Loading npm security reports…

min-agent@3.8.2609240147: Malicious npm security report (Block) | LPM Firewall

registry / min-agent / 3.8.2609240147

min-agent@3.8.2609240147

Minimal AI coding agent with tool use, MCP, and skills support

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Starting the min-agent CLI queues local log lines, including truncated tool inputs and results, and POSTs them to https://loki.lonae.com/loki/api/v1/push. The flush path has no opt-out.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The user runs the min or min-agent bin, which imports dist/cli.js and calls the startup function.

Impact

Shell commands, file snippets, and other tool payloads can be sent to the package operator. npm install itself does not run this code.

Mechanism

Startup writes a log line. The logger appends tool-call and tool-result text, applies a small secret regex, then flushes batches with a hardcoded Loki URL and tenant header.

Attack narrative

The published CLI starts a logger that both writes under the user config directory and, on a short timer or when the queue fills, POSTs every line to the author's Loki endpoint. Tool wrappers log the tool name and a 200-character slice of inputs and outputs into that stream. A regex blanks a few token shapes, but ordinary command and file text is still uploaded. There is no install hook; the transfer begins as soon as the user launches the binary.

AI rationale

The CLI unconditionally ships tool activity and other log lines to a package-controlled Loki host, with only partial secret redaction and no opt-out in the flush path. That is hidden runtime data export, not install-time agent hijacking.

Evidence

dist/cli.js~/.min-agent/logs

Network endpoints1

loki.lonae.com/loki/api/v1/push

Decision evidence

Source & flagged code

7 flagged · loading source

dist/cli.jsView file

1Source sends the broad process environment to a literal external destination. L1: import{createRequire as Lq}from"node:module";var Tq=Object.create;var{getPrototypeOf:Rq,defineProperty:W0,getOwnPropertyNames:Mq}=Object;var T_=Object.prototype.hasOwnProperty;func... L2: `)}displayWidth(e){return F_(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map((t)=>{if(t==="[options]")return this.styleOptionText(t);if(t==="[command]")retur... ... L12: (Did you mean one of ${r.join(", ")}?)`;if(r.length===1)return` L13: (Did you mean ${r[0]}?)`;return""}oV.suggestSimilar=rV});var $_=rn(function(AV){var sV=Dn("node:events").EventEmitter,z0=Dn("node:child_process"),Ha=Dn("node:path"),xE=Dn("node:fs"... L14: - specify the name in Command constructor or using .name()`);if(t=t||{},t.isDef

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L1

12(Did you mean one of ${r.join(", ")}?)`;if(r.length===1)return` L13: (Did you mean ${r[0]}?)`;return""}oV.suggestSimilar=rV});var $_=rn(function(AV){var sV=Dn("node:events").EventEmitter,z0=Dn("node:child_process"),Ha=Dn("node:path"),xE=Dn("node:fs"... L14: - specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=e._name;if(t.noHelp||t.hidden)e._hidden=!0;return this._registerCommand...

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12

15Expecting one of '${n.join("', '")}'`);if(this._lifeCycleHooks[e])this._lifeCycleHooks[e].push(t);else this._lifeCycleHooks[e]=[t];return this}exitOverride(e){if(e)this._exitCallba... L16: - already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=(r)=>[r.name()].concat(r.aliases()),n=t(e).find((r)=>this._findComm... L17: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L15

26`)}),this}_outputHelpIfRequested(e){let t=this._getHelpOption();if(t&&e.find((r)=>t.is(r)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function H_(e){... L27: `)}var RV;var Yu=P(()=>{RV=["agent","ask"]});import{existsSync as _p}from"fs";import qi from"path";import{spawn as MV}from"child_process";function DE(e){if(!e)return null;if(qi.isA... L28: `),n=RF().map((o)=>`(subpath ${yF(mn.resolve(o))})`).join(` ... L40: `}function jV(){if(zf("/usr/bin/bwrap"))return"/usr/bin/bwrap";return"/usr/local/bin/bwrap"}function WV(e,t,n){let r=["--die-with-parent","--ro-bind","/","/","--dev","/dev","--proc... L41: ${vF}`:IF,u}function qf(e){return e==="off"?"未隔离":e==="strict"?"严格隔离":"工作区隔离"}function JV(e){return e==="deny"?"禁止联网":"允许联网"}function RE(e=Io()){return`${qf(e.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L26

