registry / @minimax-ai/code / 0.2.6
@minimax-ai/code@0.2.6
Minimax Code — terminal coding agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected code creates a guarded capability to ingest local Codex session history into this package's workflow. It is not shown to exfiltrate data or alter Codex configuration, so blocking is not supported.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the CLI with the resume capability available, followed by use of the resume handoff.
Impact
A user who enables and uses the handoff can expose local Codex session history to this package's agent workflow.
Mechanism
It discovers matching recent Codex session files in the local Codex home and supplies a reader for the selected current-workspace session.
AI rationale
The inspected code creates a guarded capability to ingest local Codex session history into this package's workflow. It is not shown to exfiltrate data or alter Codex configuration, so blocking is not supported.
Evidence
chunks/launcher-UNNRDX2R.jsassets/skills/resume-codex/scripts/session-reader.mjsassets/skills/resume-codex/SKILL.md.codex/sessions
Decision evidence
public snapshotAI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The launcher locates recent Codex session records under the configured Codex home and restricts matches to the current workspace.
- The launcher automatically detects this capability when the resume command is available and presents a recent-session handoff.
- The bundled reader resolves the Codex home and reads a selected matching session.
- The skill requires a matching current workspace and accepts only Codex CLI or VS Code sessions.
Evidence against
- No source evidence shows session contents being sent to a network endpoint.
- The inspected integration is guarded by an available resume command and workspace matching; no foreign agent configuration write was found.
- The manifest postinstall hook is a native SQLite compatibility check, not agent setup.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
23 flaggedpackage.jsonView file
•scripts.postinstall = node ./verify-native-install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgchunks/chunk-DYAIGUK3.jsView file
1import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p,b as T}from"./chunk-6IC2NFSY.js";import{a as y,d as v,e as C,f as g,g as w,h as m,i as M,j as b,k}from"./chunk-5RRKMW2I.js";import{Ja as x}from"./chunk-V265NCK2.js";i...
L3: <html lang="en">
High
Child Process
Package source references child process execution.
chunks/chunk-DYAIGUK3.jsView on unpkg · L1assets/skills/pdf/scripts/render_html.cjsView file
Findings
4 Critical12 High9 Medium6 Low
CriticalSame File Env Network Executionchunks/chunk-VVZRUBTN.js
CriticalCommand Output Exfiltrationchunks/chunk-VVZRUBTN.js
CriticalTrigger Reachable Dangerous Capabilitychunks/chunk-VVZRUBTN.js
CriticalPrevious Version Dangerous Deltachunks/chunk-COTC5RMO.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processchunks/chunk-DYAIGUK3.js
HighShellassets/skills/pdf/scripts/render_html.cjs
HighEvalmatrix-mcp-stdio.js
HighCredential Redirect Persistencechunks/launcher-UNNRDX2R.js
HighCloud Metadata Accesschunks/chunk-IFW4FVPB.js
HighRemote Agent Bridgechunks/chunk-VVZRUBTN.js
Affected versions and remediation
This report applies to @minimax-ai/code@0.2.6.
See all versions of @minimax-ai/code for other recorded verdicts.
- Review the evidence and your use of @minimax-ai/code@0.2.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.