@mutmutco/codex-plugin@4.5.128: Clean npm security report (Allow)

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The manifest has no install hook, and the flagged agent-path code only exempts untracked agent configuration paths from a commit check. The CLI telemetry is limited to command and platform metadata sent to the MMI Hub, so the scanner hints do not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running a CLI command; telemetry can be disabled with MMI_TELEMETRY=off.

Impact

The inspected behavior discloses limited usage and platform metadata; it does not send credentials or environment contents.

Mechanism

The request contains the command path, package version, CI status, and operating system.

AI rationale

The manifest has no install hook, and the flagged agent-path code only exempts untracked agent configuration paths from a commit check. The CLI telemetry is limited to command and platform metadata sent to the MMI Hub, so the scanner hints do not establish malicious behavior.

Evidence

package.jsoncli/dist/main.cjs

Network endpoints1

tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares no lifecycle scripts; installation does not trigger the CLI.
The agent-path match only identifies untracked configuration directories as exempt from a commit check.
CLI telemetry sends the command, version, CI status, and OS to the MMI Hub endpoint; it sends no environment values or credentials.
Telemetry runs on a CLI command pre-action and can be disabled with MMI_TELEMETRY=off.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 5 file(s), 2.63 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.hetzner.cloud, api.vercel.com, cli.github.com, github.com, npm.pkg.github.com, registry.npmjs.org, strategy.mutmut.work, tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Source & flagged code

7 flagged

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve8()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve8) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/codex-plugin@4.5.84 matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1115if (process.platform === "win32") { L1116: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1117: } else {

High

Child Process

Package source references child process execution.

cli/dist/main.cjsView on unpkg · L1115

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve8()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve8) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/dist/main.cjsView on unpkg · L39

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/dist/main.cjsView on unpkg

cli/dist/index.cjsView file

4// src/client-version.ts L5: var import_node_fs = require("node:fs"); L6: var import_node_path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/dist/index.cjsView on unpkg · L4

bin/mmi-cli.cmdView file

•path = bin/mmi-cli.cmd kind = build_helper sizeBytes = 150 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/mmi-cli.cmdView on unpkg

Source & flagged code

7 flagged · loading source

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve8()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve8) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/codex-plugin@4.5.84 matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1115if (process.platform === "win32") { L1116: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1117: } else {

Findings

2 Critical3 High5 Medium4 Low

CriticalCredential Exfiltrationcli/dist/main.cjs

CriticalPrevious Version Dangerous Deltacli/dist/main.cjs

HighChild Processcli/dist/main.cjs

HighCommand Output Exfiltrationcli/dist/main.cjs

HighSemantic Analysis Limitedcli/dist/main.cjs

MediumDynamic Requirecli/dist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/mmi-cli.cmd

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mutmutco

Behavioral surface

Related packages

More from @mutmutco

Source & flagged code