registry / mindexec-ai / 0.2.897

mindexec-ai@0.2.897

MindExec local runtime and bridge CLI

AI Security Review

scanned 7h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

user runs mindexec/npx mindexec-ai or calls protected local APIs

Impact

dangerous dual-use local automation if exposed token/pairing secrets are misused

Mechanism

local bridge with Codex execution, MCP proxy, remote agent hub, and workspace file operations

Rationale

Static inspection shows a powerful AI local bridge and externally bindable remote hub, but the only install-time behavior is package-local grammar setup and the agent/Codex capabilities are user-invoked and token-gated. This is unresolved dangerous capability risk rather than concrete malware or unconsented lifecycle hijack.

Evidence

package.jsonscripts/setup-tree-sitter-grammars.mjslaunch-bridge.cjsserver.jscodex-runtime.jsremote-hub.jsport-guard.cjsREADME.mdtree-sitter-grammars/*.wasm.mindexec/~/.mindexec/codex-runtime/config.toml~/.mindexec/codex-runtime/auth.json~/.codex/auth.json

Network endpoints10

127.0.0.1:5167localhost:5167/mindcanvastcp://0.0.0.0:5199127.0.0.1:5077api.openai.com/v1html.duckduckgo.com/html/api.duckduckgo.com/search.brave.com/searchnews.google.com/rss/searchwww.bing.com/search

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

codex-runtime.js can spawn Codex CLI for user-supplied API prompts and workspaces.
codex-runtime.js creates ~/.mindexec/codex-runtime and copies ~/.codex/auth.json into that isolated runtime home.
remote-hub.js starts a RemoteHub listener on 0.0.0.0 by default, gated by pairToken.
server.js exposes protected local APIs for Codex, MCP calls, remote devices, file writes, and browser actions.

Evidence against

package.json postinstall only runs scripts/setup-tree-sitter-grammars.mjs.
scripts/setup-tree-sitter-grammars.mjs only ensures packaged tree-sitter wasm files under tree-sitter-grammars/.
server.js binds main LocalBridge HTTP server to 127.0.0.1 and protects dangerous routes with X-Bridge-Token.
launch-bridge.cjs is a user-invoked CLI that starts server.js and optionally opens localhost UI.
No lifecycle hook writes Claude/Codex/Cursor foreign control surfaces or registers MCP servers.
Network endpoints are product-aligned local bridge, remote hub, search/OAuth/API features.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 4.98 MB of source, external domains: 127.0.0.1, api.duckduckgo.com, api.imagerouter.io, api.openai.com, bulkmd.pages.dev, clipbrd.pages.dev, developers.cloudflare.com, duckduckgo.com, example.com, github.com, html.duckduckgo.com, img.youtube.com, markdown-link-checker.pages.dev, mcp.example.test, md2html-4r7.pages.dev, mdoutln.pages.dev, mdtable-3ik.pages.dev, mdview-die.pages.dev, mindexec.pages.dev, mindexecution.pages.dev, news.google.com, openrouter.ai, quickpad.pages.dev, reactjs.org, readme-1o4.pages.dev, schema.org, search.brave.com, www.bing.com, www.googleapis.com, www.w3.org, www.youtube.com

Source & flagged code

12 flagged

package.jsonView file

Lines 20-60json

20 ],

21 "scripts": {

22 "start": "node launch-bridge.cjs",

23 "dev": "node launch-bridge.cjs --watch",

24 "test:syntax": "node --check server.js && node --check remote-hub.js && node --check codex-runtime.js && node --check launch-bridge.cjs && node --check port-guard.cjs && node --check scripts/setup-tree-sitter-grammars.mjs && node --check scripts/auth-session-smoke.mjs && node --check scripts/remote-hub-smoke.mjs && node --check scripts/remote-hub-scale-smoke.mjs && node --check scripts/remote-fleet-render-smoke.mjs && node --check scripts/remote-http-smoke.mjs && node --check scripts/remote-frame-ws-smoke.mjs && node --check scripts/remote-input-ws-smoke.mjs && node --check scripts/remote- ...

