registry / @memnexus-ai/mx-agent-cli / 0.1.268
@memnexus-ai/mx-agent-cli@0.1.268
CLI for creating and managing AI agent teams
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsObfuscatedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/lib/fleet-data.jsView file
20import { join } from 'path';
L21: import { spawnSync } from 'child_process';
L22: import { listTeams } from './catalog.js';
High
Child Process
Package source references child process execution.
dist/lib/fleet-data.jsView on unpkg · L20dist/lib/gh-remote.jsView file
57// 1. gh present? Probe directly (shell-free) so a missing binary surfaces as a
L58: // non-zero/ null status via ENOENT. Avoids `command -v gh` under `shell: true`,
L59: // which triggers Node DEP0190 (passing args with shell option true).
High
dist/index.jsView file
Findings
4 High5 Medium7 Low
HighChild Processdist/lib/fleet-data.js
HighShelldist/lib/gh-remote.js
HighSame File Env Network Executiondist/commands/pr-sync.js
HighPrevious Version Dangerous Deltadist/commands/monitor.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/agent-config/hooks/git-mutation-guard.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.268.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.268 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.