@mutmutco/codex-plugin@4.5.105: Clean npm security report (Allow)

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package has no install lifecycle hooks, and the flagged agent-config path is used for path classification rather than configuration mutation. The inspected runtime telemetry is limited to CLI usage metadata sent to the package’s Hub during a user-run command, so no malicious behavior was established.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs a CLI command.

Impact

The inspected transfer does not include command arguments, credentials, or project contents, and no confirmed attack effect was established.

Mechanism

The CLI posts the command name, version, CI status, and operating system to its default Hub endpoint; an environment setting disables this telemetry.

AI rationale

The package has no install lifecycle hooks, and the flagged agent-config path is used for path classification rather than configuration mutation. The inspected runtime telemetry is limited to CLI usage metadata sent to the package’s Hub during a user-run command, so no malicious behavior was established.

Evidence

package.jsoncli/dist/main.cjs

Network endpoints1

tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json contains no lifecycle hooks.
The CLI telemetry payload contains only the command, version, a CI boolean, and operating system; it can be disabled with MMI_TELEMETRY=off.
Telemetry is sent from the CLI pre-action handler when a command runs, to the package’s default Hub endpoint.
The hinted agent-config path is handled by a path-classification helper that normalizes and checks paths; the inspected code does not write agent configuration.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 5 file(s), 2.56 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.hetzner.cloud, api.vercel.com, cli.github.com, github.com, npm.pkg.github.com, registry.npmjs.org, strategy.mutmut.work, tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Source & flagged code

7 flagged

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/codex-plugin@4.5.84 matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1111if (process.platform === "win32") { L1112: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1113: } else {

High

Child Process

Package source references child process execution.

cli/dist/main.cjsView on unpkg · L1111

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/dist/main.cjsView on unpkg · L39

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/dist/main.cjsView on unpkg

cli/dist/index.cjsView file

4// src/client-version.ts L5: var import_node_fs = require("node:fs"); L6: var import_node_path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/dist/index.cjsView on unpkg · L4

bin/mmi-cli.cmdView file

•path = bin/mmi-cli.cmd kind = build_helper sizeBytes = 150 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/mmi-cli.cmdView on unpkg

Source & flagged code

7 flagged · loading source

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/codex-plugin@4.5.84 matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1111if (process.platform === "win32") { L1112: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1113: } else {

Findings

2 Critical3 High5 Medium4 Low

CriticalCredential Exfiltrationcli/dist/main.cjs

CriticalPrevious Version Dangerous Deltacli/dist/main.cjs

HighChild Processcli/dist/main.cjs

HighCommand Output Exfiltrationcli/dist/main.cjs

HighSemantic Analysis Limitedcli/dist/main.cjs

MediumDynamic Requirecli/dist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/mmi-cli.cmd

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mutmutco

Behavioral surface

Related packages

More from @mutmutco

Source & flagged code