registry / @memnexus-ai/mx-agent-cli / 0.1.299
@memnexus-ai/mx-agent-cli@0.1.299
CLI for creating and managing AI agent teams
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged execution builds the CLI inside a validated worktree with npm lifecycle scripts disabled, and agent configuration writes occur during project initialization. The coordination credential flow sends a stored MemNexus key to the package’s own service as part of starting a team.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Build runs during explicit provisioning; configuration deployment runs during project initialization; token resolution runs during an explicit team start.
Impact
No malicious impact identified in the reviewed paths.
Mechanism
The build runs npm with lifecycle scripts ignored inside a checked worktree. Initialization deploys project agent configuration. Coordination sends the MemNexus user key to the configured coordination service.
AI rationale
The flagged execution builds the CLI inside a validated worktree with npm lifecycle scripts disabled, and agent configuration writes occur during project initialization. The coordination credential flow sends a stored MemNexus key to the package’s own service as part of starting a team.
Evidence
dist/lib/cli-build.jsdist/commands/create.jsdist/commands/init.jsdist/commands/start.jsdist/lib/coordination-token.js.claude/settings.jsonCLAUDE.md.claude/hooks/
Network endpoints1
mxagent.dev.memnexus.ai
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares `prepublishOnly` and `prepare`, with no `preinstall`, `install`, or `postinstall` script.
- The flagged process execution is `npm ci` and `npm run build` in a validated project worktree; `npm ci` uses `--ignore-scripts` and the build is reached during provisioning.
- Project agent configuration deployment is part of the `new`/init scaffold flow, which writes the project’s Claude settings and hooks.
- When `start` resolves a coordination token, the user key is sent in a request to the configured coordination service, which defaults to the package’s MemNexus service.
Evidence against
- The CLI can automatically resolve a coordination token during `start`, including reading a stored MemNexus user key.
- The init scaffold writes files into the project’s `.claude` configuration directory.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
8 flaggeddist/index.jsView file
70const __dirname = dirname(fileURLToPath(import.meta.url));
L71: const require = createRequire(import.meta.url);
L72: const pkg = require(join(__dirname, '../package.json'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L70dist/lib/cli-build.jsView file
24*/
L25: import { spawnSync } from 'child_process';
L26: import { accessSync, constants, lstatSync, realpathSync, statSync } from 'fs';
...
L74: * Everything absent from this list is dropped, which removes every `GIT_*` (the
L75: * `testing-tools/git-env.cjs:5-20` reason), every `npm_config_*`, `NODE_ENV`,
L76: * `NODE_OPTIONS`, `NODE_PATH`, `MX_*`, `ANTHROPIC_*`, `AZURE_*`, `GH_TOKEN` and
...
L150: *
L151: * npm's stderr can carry registry-supplied strings. Printing them unfiltered
L152: * into a terminal is escape-sequence injection (CWE-150): an escape run can
...
L186: * leaks the secret rather than the marker. The truncation keeps the tail, so it
L187: * removes a pattern's fixed literal prefix first: `https://`, `ghp_`,
L188: * `github_pat_`, `sk-ant-` and `Authorization:` are al
Critical
Encoded Package Runner Execution
Source decodes numeric character arrays into a child-process package-runner command and executes it.
Findings
4 Critical2 High5 Medium6 Low
CriticalEncoded Package Runner Executiondist/lib/cli-build.js
CriticalTrojan Source Unicodedist/lib/behavioral-injection.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitydist/lib/behavioral-injection.js
CriticalPrevious Version Dangerous Deltadist/lib/coordination-token.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/init.js
HighSemantic Analysis Limiteddist/commands/codex-prove-guards.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/agent-config/hooks/git-mutation-guard.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @memnexus-ai/mx-agent-cli@0.1.299.
See all versions of @memnexus-ai/mx-agent-cli for other recorded verdicts.
- Review the evidence and your use of @memnexus-ai/mx-agent-cli@0.1.299 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.