25 "test:auth": "node scripts/auth-session-smoke.mjs",

26 "test:remote": "node scripts/remote-hub-smoke.mjs",

27 "test:remote:scale": "node scripts/remote-hub-scale-smoke.mjs",

28 "test:remote:render": "node scripts/remote-fleet-render-smoke.mjs",

29 "test:remote:http": "node scripts/remote-http-smoke.mjs",

30 "test:remote:frame-ws": "node scripts/remote-frame-ws-smoke.mjs",

31 "test:remote:input-ws": "node scripts/remote-input-ws-smoke.mjs",

32 "test:remote:agent-ws": "node scripts/remote-agent-ws-smoke.mjs",

33 "test:remote:managed": "node scripts/remote-agent-managed-smoke.mjs",

34 "test:remote:registry": "node scripts/remote-registry-follower-smoke.mjs",

35 "test:remote:package": "node scripts/remote-agent-package-smoke.mjs",

36 "test:remote:live-rate": "node scripts/remote-fast-live-rate-smoke.mjs",

37 "test:remote:mdm-browser": "node scripts/remote-fast-mdm-browser-smoke.mjs",

38 "pack:dry": "npm pack --dry-run",

39 "setup:grammars": "node scripts/setup-tree-sitter-grammars.mjs",

40 "postinstall": "npm run setup:grammars"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "keywords": [

43 "mindexec",

44 "mindcanvas",

45 "cli",

46 "bridge",

47 "local",

48 "ai"

49 ],

50 "author": "",

51 "license": "MIT",

52 "publishConfig": {

53 "access": "public"

54 },

55 "engines": {

56 "node": ">=20"

57 },

58 "dependencies": {

59 "@mindexec/remote": "^0.1.17",

60 "@openai/codex-sdk": "^0.137.0",

Long lines were clipped for display.

server.jsView file

18import sharp from 'sharp'; L19: import { createServer } from 'http'; L20: import { WebSocket, WebSocketServer } from 'ws'; ... L28: L29: const execAsync = promisify(exec); L30: const execFileAsync = promisify(execFile); ... L33: const app = express(); L34: const PORT = normalizePort(process.env.BRIDGE_PORT); L35: const BRIDGE_ROOT = path.dirname(fileURLToPath(import.meta.url));

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

server.jsView on unpkg · L18

•Trigger-reachable chain: manifest.main -> server.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg

12import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L12

28L29: const execAsync = promisify(exec); L30: const execFileAsync = promisify(execFile);

High

wwwroot/assets/canvas-ai-task-core-DyNJof-L.jsView file

Lines 1128-1168javascript

1128 list,

1129 stats,

1130 json,

1131 url,

1132 outreach,

1133 experiment,

1134 campaign,

1135 artifact,

1136 action,

1137 metric,

1138 math: Object.freeze({

wwwroot/assets/supabaseAuthAdapter-_4BPk0jl.jsView file

Lines 23-45javascript

23 import ws from "ws"

24 const client = new RealtimeClient(url, {

25 ...options,

26 transport: ws

27 })`):new Error(`WebSocket not available: ${r}`)}this._handleNodeJsRaceCondition()}}endpointURL(){return this.socketAdapter.endPointURL()}async disconnect(e,r){return this._cancelPendingDisconnect(),this.isDisconnecting()?"ok":await this.socketAdapter.disconnect(()=>{clearInterval(this._workerHeartbeatTimer),this._terminateWorker()},e,r)}getChannels(){return this.channels}async removeChannel(e){const r=await e.unsubscribe();return r==="ok"&&e.teardown(),r}async removeAllChannels(){const e=this.channels.map(async s=>{const n=await s.unsubscribe();return s.teardown(),n}),r=await Promise.all(e); ...

scripts/remote-fast-mdm-browser-smoke.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3import assert from 'node:assert/strict';

4import { spawn } from 'node:child_process';

5import { mkdtemp, rm } from 'node:fs/promises';

6import net from 'node:net';

