registry / @minimax-ai/code / 0.4.10
@minimax-ai/code@0.4.10
⚠ Under reviewMinimax Code — terminal coding agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected install behavior is a native SQLite compatibility check, and the flagged agent reads are launcher features, not an install hook. The required clean citation list is larger than the citation cap, so the review stays unresolved rather than marked clean.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm postinstall runs verify-native-install.mjs. Agent file reads occur only if the mcode launcher is started.
Impact
Install failure is a non-zero exit and a console message. No confirmed secret theft, remote payload, or unconsented agent-config write was established from the inspected hooks.
Mechanism
The install script validates Node, glibc, and an in-memory better-sqlite3 query. The launcher can read local instruction filenames and a matching Codex session record.
AI rationale
Inspected install behavior is a native SQLite compatibility check, and the flagged agent reads are launcher features, not an install hook. The required clean citation list is larger than the citation cap, so the review stays unresolved rather than marked clean.
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json scripts contain only postinstall running node ./verify-native-install.mjs, with no preinstall or install hook and no dependency on this package name.
- That postinstall path checks the Node and glibc range, then loads optional better-sqlite3 for an in-memory SELECT 1 and prints pass or reinstall text.
- Flagged agent sites name AGENTS.md and CLAUDE.md for reads, and the launcher looks up a recent local Codex session id under CODEX_HOME or ~/.codex/sessions when the CLI runs.
- A clean decision would need citations for ten required paths, but sourceCitations allows at most eight, so coverage cannot be completed.
Evidence against
- The postinstall script does not spawn a shell, write agent config, or open a network connection.
- Dependencies are clipboard, ripgrep, and optional better-sqlite3, not another release of this package.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
25 flaggedpackage.jsonView file
•scripts.postinstall = node ./verify-native-install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgchunks/chunk-2CEKQTMO.jsView file
1import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p}from"./chunk-VPHVKGPT.js";import{e as g,k as d,m as h}from"./chunk-WAVNKSSE.js";import{isAbsolute as f,resolve as A}from"node:path";import{spawn as E}from"node:child_...
High
Child Process
Package source references child process execution.
chunks/chunk-2CEKQTMO.jsView on unpkg · L11import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p}from"./chunk-VPHVKGPT.js";import{e as g,k as d,m as h}from"./chunk-WAVNKSSE.js";import{isAbsolute as f,resolve as A}from"node:path";import{spawn as E}from"node:child_...
Findings
3 Critical14 High9 Medium7 Low
CriticalBrowser Credential Phishingchunks/chunk-X5PAB4UH.js
CriticalTrigger Reachable Dangerous Capabilitychunks/chunk-X5PAB4UH.js
CriticalPrevious Version Dangerous Deltachunks/chunk-DV5WIEGS.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processchunks/chunk-2CEKQTMO.js
HighShellassets/skills/pdf/scripts/render_html.cjs
HighSame File Env Network Executionchunks/chunk-TRPB3GW5.js
HighCredential Redirect Persistencechunks/launcher-BO2AIPOJ.js
HighCommand Output Exfiltrationchunks/chunk-TRPB3GW5.js
HighSandbox Evasion Gated Capabilitychunks/chunk-2CEKQTMO.js
HighCloud Metadata Access
Affected versions and remediation
This report applies to @minimax-ai/code@0.4.10.
See all versions of @minimax-ai/code for other recorded verdicts.
- Review the evidence and your use of @minimax-ai/code@0.4.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.