mint@4.2.1145
The Mintlify CLI
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe package has no install lifecycle hook and delegates its executable to a version-pinned Mintlify CLI. The inspected entrypoints show user-invoked CLI startup and no concrete attack behavior.
Static reason
No blocking static signals were detected.
Trigger
The CLI runs when a user invokes the mint executable.
Impact
No malicious effect was established from the inspected source.
Mechanism
The root executable imports the pinned CLI; its wrapper starts the CLI process and forwards user arguments without a shell.
AI rationale
The package has no install lifecycle hook and delegates its executable to a version-pinned Mintlify CLI. The inspected entrypoints show user-invoked CLI startup and no concrete attack behavior.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no install lifecycle hook; its only script is clean:all, and it pins @mintlify/cli to 4.0.1748.
- The pinned CLI package exposes bin/index.js as its executable entrypoint.
- The CLI wrapper starts its local CLI only when invoked, passing user arguments to node without a shell.
- The root executable imports the pinned CLI package.
Evidence against
Behavioral surface
Trivial
Source & flagged code
4 flaggedpackage.jsonView file
29"scripts": {
"clean:all": "rimraf node_modules"
},
"dependencies": {
"@mintlify/cli": "4.0.1748"
},
"devDependencies": {
"r
Low
Suspicious Lifecycle Evidence
package.json declares no install lifecycle hook; its only script is clean:all, and it pins @mintlify/cli to 4.0.1748.
package.jsonView on unpkg · L29.lpm-dependency-evidence-fe5abe81-39f9-48fa-b123-e981c713f753/0/npm-linux/package.jsonView file
28"exports": "./bin/index.js",
"bin": {
"mint": "bin/index.js",
"mintlify": "bin/index.js"
},
"scripts": {
"dev": "pnpm build && NODE_NO_WARNINGS=1 node bin/index.j
Low
Ai Review Evidence
The pinned CLI package exposes bin/index.js as its executable entrypoint.
.lpm-dependency-evidence-fe5abe81-39f9-48fa-b123-e981c713f753/0/npm-linux/package.jsonView on unpkg · L28Findings
5 Low
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-fe5abe81-39f9-48fa-b123-e981c713f753/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-fe5abe81-39f9-48fa-b123-e981c713f753/0/npm-linux/bin/index.js
LowAi Review Evidenceindex.js
Affected versions and remediation
This report applies to mint@4.2.1145.
See all versions of mint for other recorded verdicts.
- Review the evidence and your use of mint@4.2.1145 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.