferences.json
processes
muggle servenode scripts/postinstall.mjs

What was examined

5.34.0
sha256:9eeab09be166a2235a81ca4d37bc381a7b5247844341c05de5c7563a43f20963

Links