mint@4.2.1152
The Mintlify CLI
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe package has no install lifecycle hook and delegates CLI execution to @mintlify/cli. Its command telemetry is opt-out capable, sends to a Mintlify host, and does not establish malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the CLI while telemetry is enabled.
Impact
No harmful impact was established from this package-aligned telemetry behavior.
Mechanism
The CLI reports a sanitized command and environment details; command events may include the stored account email.
AI rationale
The package has no install lifecycle hook and delegates CLI execution to @mintlify/cli. Its command telemetry is opt-out capable, sends to a Mintlify host, and does not establish malicious behavior.
Network endpoints1
ph.mintlify.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no install hook and depends on the pinned @mintlify/cli release.
- The package entrypoint launches the CLI when invoked.
- Command telemetry reports a sanitized command name and subcommand.
- When telemetry is enabled, the CLI can include environment details and the stored account email in command events.
- Telemetry supports configuration and environment opt-outs and uses Mintlify's ph.mintlify.com host.
Evidence against
Behavioral surface
Trivial
Source & flagged code
8 flaggedpackage.jsonView file
29"scripts": {
"clean:all": "rimraf node_modules"
},
"dependencies": {
"@mintlify/cli": "4.0.1755"
},
"devDependencies": {
"r
Low
Suspicious Lifecycle Evidence
The package has no install hook and depends on the pinned @mintlify/cli release.
package.jsonView on unpkg · L29.lpm-dependency-evidence-896f66fc-0d1c-4bdf-8c17-c6b40e5c6799/0/npm-linux/package.jsonView file
27},
"exports": "./bin/index.js",
"bin": {
"mint": "bin/index.js",
"mintlify": "bin/index.js"
},
"scripts": {
"dev": "pnpm build && NODE_NO_WARNINGS=1 node
Low
Suspicious Lifecycle Evidence
The package has no install hook and depends on the pinned @mintlify/cli release.
.lpm-dependency-evidence-896f66fc-0d1c-4bdf-8c17-c6b40e5c6799/0/npm-linux/package.jsonView on unpkg · L27Findings
9 Low
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-896f66fc-0d1c-4bdf-8c17-c6b40e5c6799/0/npm-linux/package.json
LowAi Review Evidenceindex.js
LowAi Review Evidence.lpm-dependency-evidence-896f66fc-0d1c-4bdf-8c17-c6b40e5c6799/0/npm-linux/bin/index.js
LowAi Review Evidence.lpm-dependency-evidence-896f66fc-0d1c-4bdf-8c17-c6b40e5c6799/0/npm-linux/bin/start.js
LowAi Review Evidence.lpm-dependency-evidence-896f66fc-0d1c-4bdf-8c17-c6b40e5c6799/0/npm-linux/bin/middlewares/telemetryMiddleware.js
LowAi Review Evidence.lpm-dependency-evidence-896f66fc-0d1c-4bdf-8c17-c6b40e5c6799/0/npm-linux/bin/middlewares/telemetryMiddleware.js
LowAi Review Evidence.lpm-dependency-evidence-896f66fc-0d1c-4bdf-8c17-c6b40e5c6799/0/npm-linux/bin/telemetry/track.js
Affected versions and remediation
This report applies to mint@4.2.1152.
See all versions of mint for other recorded verdicts.
- Review the evidence and your use of mint@4.2.1152 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.