registry / mindexec-ai / 0.2.787

mindexec-ai@0.2.787

MindExec local runtime and bridge CLI

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious install-time attack surface was found. Runtime exposes powerful AI-agent, shell, MCP, browser, and remote-device capabilities once the user starts the bridge, with token gating and product-aligned behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs mindexec, mind-bridge, npm start, or node launch-bridge.cjs.

Impact

Dangerous dual-use runtime could execute commands, drive Codex, call MCP servers, and control paired remote devices if the bridge token or remote pairing is exposed.

Mechanism

local AI bridge with remote-agent and command execution APIs

Attack narrative

The scanner's critical finding is explained by the package's declared local bridge: server.js combines environment configuration, network APIs, shell execution, Codex execution, remote-agent management, and auth/session handling. The only lifecycle hook copies tree-sitter grammars inside the package namespace. Runtime behavior is high-risk and agent-facing, including a default externally reachable RemoteHub and npx @latest fallback for @mindexec/remote, but it is activated by running the CLI/server rather than by npm install and is broadly product-aligned.

Rationale

Static inspection supports a warn-level dangerous runtime capability, not malicious install-time compromise or unconsented foreign AI-agent control-surface mutation. The package should not be publish-blocked absent concrete exfiltration, persistence, destructive behavior, or lifecycle-triggered agent hijacking.

Evidence

package.jsonscripts/setup-tree-sitter-grammars.mjslaunch-bridge.cjsserver.jsremote-hub.jscodex-runtime.jsport-guard.cjstree-sitter-grammars/*.wasm.mindexec/~/.mindexec-ai/auth/supabase-session.json~/.mindexec/codex-runtime/config.tomlremote-fast/*/mindexec-remote-fast

Network endpoints10

127.0.0.1:5077127.0.0.1:5167tcp://0.0.0.0api.openai.com/v1html.duckduckgo.com/html/api.duckduckgo.com/search.brave.com/searchnews.google.com/rss/searchwww.bing.com/searchwww.youtube.com/watch

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

server.js starts a local bridge with token-protected shell, Codex, MCP, remote-device, and file APIs.
remote-hub.js defaults RemoteHub host to 0.0.0.0, exposing a paired remote-agent TCP/WebSocket surface at runtime.
server.js can launch bundled remote-fast binaries or npx -y @mindexec/remote@latest for managed remote-agent connections.
codex-runtime.js creates an isolated Codex home under ~/.mindexec/codex-runtime and can spawn codex with user-selected sandbox/approval settings.
server.js can read/store Supabase auth session under ~/.mindexec-ai/auth and use it for remote registry/realtime coordination.

Evidence against

package.json postinstall only runs scripts/setup-tree-sitter-grammars.mjs.
scripts/setup-tree-sitter-grammars.mjs only ensures packaged tree-sitter WASM files are present under tree-sitter-grammars/.
Bridge HTTP server listens on 127.0.0.1, and protected routes require X-Bridge-Token/Authorization token.
No install-time writes to foreign AI-agent control surfaces such as .mcp.json, CLAUDE.md, Cursor, or global Codex config were found.
No credential harvesting/exfiltration or destructive lifecycle behavior was found in inspected source.
Network and shell capabilities are aligned with the declared MindExec local bridge/remote-agent product.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 4.52 MB of source, external domains: 127.0.0.1, api.duckduckgo.com, api.imagerouter.io, api.openai.com, bulkmd.pages.dev, clipbrd.pages.dev, developers.cloudflare.com, duckduckgo.com, example.com, github.com, html.duckduckgo.com, img.youtube.com, markdown-link-checker.pages.dev, md2html-4r7.pages.dev, mdoutln.pages.dev, mdtable-3ik.pages.dev, mdview-die.pages.dev, mindexec.pages.dev, mindexecution.pages.dev, news.google.com, openrouter.ai, quickpad.pages.dev, reactjs.org, readme-1o4.pages.dev, schema.org, search.brave.com, www.bing.com, www.googleapis.com, www.w3.org, www.youtube.com

Source & flagged code

12 flagged

package.jsonView file

Lines 20-60json

20 ],

21 "scripts": {

22 "start": "node launch-bridge.cjs",

23 "dev": "node launch-bridge.cjs --watch",

24 "test:syntax": "node --check server.js && node --check remote-hub.js && node --check codex-runtime.js && node --check launch-bridge.cjs && node --check port-guard.cjs && node --check scripts/setup-tree-sitter-grammars.mjs && node --check scripts/auth-session-smoke.mjs && node --check scripts/remote-hub-smoke.mjs && node --check scripts/remote-hub-scale-smoke.mjs && node --check scripts/remote-fleet-render-smoke.mjs && node --check scripts/remote-http-smoke.mjs && node --check scripts/remote-frame-ws-smoke.mjs && node --check scripts/remote-input-ws-smoke.mjs && node --check scripts/remote- ...

