registry / mimi-seed / 0.4.3

mimi-seed@0.4.3

Mimi Seed CLI — Claude Code와 Codex에서 앱 출시 운영을 관리합니다.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 92.4 KB of source, external domains: 127.0.0.1, api.github.com, gitlab.com, mimi-seed.pryzm.gg, play.google.com, your-jenkins.example.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 48-88javascript

48 } catch {

49 return;

50 }

51 for (const e of entries) {

52 if (e.isDirectory()) {

53 if (skipDirs.has(e.name)) continue;

54 await visit(path.join(dir, e.name), depth + 1);

55 } else if (e.isFile() && match(e.name)) {

56 found.push(path.join(dir, e.name));

57 }

58 }

59 }

60 await visit(root, 0);

61 return found;

62}

63async function detectHints(cwd) {

64 const hints = [];

65 for (const fname of ["app.json", "app.config.json"]) {

66 const txt = await readIfExists(path.join(cwd, fname));

67 if (!txt) continue;

68 try {

69 const json = JSON.parse(txt);

70 const expo = json.expo ?? json;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L68

71 const pkg = expo?.android?.package;

72 const bid = expo?.ios?.bundleIdentifier;

73 const name = expo?.name;

74 if (pkg || bid) {

75 hints.push({

76 name,

77 packageName: typeof pkg === "string" ? pkg : void 0,

78 bundleId: typeof bid === "string" ? bid : void 0,

79 source: [fname]

80 });

81 }

82 } catch {

83 }

84 }

85 const gradleFiles = await walk(

86 cwd,

87 (n) => n === "build.gradle" || n === "build.gradle.kts",

88 4

Lines 243-283javascript

243 const envToken = process.env.MIMI_SEED_TOKEN;

244 if (envToken) {

245 const webBase = process.env.MIMI_SEED_WEB_BASE ?? "https://mimi-seed.pryzm.gg";

246 return {

247 token: envToken,

248 prefix: envToken.slice(0, 8

Lines 930-970javascript

930 ${kleur5.cyan("mimi-seed auth logout")} OAuth \uD1A0\uD070 \uC0AD\uC81C

931

932${kleur5.bold("\uD50C\uB7AB\uD3FC\uBCC4 \uC790\uACA9\uC99D\uBA85:")}

933 ${kleur5.cyan("mimi-seed auth appstore")} App Store Connect API \uD0A4 (appstore.json)

934 ${kleur5.cyan("mimi-seed auth playstore")} Play \uC11C\uBE44\uC2A4 \uACC4\uC815 JSON \uB4F1\uB85D

935 ${kleur5.cyan(

Lines 1555-1595javascript

1555 if (answer !== "y" && answer !== "yes") {

1556 log2(kleur6.dim("\uCDE8\uC18C\uB428. (--yes \uB85C \uD655\uC778 \uC0DD\uB7B5 \uAC00\uB2A5)"));

1557 return;

1558 }

1559 }

1560

Source & flagged code

4 flagged · loading source

dist/index.jsView file

263// src/git.ts L264: import { execSync } from "child_process"; L265: function isGitRepo(cwd) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L263

950stdio: "inherit", L951: shell: true L952: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L950

1575log2(kleur6.bold("\uC644\uB8CC. Play Console\uC5D0\uC11C \uBC30\uD3EC \uC0C1\uD0DC\uB97C \uD655\uC778\uD558\uC138\uC694.")); L1576: log2(kleur6.dim(" https://play.google.com/console/developers")); L1577: } ... L1579: // src/mcp-restart.ts L1580: import { execSync as execSync2 } from "child_process"; L1581: import fs7 from "fs"; ... L1585: function log3(msg) { L1586: process.stdout.write(msg + "\n"); L1587: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1575

68try { L69: const json = JSON.parse(txt); L70: const expo = json.expo ?? json; ... L128: } L129: const pkgJson = await readIfExists(path.join(cwd, "package.json")); L130: if (pkgJson) { ... L168: // src/handshake.ts L169: import http from "http"; L170: async function awaitHandshake(timeoutMs) { ... L179: res.statusCode = 400; L180: res.end(); L181: return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L68

Findings

4 High3 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 48-88javascript

48 } catch {

49 return;

50 }

51 for (const e of entries) {

52 if (e.isDirectory()) {

53 if (skipDirs.has(e.name)) continue;

54 await visit(path.join(dir, e.name), depth + 1);

55 } else if (e.isFile() && match(e.name)) {

56 found.push(path.join(dir, e.name));

57 }

58 }

59 }

60 await visit(root, 0);

61 return found;

62}

63async function detectHints(cwd) {

64 const hints = [];

65 for (const fname of ["app.json", "app.config.json"]) {

66 const txt = await readIfExists(path.join(cwd, fname));

67 if (!txt) continue;

68 try {

69 const json = JSON.parse(txt);

70 const expo = json.expo ?? json;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L68

71 const pkg = expo?.android?.package;

72 const bid = expo?.ios?.bundleIdentifier;

73 const name = expo?.name;

74 if (pkg || bid) {

75 hints.push({

76 name,

77 packageName: typeof pkg === "string" ? pkg : void 0,

78 bundleId: typeof bid === "string" ? bid : void 0,

79 source: [fname]

80 });

81 }

82 } catch {

83 }

84 }

85 const gradleFiles = await walk(

86 cwd,

87 (n) => n === "build.gradle" || n === "build.gradle.kts",

88 4

Lines 243-283javascript

243 const envToken = process.env.MIMI_SEED_TOKEN;

244 if (envToken) {

245 const webBase = process.env.MIMI_SEED_WEB_BASE ?? "https://mimi-seed.pryzm.gg";

246 return {

247 token: envToken,

248 prefix: envToken.slice(0, 8

Lines 930-970javascript

930 ${kleur5.cyan("mimi-seed auth logout")} OAuth \uD1A0\uD070 \uC0AD\uC81C

931

932${kleur5.bold("\uD50C\uB7AB\uD3FC\uBCC4 \uC790\uACA9\uC99D\uBA85:")}

933 ${kleur5.cyan("mimi-seed auth appstore")} App Store Connect API \uD0A4 (appstore.json)

934 ${kleur5.cyan("mimi-seed auth playstore")} Play \uC11C\uBE44\uC2A4 \uACC4\uC815 JSON \uB4F1\uB85D

935 ${kleur5.cyan(

Lines 1555-1595javascript

1555 if (answer !== "y" && answer !== "yes") {

1556 log2(kleur6.dim("\uCDE8\uC18C\uB428. (--yes \uB85C \uD655\uC778 \uC0DD\uB7B5 \uAC00\uB2A5)"));

1557 return;

1558 }

1559 }

1560