registry  /  @pheem49/mint  /  1.8.1

@pheem49/mint@1.8.1

A native Tauri desktop AI assistant with a Rust backend and React UI.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a native AI assistant CLI/desktop app with broad user-invoked capabilities, but inspected source gates sensitive actions behind user commands, config, or approval.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install builds CLI; user runs mint commands
Impact
No unconsented exfiltration, persistence, or foreign AI-agent control mutation confirmed
Mechanism
postinstall native build plus user-invoked AI assistant capabilities
Rationale
Static inspection shows a package-aligned native AI assistant with install-time compilation and user-invoked network/agent features, not concrete malicious behavior. The scanner IOC strings correspond to legitimate provider/messaging/update code and an internal headless-agent JSON prompt, not reviewer manipulation or exfiltration.
Evidence
package.jsonsrc/bin/index.jscrates/mint-cli/src/main.rscrates/mint-core/src/config.rscrates/mint-core/src/chat.rscrates/mint-core/src/shell.rscrates/mint-core/src/channels.rscrates/mint-cli/src/updater.rsbin/minttarget/release/mint~/.config/mint/mint-config.json
Network endpoints12
generativelanguage.googleapis.comapi.openai.comapi.anthropic.comopenrouter.aiapi.deepseek.comrouter.huggingface.coapi.telegram.orgdiscord.com/apislack.com/apiapi.github.comwww.googleapis.comapi.search.brave.com

Decision evidence

public snapshot
AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json runs postinstall cargo build and copies target/release/mint to bin/mint
  • src/bin/index.js spawns bin/mint with user CLI args
  • bin/mint is a shipped ELF native executable
  • CLI includes user-invoked shell/file/agent/MCP features with approval/config gates
Evidence against
  • No install-time code found beyond cargo build/copy; mint-cli has no build.rs
  • Network endpoints are package-aligned AI/search/messaging/update APIs in source
  • Config writes are to Mint-owned config files and user-invoked setup/onboarding paths
  • Shell execution requires explicit approval in crates/mint-core/src/shell.rs
  • No credential harvesting or hardcoded exfiltration endpoint found
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
CopyleftLicense
scanned 49 file(s), 930 KB of source, external domains: 127.0.0.1, asset.localhost, facebook.com, github.com, instagram.com, updates.example.com, www.w3.org, youtube.com

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = cargo build -p mint-cli --release && mkdir -p bin && cp target/release/mint bin/mint
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = cargo build -p mint-cli --release && mkdir -p bin && cp target/release/mint bin/mint
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/mintView file
•path = bin/mint kind = binary_string_ioc sizeBytes = 17210464 magicHex = [redacted] matchedPrintableString = ibrary/std/src/time.rs $stopped (not terminated) by signal: start byte index is out of bounds of ` invalid utf-8 sequence of bytes from index mcp tool already allowed: [mint] v | active ai: 'attempted to register forbidden signal https://api.telegram.org/bot /sendmessage received frame crates/mint-core/src/memory.rs #not enough palette entries, expect got unknown multiband sample ( ), please share sample "error parsing sos segment. reason: http error: unable to
Critical
Binary String Ioc

Native or WebAssembly artifact printable strings contain known collector or webhook infrastructure.

bin/mintView on unpkg
•path = bin/mint kind = native_binary sizeBytes = 17210464 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

bin/mintView on unpkg

Findings

1 Critical1 High4 Medium6 Low
CriticalBinary String Iocbin/mint
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumShips Native Binarybin/mint
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License