25 "test:auth": "node scripts/auth-session-smoke.mjs",

26 "test:remote": "node scripts/remote-hub-smoke.mjs",

27 "test:remote:scale": "node scripts/remote-hub-scale-smoke.mjs",

28 "test:remote:render": "node scripts/remote-fleet-render-smoke.mjs",

29 "test:remote:http": "node scripts/remote-http-smoke.mjs",

30 "test:remote:frame-ws": "node scripts/remote-frame-ws-smoke.mjs",

31 "test:remote:input-ws": "node scripts/remote-input-ws-smoke.mjs",

32 "test:remote:agent-ws": "node scripts/remote-agent-ws-smoke.mjs",

33 "test:remote:managed": "node scripts/remote-agent-managed-smoke.mjs",

34 "test:remote:registry": "node scripts/remote-registry-follower-smoke.mjs",

35 "test:remote:package": "node scripts/remote-agent-package-smoke.mjs",

36 "test:remote:live-rate": "node scripts/remote-fast-live-rate-smoke.mjs",

37 "test:remote:mdm-browser": "node scripts/remote-fast-mdm-browser-smoke.mjs",

38 "pack:dry": "npm pack --dry-run",

39 "setup:grammars": "node scripts/setup-tree-sitter-grammars.mjs",

40 "postinstall": "npm run setup:grammars"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "keywords": [

43 "mindexec",

44 "mindcanvas",

45 "cli",

46 "bridge",

47 "local",

48 "ai"

49 ],

50 "author": "",

51 "license": "MIT",

52 "publishConfig": {

53 "access": "public"

54 },

55 "engines": {

56 "node": ">=20"

57 },

58 "dependencies": {

59 "@mindexec/remote": "^0.1.17",

60 "@openai/codex-sdk": "^0.137.0",

Long lines were clipped for display.

server.jsView file

18import sharp from 'sharp'; L19: import { createServer } from 'http'; L20: import { WebSocket, WebSocketServer } from 'ws'; ... L28: L29: const execAsync = promisify(exec); L30: const execFileAsync = promisify(execFile); ... L33: const app = express(); L34: const PORT = normalizePort(process.env.BRIDGE_PORT); L35: const BRIDGE_ROOT = path.dirname(fileURLToPath(import.meta.url));

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

server.jsView on unpkg · L18

•Trigger-reachable chain: manifest.main -> server.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg

12import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L12

28L29: const execAsync = promisify(exec); L30: const execFileAsync = promisify(execFile);

High

wwwroot/assets/MindCanvas-RA-lRV7k.jsView file

965})(); L966: `}function Xw(t){const e=performance.now(),a=[],r={log:(...i)=>a.push(rR(i.map(s=>String(s)).join(" "))),warn:(...i)=>a.push(rR(i.map(s=>String(s)).join(" "))),error:(...i)=>a.push... L967: `));return{ok:!0,output:await Promise.resolve(i(t.input,r)),logs:a,error:"",durationMs:Math.round(performance.now()-e),isolation:"inline-test-fallback"}}).catch(i=>({ok:!1,output:n...

High

Eval

Package source references dynamic code evaluation.

wwwroot/assets/MindCanvas-RA-lRV7k.jsView on unpkg · L965

wwwroot/assets/supabaseAuthAdapter-DjshhyTD.jsView file

Lines 23-45javascript

23 import ws from "ws"

24 const client = new RealtimeClient(url, {

25 ...options,

26 transport: ws

27 })`):new Error(`WebSocket not available: ${r}`)}this._handleNodeJsRaceCondition()}}endpointURL(){return this.socketAdapter.endPointURL()}async disconnect(e,r){return this._cancelPendingDisconnect(),this.isDisconnecting()?"ok":await this.socketAdapter.disconnect(()=>{clearInterval(this._workerHeartbeatTimer),this._terminateWorker()},e,r)}getChannels(){return this.channels}async removeChannel(e){const r=await e.unsubscribe();return r==="ok"&&e.teardown(),r}async removeAllChannels(){const e=this.channels.map(async s=>{const n=await s.unsubscribe();return s.teardown(),n}),r=await Promise.all(e); ...

