registry / @mnemonik/cli / 7.140.0
@mnemonik/cli@7.140.0
Mnemonik installer and local project helper
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe package has no npm lifecycle hooks, and the flagged dynamic evaluation is in embedded WebAssembly support. The inspected automatic update path verifies official package metadata, integrity, and a signed release manifest; the supplied agent-configuration locations are comments rather than configuration mutations.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI runs when invoked; an installed runtime may also start its periodic update check.
Impact
No malicious effect was established from the inspected source.
Mechanism
The updater fetches official release metadata and verifies the selected package against a signed manifest and integrity values.
AI rationale
The package has no npm lifecycle hooks, and the flagged dynamic evaluation is in embedded WebAssembly support. The inspected automatic update path verifies official package metadata, integrity, and a signed release manifest; the supplied agent-configuration locations are comments rather than configuration mutations.
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no lifecycle scripts and exposes the CLI through dist/bin.js.
- The eight supplied agent-configuration locations resolve to comments about scanner exclusions and shell snapshots, not configuration writes.
- The CLI installer validates selected hosts and components and reports authorization requirements.
- The updater targets the official package registry and checks release metadata, package integrity, and a signed release manifest before installing an update.
- The eval match is in WebAssembly em-asm support, where generated functions are built from module-provided function bodies; no remote-response execution path was confirmed.
Evidence against
- An installed CLI can start a periodic automatic update check and replace its runtime.
- The bundle contains eval and network code, although the inspected contexts do not establish an attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
7 flaggeddist/diagnostics.jsView file
898import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature } from "node:crypto";
L899: import { execFile, execFileSync } from "node:child_process";
L900: function windowsCommand(file) {
High
Child Process
Package source references child process execution.
dist/diagnostics.jsView on unpkg · L8985213var func = `(${args}) => { ${body} };`;
L5214: ASM_CONSTS[start] = eval(func);
L5215: }
High
1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
L2: var __create = Object.create;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/diagnostics.jsView on unpkg · L1Findings
1 Critical5 High4 Medium4 Low
CriticalRemote Response Code Executiondist/runtime/selfUpdate.js
HighChild Processdist/diagnostics.js
HighEvaldist/diagnostics.js
HighSame File Env Network Executiondist/install/journey.js
HighSandbox Evasion Gated Capabilitydist/install/journey.js
HighCross File Remote Execution Contextdist/auth/credentials.js
MediumDynamic Requiredist/diagnostics.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @mnemonik/cli@7.140.0.
See all versions of @mnemonik/cli for other recorded verdicts.
- Review the evidence and your use of @mnemonik/cli@7.140.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.