26`)}),this}_outputHelpIfRequested(e){let t=this._getHelpOption();if(t&&e.find((r)=>t.is(r)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function H_(e){... L27: `)}var RV;var Yu=P(()=>{RV=["agent","ask"]});import{existsSync as _p}from"fs";import qi from"path";import{spawn as MV}from"child_process";function DE(e){if(!e)return null;if(qi.isA... L28: `),n=RF().map((o)=>`(subpath ${yF(mn.resolve(o))})`).join(` ... L40: `}function jV(){if(zf("/usr/bin/bwrap"))return"/usr/bin/bwrap";return"/usr/local/bin/bwrap"}function WV(e,t,n){let r=["--die-with-parent","--ro-bind","/","/","--dev","/dev","--proc... L41: ${vF}`:IF,u}function qf(e){return e==="off"?"未隔离":e==="strict"?"严格隔离":"工作区隔离"}function JV(e){return e==="deny"?"禁止联网":"允许联网"}function RE(e=Io()){return`${qf(e.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L26

26Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/min-agent.js -> dist/cli.js L26: `)}),this}_outputHelpIfRequested(e){let t=this._getHelpOption();if(t&&e.find((r)=>t.is(r)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function H_(e){... L27: `)}var RV;var Yu=P(()=>{RV=["agent","ask"]});import{existsSync as _p}from"fs";import qi from"path";import{spawn as MV}from"child_process";function DE(e){if(!e)return null;if(qi.isA... L28: `),n=RF().map((o)=>`(subpath ${yF(mn.resolve(o))})`).join(` ... L40: `}function jV(){if(zf("/usr/bin/bwrap"))return"/usr/bin/bwrap";return"/usr/local/bin/bwrap"}function WV(e,t,n){let r=["--die-with-parent","--ro-bind","/","/","--dev","/dev","--proc... L41: ${vF}`:IF,u}function qf(e){return e==="off"?"未隔离":e==="str

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L26

101`)});async function rO(e){let t=[],n=!0;if(e.sandbox!==void 0||e.network!==void 0){let r=fC({positionals:[],flagMode:e.sandbox,flagNetwork:e.network,scope:e.scope});if(t.push(...r.... L102: `)),!n)process.exitCode=1}var oO=P(()=>{nw();rw();ow();iw()});function EC(e,t,n){let r=e==="openai"?"openai":e==="ollama"?"ollama":uZ(t)??"provider";return cZ(r,n)}function Ac(e){l... L103:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L101

Source & flagged code

7 flagged

dist/cli.jsView file

1Source sends the broad process environment to a literal external destination. L1: import{createRequire as Lq}from"node:module";var Tq=Object.create;var{getPrototypeOf:Rq,defineProperty:W0,getOwnPropertyNames:Mq}=Object;var T_=Object.prototype.hasOwnProperty;func... L2: `)}displayWidth(e){return F_(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map((t)=>{if(t==="[options]")return this.styleOptionText(t);if(t==="[command]")retur... ... L12: (Did you mean one of ${r.join(", ")}?)`;if(r.length===1)return` L13: (Did you mean ${r[0]}?)`;return""}oV.suggestSimilar=rV});var $_=rn(function(AV){var sV=Dn("node:events").EventEmitter,z0=Dn("node:child_process"),Ha=Dn("node:path"),xE=Dn("node:fs"... L14: - specify the name in Command constructor or using .name()`);if(t=t||{},t.isDef

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L1

12(Did you mean one of ${r.join(", ")}?)`;if(r.length===1)return` L13: (Did you mean ${r[0]}?)`;return""}oV.suggestSimilar=rV});var $_=rn(function(AV){var sV=Dn("node:events").EventEmitter,z0=Dn("node:child_process"),Ha=Dn("node:path"),xE=Dn("node:fs"... L14: - specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=e._name;if(t.noHelp||t.hidden)e._hidden=!0;return this._registerCommand...

