mint@4.2.1153
The Mintlify CLI
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe package is a thin CLI wrapper with no install hook in the inspected manifests. The observed telemetry is package-aligned usage reporting to a vendor endpoint, and the inspected source provides disable settings; no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A user runs the CLI and invokes a command.
Impact
No concrete attack impact is established by the inspected source.
Mechanism
The package delegates to @mintlify/cli, whose command telemetry sends usage and environment details to Mintlify's PostHog host; configuration and environment settings can disable telemetry.
AI rationale
The package is a thin CLI wrapper with no install hook in the inspected manifests. The observed telemetry is package-aligned usage reporting to a vendor endpoint, and the inspected source provides disable settings; no concrete attack behavior was found.
Network endpoints1
ph.mintlify.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI and declares no install lifecycle hook in its manifest.
- Its entrypoint delegates to the pinned @mintlify/cli dependency.
- The inspected dependency exports its CLI entrypoint and declares no install lifecycle hook.
- The dependency launcher starts its CLI with the caller's arguments.
- Command telemetry goes to Mintlify's PostHog host and can be disabled through configuration or environment settings.
- Telemetry may include command and environment details, login status, and stored email; the inspected recipient is the package vendor's telemetry host.
Evidence against
Behavioral surface
Trivial
Source & flagged code
7 flaggedpackage.jsonView file
28"bin": "index.js",
"scripts": {
"clean:all": "rimraf node_modules"
},
"dependencies": {
"@mintlify/cli": "4.0.1756"
},
"devDependencies": {
"rimraf": "5.0.1
Low
Suspicious Lifecycle Evidence
The package exposes a CLI and declares no install lifecycle hook in its manifest.
package.jsonView on unpkg · L28index.jsView file
3import { cli as _ } from '@mintlify/cli';
Low
Suspicious Dependency Evidence
Its entrypoint delegates to the pinned @mintlify/cli dependency.
index.jsView on unpkg · L3.lpm-dependency-evidence-f977daba-cda5-4763-9686-a6fc9f3dd64b/0/npm-linux/package.jsonView file
Findings
8 Low
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidenceindex.js
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-f977daba-cda5-4763-9686-a6fc9f3dd64b/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-f977daba-cda5-4763-9686-a6fc9f3dd64b/0/npm-linux/bin/index.js
LowAi Review Evidence.lpm-dependency-evidence-f977daba-cda5-4763-9686-a6fc9f3dd64b/0/npm-linux/bin/telemetry/client.js
LowAi Review Evidence.lpm-dependency-evidence-f977daba-cda5-4763-9686-a6fc9f3dd64b/0/npm-linux/bin/config.js
LowAi Review Evidence.lpm-dependency-evidence-f977daba-cda5-4763-9686-a6fc9f3dd64b/0/npm-linux/bin/telemetry/track.js
Affected versions and remediation
This report applies to mint@4.2.1153.
See all versions of mint for other recorded verdicts.
- Review the evidence and your use of mint@4.2.1153 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.