mint@4.2.1134
The Mintlify CLI
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe manifest contains no install lifecycle hook, and the inspected launcher runs the CLI only when invoked. These source facts support a clean verdict.
Static reason
No blocking static signals were detected.
Trigger
The CLI runs when a user invokes its command.
Impact
The inspected sources show no unconsented install-time action or other concrete attack behavior.
Mechanism
The package launches the declared CLI dependency and forwards command-line arguments to it.
AI rationale
The manifest contains no install lifecycle hook, and the inspected launcher runs the CLI only when invoked. These source facts support a clean verdict.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest exposes a CLI and declares no install lifecycle hook; its only script removes its own node_modules directory.
- The declared CLI dependency exposes bin/index.js, which starts the CLI when invoked and passes user arguments to the child process without enabling a shell.
Evidence against
Behavioral surface
Trivial
Source & flagged code
3 flaggedpackage.jsonView file
28"bin": "index.js",
"scripts": {
"clean:all": "rimraf node_modules"
},
"dependencies": {
"@mintlify/cli": "4.0.1737"
},
"devDependencies": {
"rimraf": "5.0.1"
},
"gitHead": "30ccd3ad3b9e8ebe888
Low
Suspicious Lifecycle Evidence
The package manifest exposes a CLI and declares no install lifecycle hook; its only script removes its own node_modules directory.
package.jsonView on unpkg · L28.lpm-dependency-evidence-d8b3bddd-afc9-48c1-a31c-e0b459645c65/0/npm-linux/package.jsonView file
28"exports": "./bin/index.js",
"bin": {
"mint": "bin/index.js",
"mintlify": "bin/index.js"
},
"scripts": {
"dev": "pnpm build && NODE_NO_WARNINGS=1 node bin/index.js",
"prepack": "npm run build",
"build": "tsc --project tsco
Low
Suspicious Dependency Evidence
The declared CLI dependency exposes bin/index.js, which starts the CLI when invoked and passes user arguments to the child process without enabling a shell.
.lpm-dependency-evidence-d8b3bddd-afc9-48c1-a31c-e0b459645c65/0/npm-linux/package.jsonView on unpkg · L28Findings
4 Low
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-d8b3bddd-afc9-48c1-a31c-e0b459645c65/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-d8b3bddd-afc9-48c1-a31c-e0b459645c65/0/npm-linux/bin/index.js
Affected versions and remediation
This report applies to mint@4.2.1134.
See all versions of mint for other recorded verdicts.
- Review the evidence and your use of mint@4.2.1134 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.