registry / @memnexus-ai/mx-agent-cli
@memnexus-ai/mx-agent-cli
CLI for creating and managing AI agent teams
This report shows the evidence for @memnexus-ai/mx-agent-cli@0.1.303. 0 of 60 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged build and agent-configuration writes are reachable through explicit CLI commands and match the package’s stated project-management purpose. The encoded-runner and Trojan Source indicators were not substantiated by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
CLI actions run when the user invokes commands such as create or init.
Impact
No unsolicited credential transfer, external agent-control mutation, or concealed command execution was established.
Mechanism
The create flow builds the CLI in a worktree with npm scripts disabled during installation; init writes agent configuration into the project being scaffolded. The Unicode match is an escaped character pattern used for sanitization.
AI rationale
The flagged build and agent-configuration writes are reachable through explicit CLI commands and match the package’s stated project-management purpose. The encoded-runner and Trojan Source indicators were not substantiated by the inspected source.
Evidence
dist/index.jsdist/commands/create.jsdist/lib/cli-build.jsdist/commands/init.jsdist/lib/behavioral-injection.js
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point parses CLI arguments only when invoked as the CLI; actions are exposed as explicit commands.
- The flagged build helper is called from the create flow and runs npm with --ignore-scripts; it does not decode or execute a hidden package-runner command.
- The init command writes project agent configuration as part of its explicit scaffolding flow.
- The Unicode-related match is an escaped bidi-character pattern in a sanitizer that removes control characters from messages.
Evidence against
- The manifest declares prepare and prepublishOnly scripts, but no install, preinstall, or postinstall hook.
- No evidence showed credentials being sent to an unrelated host or agent settings being changed automatically.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggeddist/index.jsView file
70const __dirname = dirname(fileURLToPath(import.meta.url));
L71: const require = createRequire(import.meta.url);
L72: const pkg = require(join(__dirname, '../package.json'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L70dist/lib/cli-build.jsView file
24*/
L25: import { spawnSync } from 'child_process';
L26: import { accessSync, constants, lstatSync, realpathSync, statSync } from 'fs';
...
L74: * Everything absent from this list is dropped, which removes every `GIT_*` (the
L75: * `testing-tools/git-env.cjs:5-20` reason), every `npm_config_*`, `NODE_ENV`,
L76: * `NODE_OPTIONS`, `NODE_PATH`, `MX_*`, `ANTHROPIC_*`, `AZURE_*`, `GH_TOKEN` and
...
L150: *
L151: * npm's stderr can carry registry-supplied strings. Printing them unfiltered
L152: * into a terminal is escape-sequence injection (CWE-150): an escape run can
...
L186: * leaks the secret rather than the marker. The truncation keeps the tail, so it
L187: * removes a pattern's fixed literal prefix first: `https://`, `ghp_`,
L188: * `github_pat_`, `sk-ant-` and `Authorization:` are al
Critical
Encoded Package Runner Execution
Source decodes numeric character arrays into a child-process package-runner command and executes it.
Findings
4 Critical2 High5 Medium6 Low
CriticalEncoded Package Runner Executiondist/lib/cli-build.js
CriticalTrojan Source Unicodedist/lib/behavioral-injection.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitydist/lib/behavioral-injection.js
CriticalPrevious Version Dangerous Deltadist/commands/new.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/init.js
HighSemantic Analysis Limiteddist/commands/codex-prove-guards.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/agent-config/hooks/git-mutation-guard.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.303.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.303 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.