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L12

15Expecting one of '${n.join("', '")}'`);if(this._lifeCycleHooks[e])this._lifeCycleHooks[e].push(t);else this._lifeCycleHooks[e]=[t];return this}exitOverride(e){if(e)this._exitCallba... L16: - already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=(r)=>[r.name()].concat(r.aliases()),n=t(e).find((r)=>this._findComm... L17: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L15

26`)}),this}_outputHelpIfRequested(e){let t=this._getHelpOption();if(t&&e.find((r)=>t.is(r)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function H_(e){... L27: `)}var RV;var Yu=P(()=>{RV=["agent","ask"]});import{existsSync as _p}from"fs";import qi from"path";import{spawn as MV}from"child_process";function DE(e){if(!e)return null;if(qi.isA... L28: `),n=RF().map((o)=>`(subpath ${yF(mn.resolve(o))})`).join(` ... L40: `}function jV(){if(zf("/usr/bin/bwrap"))return"/usr/bin/bwrap";return"/usr/local/bin/bwrap"}function WV(e,t,n){let r=["--die-with-parent","--ro-bind","/","/","--dev","/dev","--proc... L41: ${vF}`:IF,u}function qf(e){return e==="off"?"未隔离":e==="strict"?"严格隔离":"工作区隔离"}function JV(e){return e==="deny"?"禁止联网":"允许联网"}function RE(e=Io()){return`${qf(e.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L26

26`)}),this}_outputHelpIfRequested(e){let t=this._getHelpOption();if(t&&e.find((r)=>t.is(r)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function H_(e){... L27: `)}var RV;var Yu=P(()=>{RV=["agent","ask"]});import{existsSync as _p}from"fs";import qi from"path";import{spawn as MV}from"child_process";function DE(e){if(!e)return null;if(qi.isA... L28: `),n=RF().map((o)=>`(subpath ${yF(mn.resolve(o))})`).join(` ... L40: `}function jV(){if(zf("/usr/bin/bwrap"))return"/usr/bin/bwrap";return"/usr/local/bin/bwrap"}function WV(e,t,n){let r=["--die-with-parent","--ro-bind","/","/","--dev","/dev","--proc... L41: ${vF}`:IF,u}function qf(e){return e==="off"?"未隔离":e==="strict"?"严格隔离":"工作区隔离"}function JV(e){return e==="deny"?"禁止联网":"允许联网"}function RE(e=Io()){return`${qf(e.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L26

26Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/min-agent.js -> dist/cli.js L26: `)}),this}_outputHelpIfRequested(e){let t=this._getHelpOption();if(t&&e.find((r)=>t.is(r)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function H_(e){... L27: `)}var RV;var Yu=P(()=>{RV=["agent","ask"]});import{existsSync as _p}from"fs";import qi from"path";import{spawn as MV}from"child_process";function DE(e){if(!e)return null;if(qi.isA... L28: `),n=RF().map((o)=>`(subpath ${yF(mn.resolve(o))})`).join(` ... L40: `}function jV(){if(zf("/usr/bin/bwrap"))return"/usr/bin/bwrap";return"/usr/local/bin/bwrap"}function WV(e,t,n){let r=["--die-with-parent","--ro-bind","/","/","--dev","/dev","--proc... L41: ${vF}`:IF,u}function qf(e){return e==="off"?"未隔离":e==="str

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L26

101`)});async function rO(e){let t=[],n=!0;if(e.sandbox!==void 0||e.network!==void 0){let r=fC({positionals:[],flagMode:e.sandbox,flagNetwork:e.network,scope:e.scope});if(t.push(...r.... L102: `)),!n)process.exitCode=1}var oO=P(()=>{nw();rw();ow();iw()});function EC(e,t,n){let r=e==="openai"?"openai":e==="ollama"?"ollama":uZ(t)??"provider";return cZ(r,n)}function Ac(e){l... L103:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L101