7import

remote-fast/osx-x64/mindexec-remote-fastView file

•path = remote-fast/osx-x64/mindexec-remote-fast kind = native_binary sizeBytes = 83704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

remote-fast/osx-x64/mindexec-remote-fastView on unpkg

tree-sitter-grammars/tree-sitter-go.wasmView file

•path = tree-sitter-grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-grammars/tree-sitter-go.wasmView on unpkg

start-bridge.batView file

•path = start-bridge.bat kind = build_helper sizeBytes = 558 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

start-bridge.batView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = npm run setup:grammars

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm run setup:grammars

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

server.jsView on unpkg · L18

•Trigger-reachable chain: manifest.main -> server.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg

12import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L12

28L29: const execAsync = promisify(exec); L30: const execFileAsync = promisify(execFile);

High

Shell

Package source references shell execution.

server.jsView on unpkg · L28

wwwroot/assets/canvas-ai-task-core-DyNJof-L.jsView file

1148})(); L1149: `}function ui(t){const a=performance.now(),e=[],n={log:(...r)=>e.push(Ea(r.map(u=>String(u)).join(" "))),warn:(...r)=>e.push(Ea(r.map(u=>String(u)).join(" "))),error:(...r)=>e.push... L1150: `));return{ok:!0,output:await Promise.resolve(r(t.input,n)),logs:e,error:"",durationMs:Math.round(performance.now()-a),isolation:"inline-test-fallback"}}).catch(r=>({ok:!1,output:n...

High

Eval

Package source references dynamic code evaluation.

wwwroot/assets/canvas-ai-task-core-DyNJof-L.jsView on unpkg · L1148

wwwroot/assets/supabaseAuthAdapter-_4BPk0jl.jsView file

43${b}`}class C extends Error{constructor({message:e,code:r,cause:s,name:n}){var i;super(e,{cause:s}),this.__isWebAuthnError=!0,this.name=(i=n??(s instanceof Error?s.name:void 0))!==... L44: `);const A=await E.signMessage(new TextEncoder().encode(p),"utf8");if(!A||!(A instanceof Uint8Array))throw new Error("@supabase/auth-js: Wallet signMessage() API returned an recogn...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

wwwroot/assets/supabaseAuthAdapter-_4BPk0jl.jsView on unpkg · L43

scripts/remote-fast-mdm-browser-smoke.mjsView file

3Detached bundled service listener: scripts/remote-fast-mdm-browser-smoke.mjs spawns server.js; helper exposes a broad-bound HTTP listener. L3: import assert from 'node:assert/strict'; L4: import { spawn } from 'node:child_process'; L5: import { mkdtemp, rm } from 'node:fs/promises'; L6: import net from 'node:net'; L7: import os from 'node:os'; ... L14: const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); L15: const REQUESTED_FPS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_REQUEST_FPS || 12); L16: const SAMPLE_MS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_SAMPLE_MS || 1500); ... L47: L48: const payload = await response.json().catch(() => null); L49: return { status: response.status, ok: response.ok, payload }; ... L90:

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

scripts/remote-fast-mdm-browser-smoke.mjsView on unpkg · L3

remote-fast/osx-x64/mindexec-remote-fastView file

•path = remote-fast/osx-x64/mindexec-remote-fast kind = native_binary sizeBytes = 83704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

remote-fast/osx-x64/mindexec-remote-fastView on unpkg

tree-sitter-grammars/tree-sitter-go.wasmView file

•path = tree-sitter-grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-grammars/tree-sitter-go.wasmView on unpkg

start-bridge.batView file

•path = start-bridge.bat kind = build_helper sizeBytes = 558 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

start-bridge.batView on unpkg

Findings

2 Critical5 High8 Medium5 Low

CriticalSame File Env Network Executionserver.js

CriticalTrigger Reachable Dangerous Capabilityserver.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processserver.js

HighShellserver.js

HighEvalwwwroot/assets/canvas-ai-task-core-DyNJof-L.js

HighSpawned Bundled Service Listenerscripts/remote-fast-mdm-browser-smoke.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirewwwroot/assets/supabaseAuthAdapter-_4BPk0jl.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryremote-fast/osx-x64/mindexec-remote-fast

MediumShips Wasm Moduletree-sitter-grammars/tree-sitter-go.wasm

MediumShips Build Helperstart-bridge.bat

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings