registry / @minimax-ai/code / 0.5.4
@minimax-ai/code@0.5.4
⚠ Under reviewMinimax Code — terminal coding agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe postinstall path and the two agent-configuration hints are package-aligned checks and user-invoked reads, not a concrete install-time attack. A clean verdict still cannot be published because twelve required citation paths exceed the eight-citation limit.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm postinstall runs the SQLite compatibility check; agent file and Codex session reads occur only when the CLI is used.
Impact
Install may exit with a compatibility error. No unconsented agent-control write, secret theft, or remote code execution was shown.
Mechanism
The postinstall script probes Node, glibc, and an in-memory better-sqlite3 query. Separate runtime code can read named instruction files and Codex session logs.
AI rationale
The postinstall path and the two agent-configuration hints are package-aligned checks and user-invoked reads, not a concrete install-time attack. A clean verdict still cannot be published because twelve required citation paths exceed the eight-citation limit.
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with high false-positive risk.
AI review observations
- package.json postinstall only runs node ./verify-native-install.mjs and dependencies do not include this package name.
- verify-native-install.mjs loads optional better-sqlite3 and runs an in-memory SELECT 1 smoke check, then prints a compatibility message.
- chunks/chunk-S6GSNWAM.js treats AGENTS.md and CLAUDE.md as names for the user-invoked read tool.
- chunks/launcher-GKTJRNSO.js looks up ~/.codex/sessions rollout files from the running CLI, not from an install hook.
Evidence against
- Required clean citation coverage lists 12 paths while sourceCitations allows at most 8, so mark_clean cannot be finalized.
- Inspected entrypoints, the postinstall script, and the two agent-configuration hints show no install-time foreign agent writes, credential exfiltration, or remote payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
23 flaggedpackage.jsonView file
•scripts.postinstall = node ./verify-native-install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgchunks/chunk-YQCT64HF.jsView file
1import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p}from"./chunk-XJFOPESF.js";import{e as g,k as d,m as h}from"./chunk-JS2VCCBD.js";import{isAbsolute as f,resolve as A}from"node:path";import{spawn as E}from"node:child_...
High
Child Process
Package source references child process execution.
chunks/chunk-YQCT64HF.jsView on unpkg · L11import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p}from"./chunk-XJFOPESF.js";import{e as g,k as d,m as h}from"./chunk-JS2VCCBD.js";import{isAbsolute as f,resolve as A}from"node:path";import{spawn as E}from"node:child_...
Findings
1 Critical14 High9 Medium7 Low
CriticalPrevious Version Dangerous Deltachunks/chunk-WJZDMLYV.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processchunks/chunk-YQCT64HF.js
HighShellchunks/launcher-GKTJRNSO.js
HighSame File Env Network Executionchunks/chunk-7JIYXQBS.js
HighCredential Redirect Persistencechunks/launcher-GKTJRNSO.js
HighCommand Output Exfiltrationchunks/pdfjs-XFA6EEF2.js
HighSandbox Evasion Gated Capabilitychunks/chunk-YQCT64HF.js
HighCloud Metadata Accesschunks/chunk-YPNDEPC5.js
HighRemote Agent Bridgechunks/chunk-QWAB5G2D.js
HighCross File Remote Execution Contextchunks/chunk-QWAB5G2D.js
Affected versions and remediation
This report applies to @minimax-ai/code@0.5.4.
See all versions of @minimax-ai/code for other recorded verdicts.
- Review the evidence and your use of @minimax-ai/code@0.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.