registry / @minimax-ai/code / 0.4.8
@minimax-ai/code@0.4.8
⚠ Under reviewMinimax Code — terminal coding agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected behavior is consistent with native dependency verification and an interactive resume feature, with no confirmed malicious operation. A clean publication decision cannot be made because required clean citation coverage exceeds the available citation capacity.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the SQLite check; launching the application may discover a recent local Codex session when the resume skill is present.
Impact
No source evidence showed credential transmission, remote payload execution, destructive action, or agent configuration mutation.
Mechanism
The install hook loads better-sqlite3 for an in-memory check. The launcher resolves the local Codex sessions directory, filters recent records for the current workspace, and exposes only a resume prompt.
AI rationale
The inspected behavior is consistent with native dependency verification and an interactive resume feature, with no confirmed malicious operation. A clean publication decision cannot be made because required clean citation coverage exceeds the available citation capacity.
Decision evidence
public snapshotAI called this Manual Review at 79.0% confidence as Unknown with low false-positive risk.
AI review observations
- The only install hook runs a local native SQLite compatibility check.
- The named launcher code reads limited recent Codex session metadata only when a resume skill is available and presents a resume tip.
- The PDF renderer accepts an explicit user-supplied local file or HTTP URL.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
25 flaggedpackage.jsonView file
•scripts.postinstall = node ./verify-native-install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgchunks/launcher-NIEXEZF5.jsView file
9`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function wS(n){let e=n[0]==="u",t=n[1]==="{";return e&&!t&&n.length===5|...
L10: `);return r!==-1&&(e=u_(e,s,i,r)),i+e+s},Km,PS=(n,...e)=>{let[t]=e;if(!Fl(t)||!Fl(t.raw))return e.join(" ");let i=e.slice(1),s=[t.raw[0]];for(let r=1;r<t.length;r++)s.push(String(i...
L11: ]`).replace("lheading",Ay).replace("|table","").replace("blockquote"," {0,3}>").replace("|fences","").replace("|list","").replace("|html","").replace("|tag","").getRegex()},FA=/^\\...
High
Child Process
Package source references child process execution.
chunks/launcher-NIEXEZF5.jsView on unpkg · L9•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
chunks/launcher-NIEXEZF5.js:
`);Vn.mkdirSync(cs.dirname(we),{recursive:!0}),Vn.writeFileSync(we,ce),this.stop();let Z=[`Rendered line ${O} exceeds terminal width (${x(B)} > ${e}).`,"","This is likely caused by...
`);Vn.writeFileSync(B,z)}_.flush(),this.cursorRow=Math.max(0,c.length-1),this.hardwareCursorRow=U,this.maxLinesRendered=Math.max(this.maxLinesRendered,c.length),this.previousViewpo...
`).map(s=>h.hex(d.text)(s))}}function L_(){return{heading:n=>h.bold.hex(d.markdownHeading)(n),link:n=>h.hex(d.markdownLink)(n),linkUrl:n=>h.hex(d.dim)(n),code:n=>h.hex(d.markdownCo...
Check the selected provider API key and endpoint, then resend
Findings
3 Critical14 High9 Medium7 Low
CriticalBrowser Credential Phishingchunks/chunk-X5PAB4UH.js
CriticalTrigger Reachable Dangerous Capabilitychunks/chunk-X5PAB4UH.js
CriticalPrevious Version Dangerous Deltachunks/chunk-DV5WIEGS.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processchunks/launcher-NIEXEZF5.js
HighShellassets/skills/pdf/scripts/render_html.cjs
HighSame File Env Network Executionchunks/chunk-TRPB3GW5.js
HighCredential Redirect Persistencechunks/launcher-NIEXEZF5.js
HighCommand Output Exfiltrationchunks/chunk-TRPB3GW5.js
HighSandbox Evasion Gated Capabilitychunks/chunk-2CEKQTMO.js
HighCloud Metadata Access
Affected versions and remediation
This report applies to @minimax-ai/code@0.4.8.
See all versions of @minimax-ai/code for other recorded verdicts.
- Review the evidence and your use of @minimax-ai/code@0.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.