@mutmutco/codex-plugin@4.5.135: Clean npm security report (Allow)

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package manifest has no install lifecycle hooks, and the inspected CLI telemetry is limited to command metadata sent to its Hub endpoint with an opt-out. The agent-config finding is a path filter for untracked-change checks, not a configuration write.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Telemetry runs when a user invokes a CLI command.

Impact

No credential transfer or agent-configuration mutation was established in the inspected behavior.

Mechanism

The CLI posts the command name, version, CI status, and operating system to the Hub URL; MMI_TELEMETRY=off disables the request.

AI rationale

The package manifest has no install lifecycle hooks, and the inspected CLI telemetry is limited to command metadata sent to its Hub endpoint with an opt-out. The agent-config finding is a path filter for untracked-change checks, not a configuration write.

Network endpoints1

tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines no lifecycle hooks; it packages the plugin, skills, launcher, and CLI.
The agent-config paths are excluded from untracked-change checks; this code does not modify those configurations.
Telemetry is sent when a CLI command runs and contains the command, version, CI status, and operating system; it can be disabled with MMI_TELEMETRY=off.
The telemetry request goes to the configured Hub URL, whose default is the package's Hub endpoint.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 5 file(s), 2.64 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.hetzner.cloud, api.vercel.com, cli.github.com, github.com, npm.pkg.github.com, registry.npmjs.org, strategy.mutmut.work, tqxxwzftic.execute-api.eu-central-1.amazonaws.com

Source & flagged code

7 flagged

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve8()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve8) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/codex-plugin@4.5.84 matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1115if (process.platform === "win32") { L1116: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1117: } else {

High

Child Process

Package source references child process execution.

cli/dist/main.cjsView on unpkg · L1115

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve8()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve8) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli/dist/main.cjsView on unpkg · L39

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/dist/main.cjsView on unpkg

cli/dist/index.cjsView file

4// src/client-version.ts L5: var import_node_fs = require("node:fs"); L6: var import_node_path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/dist/index.cjsView on unpkg · L4

bin/mmi-cli.cmdView file

•path = bin/mmi-cli.cmd kind = build_helper sizeBytes = 150 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/mmi-cli.cmdView on unpkg

Source & flagged code

7 flagged · loading source

cli/dist/main.cjsView file

39function globalDispatcher() { L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL]; L41: } ... L80: try { L81: stream.write("", () => resolve8()); L82: } catch { ... L88: await Promise.race([ L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]), L90: new Promise((resolve8) => { ... L140: CLI_EXIT_WATCHDOG_MS = (() => { L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS); L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

cli/dist/main.cjsView on unpkg · L39

•matchType = previous_version_dangerous_delta matchedPackage = @mutmutco/codex-plugin@4.5.84 matchedIdentity = npm:QG11dG11dGNvL2NvZGV4LXBsdWdpbg:4.5.84 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/dist/main.cjsView on unpkg

1115if (process.platform === "win32") { L1116: (0, import_node_child_process2.execFileSync)("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); L1117: } else {

Findings

2 Critical3 High5 Medium4 Low

CriticalCredential Exfiltrationcli/dist/main.cjs

CriticalPrevious Version Dangerous Deltacli/dist/main.cjs

HighChild Processcli/dist/main.cjs

HighCommand Output Exfiltrationcli/dist/main.cjs

HighSemantic Analysis Limitedcli/dist/main.cjs

MediumDynamic Requirecli/dist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/mmi-cli.cmd

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mutmutco

Behavioral surface

Related packages

More from @mutmutco

Source & flagged code