mint@4.2.1146
The Mintlify CLI
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the runtime behavior inspected is the declared CLI plus package-aligned command telemetry. No concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the mint CLI.
Impact
No attack impact was established; the observed network activity is package-aligned CLI telemetry.
Mechanism
The wrapper forwards CLI arguments to the bundled command, whose telemetry middleware records a sanitized command.
AI rationale
The manifest has no install lifecycle hook, and the runtime behavior inspected is the declared CLI plus package-aligned command telemetry. No concrete attack behavior was found.
Network endpoints1
ph.mintlify.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares only a cleanup script and depends on @mintlify/cli 4.0.1749.
- The CLI package exports its bin entrypoint, which forwards arguments to its bundled start.js command.
- Telemetry is triggered during CLI command handling and sent to the Mintlify-hosted endpoint; configuration can disable it.
Evidence against
Behavioral surface
Trivial
Source & flagged code
7 flaggedpackage.jsonView file
29"scripts": {
"clean:all": "rimraf node_modules"
},
Low
Ai Review Evidence
package.json declares only a cleanup script and depends on @mintlify/cli 4.0.1749.
package.jsonView on unpkg · L2933"@mintlify/cli": "4.0.1749"
Low
Ai Review Evidence
package.json declares only a cleanup script and depends on @mintlify/cli 4.0.1749.
package.jsonView on unpkg · L33.lpm-dependency-evidence-33f3cb39-bf53-4c63-84dc-b45a5702d7ef/0/npm-linux/package.jsonView file
28"exports": "./bin/index.js",
Low
Ai Review Evidence
The CLI package exports its bin entrypoint, which forwards arguments to its bundled start.js command.
.lpm-dependency-evidence-33f3cb39-bf53-4c63-84dc-b45a5702d7ef/0/npm-linux/package.jsonFindings
8 Low
LowScripts Present
LowAi Review Evidencepackage.json
LowAi Review Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-33f3cb39-bf53-4c63-84dc-b45a5702d7ef/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-33f3cb39-bf53-4c63-84dc-b45a5702d7ef/0/npm-linux/bin/index.js
LowAi Review Evidence.lpm-dependency-evidence-33f3cb39-bf53-4c63-84dc-b45a5702d7ef/0/npm-linux/bin/middlewares/telemetryMiddleware.js
LowAi Review Evidence.lpm-dependency-evidence-33f3cb39-bf53-4c63-84dc-b45a5702d7ef/0/npm-linux/bin/config.js
LowAi Review Evidence.lpm-dependency-evidence-33f3cb39-bf53-4c63-84dc-b45a5702d7ef/0/npm-linux/bin/telemetry/client.js
Affected versions and remediation
This report applies to mint@4.2.1146.
See all versions of mint for other recorded verdicts.
- Review the evidence and your use of mint@4.2.1146 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.