@mutmutco/codex-plugin@4.5.124: Clean npm security report (Allow)

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package has no install lifecycle scripts, and the flagged agent-configuration location only classifies paths for git checks. The confirmed outbound behavior is limited CLI telemetry to the configured Hub, with an opt-out; no concrete attack behavior was established.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running a CLI command triggers the pre-action handler.

Impact

The inspected behavior reports CLI usage metadata; it does not establish credential disclosure or agent configuration changes.

Mechanism

The telemetry includes the command name, version, CI status, and operating system, and can be disabled with MMI_TELEMETRY=off.

AI rationale

The package has no install lifecycle scripts, and the flagged agent-configuration location only classifies paths for git checks. The confirmed outbound behavior is limited CLI telemetry to the configured Hub, with an opt-out; no concrete attack behavior was established.

Network endpoints1

tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines the package and published files, with no lifecycle scripts.
The CLI sends command name, version, CI status, and OS as telemetry; setting MMI_TELEMETRY to off disables it.
The telemetry call runs from the CLI pre-action handler for the invoked command.
The flagged source location identifies agent configuration directories for git-path classification; it does not write agent settings.
Telemetry uses the configured MMI Hub URL, with a package-defined Hub default.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 5 file(s), 2.63 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.hetzner.cloud, api.vercel.com, cli.github.com, github.com, npm.pkg.github.com, registry.npmjs.org, strategy.mutmut.work, tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Source & flagged code

7 flagged

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/codex-plugin@4.5.84 matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1115if (process.platform === "win32") { L1116: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1117: } else {

High

Child Process

Package source references child process execution.

cli/dist/main.cjsView on unpkg · L1115

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/dist/main.cjsView on unpkg · L39

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/dist/main.cjsView on unpkg

cli/dist/index.cjsView file

4// src/client-version.ts L5: var import_node_fs = require("node:fs"); L6: var import_node_path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/dist/index.cjsView on unpkg · L4

bin/mmi-cli.cmdView file

•path = bin/mmi-cli.cmd kind = build_helper sizeBytes = 150 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/mmi-cli.cmdView on unpkg

Source & flagged code

7 flagged · loading source

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve7()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve7) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/codex-plugin@4.5.84 matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1115if (process.platform === "win32") { L1116: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1117: } else {

Findings

2 Critical3 High5 Medium4 Low

CriticalCredential Exfiltrationcli/dist/main.cjs

CriticalPrevious Version Dangerous Deltacli/dist/main.cjs

HighChild Processcli/dist/main.cjs

HighCommand Output Exfiltrationcli/dist/main.cjs

HighSemantic Analysis Limitedcli/dist/main.cjs

MediumDynamic Requirecli/dist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/mmi-cli.cmd

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mutmutco

Behavioral surface

Related packages

More from @mutmutco

Source & flagged code