mint@4.2.1144
The Mintlify CLI
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe package has no install hook and delegates execution to its declared CLI dependency. The inspected telemetry is directed to the Mintlify host and respects the telemetry setting; no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Running the mint CLI starts the declared @mintlify/cli entrypoint.
Impact
The inspected behavior supports ordinary CLI use and package-aligned telemetry; no confirmed attack impact was established.
Mechanism
The launcher forwards CLI arguments to a child process; telemetry reports command and environment details to the Mintlify telemetry host when enabled.
AI rationale
The package has no install hook and delegates execution to its declared CLI dependency. The inspected telemetry is directed to the Mintlify host and respects the telemetry setting; no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entrypoint and declares no install lifecycle hook; its only script removes node_modules.
- The entrypoint imports the declared @mintlify/cli dependency, whose launcher forwards arguments to its CLI process.
- The CLI telemetry sends command and environment details to Mintlify’s telemetry host, and tracking is gated by the telemetry preference.
- No attack was identified in the inspected launcher and telemetry paths.
Evidence against
Behavioral surface
Trivial
Source & flagged code
8 flaggedpackage.jsonView file
28"bin": "index.js",
"scripts": {
"clean:all": "rimraf node_modules"
},
"dependencies": {
"@mintlify/cli": "4.0.1747"
},
"
Low
Suspicious Lifecycle Evidence
The manifest exposes a CLI entrypoint and declares no install lifecycle hook; its only script removes node_modules.
package.jsonView on unpkg · L28.lpm-dependency-evidence-16aa665d-0eef-497c-a4e6-3dbdc6483da7/0/npm-linux/package.jsonView file
28"exports": "./bin/index.js",
"bin": {
"mint": "bin/index.js",
"mintlify": "bin/index.js"
},
"scripts": {
"dev": "pnpm build &
Low
Suspicious Dependency Evidence
The entrypoint imports the declared @mintlify/cli dependency, whose launcher forwards arguments to its CLI process.
.lpm-dependency-evidence-16aa665d-0eef-497c-a4e6-3dbdc6483da7/0/npm-linux/package.jsonView on unpkg · L28Findings
9 Low
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-16aa665d-0eef-497c-a4e6-3dbdc6483da7/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-16aa665d-0eef-497c-a4e6-3dbdc6483da7/0/npm-linux/bin/index.js
LowSuspicious Dependency Evidenceindex.js
LowAi Review Evidence.lpm-dependency-evidence-16aa665d-0eef-497c-a4e6-3dbdc6483da7/0/npm-linux/bin/telemetry/client.js
LowAi Review Evidence.lpm-dependency-evidence-16aa665d-0eef-497c-a4e6-3dbdc6483da7/0/npm-linux/bin/telemetry/track.js
LowAi Review Evidence.lpm-dependency-evidence-16aa665d-0eef-497c-a4e6-3dbdc6483da7/0/npm-linux/bin/telemetry/track.js
LowAi Review Evidence.lpm-dependency-evidence-16aa665d-0eef-497c-a4e6-3dbdc6483da7/0/npm-linux/bin/config.js
Affected versions and remediation
This report applies to mint@4.2.1144.
See all versions of mint for other recorded verdicts.
- Review the evidence and your use of mint@4.2.1144 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.