registry / mimi-seed / 0.11.1

mimi-seed@0.11.1

Mimi Seed CLI — Claude Code와 Codex에서 앱 출시 운영을 관리합니다.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 180 KB of source, external domains: 127.0.0.1, api.github.com, gitlab.com, mimi-seed.pryzm.gg, play.google.com

Source & flagged code

2 flagged

dist/chunk-LNEVJJC7.jsView file

Lines 22-62javascript

22function credNote(spec, lang = resolveLang()) {

23 return spec.note?.[lang];

24}

25function credObtain(spec, lang = resolveLang()) {

26 return spec.obtain[lang];

27}

28function credDir(home) {

29 return path.join(home, ".mimi-seed");

30}

31function hasFile(home, name) {

32 return fs.existsSync(path.join(credDir(home), name));

33}

34function anyFileStarting(home, prefix) {

35 try {

36 return fs.readdirSync(credDir(home)).some((f) => f.startsWith(prefix));

37 } catch {

38 return false;

39 }

40}

41function readJson(home, name) {

42 try {

43 return JSON.parse(fs.readFileSync(path.join(credDir(home), name), "utf-8"));

44 } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-LNEVJJC7.jsView on unpkg · L42

45 return null;

46 }

47}

48var EXPIRING_SOON_MS = 7 * 24 * 60 * 60 * 1e3;

49function detectSocialToken(home, file, idKey, tokenKey) {

50 const cfg = readJson(home, file);

51 const id = cfg?.[idKey];

52 const token = cfg?.[tokenKey];

53 if (typeof id !== "string" || !id || typeof token !== "string" || !token) {

54 return { present: false };

55 }

56 const display = typeof cfg.username === "string" && cfg.username || typeof cfg.pageName === "string" && cfg.pageName || id;

57 const expiresAt = typeof cfg.expiresAt === "string" ? Date.parse(cfg.expiresAt) : NaN;

58 if (!Number.isFinite(expiresAt)) return { present: true, detail: display };

59 const remainingMs = expiresAt - Date.now();

60 if (remainingMs <= 0) {

61 return { present: true, detail: display, freshness: "expired", daysRemaining: 0 };

62 }

•matchType = previous_version_dangerous_delta matchedPackage = mimi-seed@0.9.1 matchedIdentity = npm:bWltaS1zZWVk:0.9.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-LNEVJJC7.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/chunk-LNEVJJC7.jsView file

42try { L43: return JSON.parse(fs.readFileSync(path.join(credDir(home), name), "utf-8")); L44: } catch { ... L95: ko: [ L96: "https://mimi-seed.pryzm.gg \uC5D0\uC11C \uAC00\uC785/\uB85C\uADF8\uC778\uD558\uBA74 \uB05D \u2014 \uBE0C\uB77C\uC6B0\uC800\uAC00 \uC54C\uC544\uC11C \uD1A0\uD070\uC744 \uB118\uACA8... L97: "CI \uC5D0\uC11C\uB294 MIMI_SEED_TOKEN \uD658\uACBD\uBCC0\uC218\uB85C \uB300\uCCB4\uD560 \uC218 \uC788\uB2E4." ... L105: detect: (home) => { L106: if (process.env.MIMI_SEED_TOKEN) return { present: true, detail: "MIMI_SEED_TOKEN (env)" }; L107: const cfg = readJson(home, "config.json"); ... L481: } L482: function detectAll(home = os.homedir()) { L483: return new Map(CREDENTIALS.map((c) => [c.id, c.detect(home)]));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-LNEVJJC7.jsView on unpkg · L42

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-LNEVJJC7.jsView on unpkg

Findings

2 High3 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/chunk-LNEVJJC7.js

HighPrevious Version Dangerous Deltadist/chunk-LNEVJJC7.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-LNEVJJC7.jsView file

Lines 22-62javascript

22function credNote(spec, lang = resolveLang()) {

23 return spec.note?.[lang];

24}

25function credObtain(spec, lang = resolveLang()) {

26 return spec.obtain[lang];

27}

28function credDir(home) {

29 return path.join(home, ".mimi-seed");

30}

31function hasFile(home, name) {

32 return fs.existsSync(path.join(credDir(home), name));

33}

34function anyFileStarting(home, prefix) {

35 try {

36 return fs.readdirSync(credDir(home)).some((f) => f.startsWith(prefix));

37 } catch {

38 return false;

39 }

40}

41function readJson(home, name) {

42 try {

43 return JSON.parse(fs.readFileSync(path.join(credDir(home), name), "utf-8"));

44 } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-LNEVJJC7.jsView on unpkg · L42

45 return null;

46 }

47}

48var EXPIRING_SOON_MS = 7 * 24 * 60 * 60 * 1e3;

49function detectSocialToken(home, file, idKey, tokenKey) {

50 const cfg = readJson(home, file);

51 const id = cfg?.[idKey];

52 const token = cfg?.[tokenKey];

53 if (typeof id !== "string" || !id || typeof token !== "string" || !token) {

54 return { present: false };

55 }

56 const display = typeof cfg.username === "string" && cfg.username || typeof cfg.pageName === "string" && cfg.pageName || id;

57 const expiresAt = typeof cfg.expiresAt === "string" ? Date.parse(cfg.expiresAt) : NaN;

58 if (!Number.isFinite(expiresAt)) return { present: true, detail: display };

59 const remainingMs = expiresAt - Date.now();

60 if (remainingMs <= 0) {

61 return { present: true, detail: display, freshness: "expired", daysRemaining: 0 };

62 }

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-LNEVJJC7.jsView on unpkg