scripts/remote-fast-mdm-browser-smoke.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3import assert from 'node:assert/strict';

4import { spawn } from 'node:child_process';

5import { mkdtemp, rm } from 'node:fs/promises';

6import net from 'node:net';

7import

remote-fast/osx-x64/mindexec-remote-fastView file

•path = remote-fast/osx-x64/mindexec-remote-fast kind = native_binary sizeBytes = 83704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

remote-fast/osx-x64/mindexec-remote-fastView on unpkg

tree-sitter-grammars/tree-sitter-go.wasmView file

•path = tree-sitter-grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-grammars/tree-sitter-go.wasmView on unpkg

start-bridge.batView file

•path = start-bridge.bat kind = build_helper sizeBytes = 558 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

start-bridge.batView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = npm run setup:grammars

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm run setup:grammars

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

server.jsView on unpkg · L18

•Trigger-reachable chain: manifest.main -> server.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg

12import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L12

28L29: const execAsync = promisify(exec); L30: const execFileAsync = promisify(execFile);

High

Shell

Package source references shell execution.

server.jsView on unpkg · L28

wwwroot/assets/MindCanvas-RA-lRV7k.jsView file

High

Eval

Package source references dynamic code evaluation.

wwwroot/assets/MindCanvas-RA-lRV7k.jsView on unpkg · L965

wwwroot/assets/supabaseAuthAdapter-DjshhyTD.jsView file

43${b}`}class C extends Error{constructor({message:e,code:r,cause:s,name:n}){var i;super(e,{cause:s}),this.__isWebAuthnError=!0,this.name=(i=n??(s instanceof Error?s.name:void 0))!==... L44: `);const A=await E.signMessage(new TextEncoder().encode(p),"utf8");if(!A||!(A instanceof Uint8Array))throw new Error("@supabase/auth-js: Wallet signMessage() API returned an recogn...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

wwwroot/assets/supabaseAuthAdapter-DjshhyTD.jsView on unpkg · L43

scripts/remote-fast-mdm-browser-smoke.mjsView file

3Detached bundled service listener: scripts/remote-fast-mdm-browser-smoke.mjs spawns server.js; helper exposes a broad-bound HTTP listener. L3: import assert from 'node:assert/strict'; L4: import { spawn } from 'node:child_process'; L5: import { mkdtemp, rm } from 'node:fs/promises'; L6: import net from 'node:net'; L7: import os from 'node:os'; ... L14: const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); L15: const REQUESTED_FPS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_REQUEST_FPS || 12); L16: const SAMPLE_MS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_SAMPLE_MS || 1500); ... L47: L48: const payload = await response.json().catch(() => null); L49: return { status: response.status, ok: response.ok, payload }; ... L90:

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

scripts/remote-fast-mdm-browser-smoke.mjsView on unpkg · L3

remote-fast/osx-x64/mindexec-remote-fastView file

•path = remote-fast/osx-x64/mindexec-remote-fast kind = native_binary sizeBytes = 83704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

remote-fast/osx-x64/mindexec-remote-fastView on unpkg

tree-sitter-grammars/tree-sitter-go.wasmView file

•path = tree-sitter-grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-grammars/tree-sitter-go.wasmView on unpkg

start-bridge.batView file

•path = start-bridge.bat kind = build_helper sizeBytes = 558 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

start-bridge.batView on unpkg

Findings

2 Critical5 High8 Medium5 Low

CriticalSame File Env Network Executionserver.js

CriticalTrigger Reachable Dangerous Capabilityserver.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processserver.js

HighShellserver.js

HighEvalwwwroot/assets/MindCanvas-RA-lRV7k.js

HighSpawned Bundled Service Listenerscripts/remote-fast-mdm-browser-smoke.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirewwwroot/assets/supabaseAuthAdapter-DjshhyTD.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryremote-fast/osx-x64/mindexec-remote-fast

MediumShips Wasm Moduletree-sitter-grammars/tree-sitter-go.wasm

MediumShips Build Helperstart-bridge.bat

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings