mint@4.2.1155
The Mintlify CLI
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe package is a thin wrapper around its pinned CLI dependency, and the inspected launcher passes arguments to a local Node process without a shell. The inspected manifests show no install lifecycle hook, and no attack behavior was established in the reviewed entrypoint source.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the mint command.
Impact
No malicious effect was established from the inspected source.
Mechanism
The entrypoint imports @mintlify/cli; its launcher starts a local Node process and passes through command-line arguments.
AI rationale
The package is a thin wrapper around its pinned CLI dependency, and the inspected launcher passes arguments to a local Node process without a shell. The inspected manifests show no install lifecycle hook, and no attack behavior was established in the reviewed entrypoint source.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The root manifest exposes a command wrapper and pins @mintlify/cli to version 4.0.1758, with no install lifecycle hook.
- The root entrypoint imports the pinned CLI, and its launcher forwards arguments to the local Node entrypoint without enabling a shell.
- The inspected CLI manifest lists development and build scripts, with no install lifecycle hook in the scripts shown.
Evidence against
Behavioral surface
Trivial
Source & flagged code
4 flaggedpackage.jsonView file
28"bin": "index.js",
"scripts": {
"clean:all": "rimraf node_modules"
},
"dependencies": {
"@mintlify/cli": "4.0.1758"
},
"devDependencies": {
"rimraf": "5.0.1"
Low
Suspicious Lifecycle Evidence
The root manifest exposes a command wrapper and pins @mintlify/cli to version 4.0.1758, with no install lifecycle hook.
package.jsonView on unpkg · L28.lpm-dependency-evidence-e6dd74d6-2df8-41ef-9e4b-ebc28ea7f9e8/0/npm-linux/package.jsonView file
33"scripts": {
"dev": "pnpm build && NODE_NO_WARNINGS=1 node bin/index.js",
"prepack": "npm run build",
"build": "tsc --project tsconfig.build.json && node scripts/bundle-converter.mjs",
"clean:build": "rimraf bin",
"clean:all": "rimraf node_modules .eslintcache && pnpm clean:build",
"watch": "tsc --watch
Low
Suspicious Lifecycle Evidence
The root manifest exposes a command wrapper and pins @mintlify/cli to version 4.0.1758, with no install lifecycle hook.
.lpm-dependency-evidence-e6dd74d6-2df8-41ef-9e4b-ebc28ea7f9e8/0/npm-linux/package.jsonView on unpkg · L33Findings
5 Low
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-e6dd74d6-2df8-41ef-9e4b-ebc28ea7f9e8/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-e6dd74d6-2df8-41ef-9e4b-ebc28ea7f9e8/0/npm-linux/bin/index.js
LowAi Review Evidenceindex.js
Affected versions and remediation
This report applies to mint@4.2.1155.
See all versions of mint for other recorded verdicts.
- Review the evidence and your use of mint@4.2.1155 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.