registry / Data exfiltration / min-agent
min-agent
Minimal AI coding agent with tool use, MCP, and skills support
This report shows the evidence for min-agent@3.8.2609240147. 8 of 27 known versions are blocked or flagged. The newest version, 3.10.2609250718, is allowed. See all versions.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe CLI unconditionally ships tool activity and other log lines to a package-controlled Loki host, with only partial secret redaction and no opt-out in the flush path. That is hidden runtime data export, not install-time agent hijacking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the min or min-agent bin, which imports dist/cli.js and calls the startup function.
Impact
Shell commands, file snippets, and other tool payloads can be sent to the package operator. npm install itself does not run this code.
Mechanism
Startup writes a log line. The logger appends tool-call and tool-result text, applies a small secret regex, then flushes batches with a hardcoded Loki URL and tenant header.
Attack narrative
The published CLI starts a logger that both writes under the user config directory and, on a short timer or when the queue fills, POSTs every line to the author's Loki endpoint. Tool wrappers log the tool name and a 200-character slice of inputs and outputs into that stream. A regex blanks a few token shapes, but ordinary command and file text is still uploaded. There is no install hook; the transfer begins as soon as the user launches the binary.
AI rationale
The CLI unconditionally ships tool activity and other log lines to a package-controlled Loki host, with only partial secret redaction and no opt-out in the flush path. That is hidden runtime data export, not install-time agent hijacking.
Evidence
dist/cli.js~/.min-agent/logs
Network endpoints1
loki.lonae.com/loki/api/v1/push
Decision evidence
public snapshotAI called this Malicious at 86.0% confidence as Malware with low false-positive risk.
Evidence for block
- The log flush always POSTs queued lines to a hardcoded Loki URL with no environment gate.
- Tool-call and tool-result helpers write the tool name and the first 200 characters of arguments or output into that same log stream.
- The push URL and tenant header are compile-time constants for loki.lonae.com.
- CLI startup always emits a log line, which arms the uploader before command handling.
- Redaction only replaces a few bearer, key, and GitHub-token patterns before a line is queued.
- package.json has no preinstall, install, or postinstall hook, so this runs when the CLI starts.
Evidence against
- Install does not execute the uploader; only the user-invoked CLI entry does.
- Reading .claude, .agents, and .opencode skill directories is discovery for the running agent, not an install-time write to another agent config.
- A short regex strips some secret shapes before upload, so this is not an unfiltered credential dump.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVars
Source & flagged code
7 flagged · loading sourcedist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: import{createRequire as Lq}from"node:module";var Tq=Object.create;var{getPrototypeOf:Rq,defineProperty:W0,getOwnPropertyNames:Mq}=Object;var T_=Object.prototype.hasOwnProperty;func...
L2: `)}displayWidth(e){return F_(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map((t)=>{if(t==="[options]")return this.styleOptionText(t);if(t==="[command]")retur...
...
L12: (Did you mean one of ${r.join(", ")}?)`;if(r.length===1)return`
L13: (Did you mean ${r[0]}?)`;return""}oV.suggestSimilar=rV});var $_=rn(function(AV){var sV=Dn("node:events").EventEmitter,z0=Dn("node:child_process"),Ha=Dn("node:path"),xE=Dn("node:fs"...
L14: - specify the name in Command constructor or using .name()`);if(t=t||{},t.isDef
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L112(Did you mean one of ${r.join(", ")}?)`;if(r.length===1)return`
L13: (Did you mean ${r[0]}?)`;return""}oV.suggestSimilar=rV});var $_=rn(function(AV){var sV=Dn("node:events").EventEmitter,z0=Dn("node:child_process"),Ha=Dn("node:path"),xE=Dn("node:fs"...
L14: - specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=e._name;if(t.noHelp||t.hidden)e._hidden=!0;return this._registerCommand...
High
Findings
1 Critical5 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to min-agent@3.8.2609240147.
The versions list below shows the verdict for each recorded version.
- Avoid installing min-agent@3.8.2609240147. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.