registry / @minimax-ai/code / 0.5.5
@minimax-ai/code@0.5.5
⚠ Under reviewMinimax Code — terminal coding agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe postinstall hook and the two agent-configuration hints behave like a local SQLite install check and normal coding-agent file reads, with no self-install chain. A clean decision still cannot be issued because twelve required citation paths exceed the eight-citation cap, so the review stays unresolved.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No install-time or import-time attack trigger was established. The postinstall script runs only the native SQLite compatibility check.
Impact
No confirmed compromise, credential theft, or unconsented agent-control write was established from the inspected entry points. Remaining required files were not fully cited.
Mechanism
The check validates the local Node and glibc environment and loads optional better-sqlite3 for an in-memory query. Agent filename and Codex session reads are ordinary product helpers, not an install mutation.
AI rationale
The postinstall hook and the two agent-configuration hints behave like a local SQLite install check and normal coding-agent file reads, with no self-install chain. A clean decision still cannot be issued because twelve required citation paths exceed the eight-citation cap, so the review stays unresolved.
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json defines one lifecycle script, postinstall, which runs node ./verify-native-install.mjs.
- That verifier, when launched as the process entry, checks the Node and glibc range and smoke-tests optional better-sqlite3 with an in-memory query.
- Declared dependencies are @mariozechner/clipboard and @vscode/ripgrep, not this package name.
- In chunks/chunk-S6GSNWAM.js the names AGENTS.md and CLAUDE.md are members of a read-tool filename set that uses readFile and access.
- The Codex helper in chunks/launcher-GHPADSKI.js joins CODEX_HOME or ~/.codex/sessions and returns if those directory reads fail.
- Twelve paths are required for a clean citation record and this review allows at most eight citations, so a mark_clean result cannot be finalized.
Evidence against
- The postinstall path prints a compatibility result or an install hint and does not write agent configuration or transmit credentials.
- The signed updater downloads a release and runs npm install only inside an explicit apply path after signature and checksum checks.
Behavioral surface
Source & flagged code
23 flaggedpackage.jsonView file
•scripts.postinstall = node ./verify-native-install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgchunks/launcher-GHPADSKI.jsView file
9`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function dC(n){let e=n[0]==="u",t=n[1]==="{";return e&&!t&&n.length===5|...
L10: `);return r!==-1&&(e=g8(e,s,i,r)),i+e+s},gf,yC=(n,...e)=>{let[t]=e;if(!Jl(t)||!Jl(t.raw))return e.join(" ");let i=e.slice(1),s=[t.raw[0]];for(let r=1;r<t.length;r++)s.push(String(i...
L11: ]`).replace("lheading",fy).replace("|table","").replace("blockquote"," {0,3}>").replace("|fences","").replace("|list","").replace("|html","").replace("|tag","").getRegex()},j9=/^\\...
High
Child Process
Package source references child process execution.
chunks/launcher-GHPADSKI.jsView on unpkg · L9220`),i=L7(e.trim());if(!i)return[];let s=new RegExp(`^##\\s+\\[?v?${i}\\]?(?=\\s|\xB7|-|$).*$`,"imu").exec(t);if(!s)return[];let r=t.slice((s.index??0)+s[0].length),o=r.search(/^##\s...
L221: `)){let r=/^\s*-\s+(.+)$/u.exec(s);if(r){i(),t=r[1]??"";continue}let o=s.trim();if(!o||/^#{1,6}\s+/u.test(o)){i();continue}t&&(t+=` ${o}`)}return i(),e}function _7(n){return n.repl...
L222: `,"utf8"),this.writtenTurns.add(i))});return this.pending=t.catch(()=>{}),t}async initializeWrittenTurns(){if(this.initialized)return;let e="";try{e=await iF(this.resultPath,"utf8"...
Findings
1 Critical14 High9 Medium7 Low
CriticalPrevious Version Dangerous Deltachunks/chunk-WJZDMLYV.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processchunks/launcher-GHPADSKI.js
HighShellchunks/launcher-GHPADSKI.js
HighSame File Env Network Executionchunks/chunk-KUDSBDBH.js
HighCredential Redirect Persistencechunks/launcher-GHPADSKI.js
HighCommand Output Exfiltrationchunks/pdfjs-XFA6EEF2.js
HighSandbox Evasion Gated Capabilitychunks/chunk-A3JEH4SG.js
HighCloud Metadata Accesschunks/chunk-YPNDEPC5.js
HighRemote Agent Bridgechunks/chunk-S2IS2DS4.js
HighCross File Remote Execution Contextchunks/chunk-S2IS2DS4.js
Affected versions and remediation
This report applies to @minimax-ai/code@0.5.5.
See all versions of @minimax-ai/code for other recorded verdicts.
- Review the evidence and your use of @minimax-ai/code@0.5.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.