registry / @minimax-ai/code / 0.4.9
@minimax-ai/code@0.4.9
⚠ Under reviewMinimax Code — terminal coding agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected install and agent locations show a compatibility check and user-invoked coding-agent file reads, not a concrete attack. Clean cannot be recorded because ten required citations exceed the eight-citation limit, so the review stays unresolved.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm postinstall runs the native SQLite check; agent file reads occur only when the user launches the CLI.
Impact
A failed native check prints guidance and a non-zero exit code. No confirmed secret theft, persistence, or unconsented agent-control write was identified.
Mechanism
The installer loads better-sqlite3 in memory and reports compatibility. The CLI can read instruction files and recent local Codex session metadata as product features.
AI rationale
Inspected install and agent locations show a compatibility check and user-invoked coding-agent file reads, not a concrete attack. Clean cannot be recorded because ten required citations exceed the eight-citation limit, so the review stays unresolved.
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The only npm lifecycle script is postinstall running verify-native-install.mjs, which smoke-tests optional better-sqlite3 and prints compatibility guidance.
- The flagged agent strings are runtime CLI behavior: a read tool recognizes AGENTS.md and CLAUDE.md, and a launcher reads recent Codex session files under the user Codex home.
- No independent install-time mutation, credential export, or remote payload chain was found, but required clean citation coverage exceeds the eight-citation limit.
Evidence against
- Dependencies are ordinary packages plus optional better-sqlite3, with no runtime self-dependency on this package name.
- The postinstall path sets a non-zero exit code on a failed native check and does not write foreign agent configuration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
25 flaggedpackage.jsonView file
•scripts.postinstall = node ./verify-native-install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgchunks/chunk-2CEKQTMO.jsView file
1import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p}from"./chunk-VPHVKGPT.js";import{e as g,k as d,m as h}from"./chunk-WAVNKSSE.js";import{isAbsolute as f,resolve as A}from"node:path";import{spawn as E}from"node:child_...
High
Child Process
Package source references child process execution.
chunks/chunk-2CEKQTMO.jsView on unpkg · L11import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p}from"./chunk-VPHVKGPT.js";import{e as g,k as d,m as h}from"./chunk-WAVNKSSE.js";import{isAbsolute as f,resolve as A}from"node:path";import{spawn as E}from"node:child_...
Findings
3 Critical14 High9 Medium7 Low
CriticalBrowser Credential Phishingchunks/chunk-X5PAB4UH.js
CriticalTrigger Reachable Dangerous Capabilitychunks/chunk-X5PAB4UH.js
CriticalPrevious Version Dangerous Deltachunks/chunk-DV5WIEGS.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processchunks/chunk-2CEKQTMO.js
HighShellassets/skills/pdf/scripts/render_html.cjs
HighSame File Env Network Executionchunks/chunk-TRPB3GW5.js
HighCredential Redirect Persistencechunks/launcher-BM4HRRYX.js
HighCommand Output Exfiltrationchunks/chunk-TRPB3GW5.js
HighSandbox Evasion Gated Capabilitychunks/chunk-2CEKQTMO.js
HighCloud Metadata Access
Affected versions and remediation
This report applies to @minimax-ai/code@0.4.9.
See all versions of @minimax-ai/code for other recorded verdicts.
- Review the evidence and your use of @minimax-ai/code@0.4.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.