mint@4.2.1157
The Mintlify CLI
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe package is a wrapper for the declared Mintlify CLI dependency and has no install lifecycle hook. The inspected runtime telemetry is tied to CLI use, can be disabled, and targets Mintlify's telemetry host; no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the CLI and its command middleware runs.
Impact
No harmful effect was identified in the inspected behavior.
Mechanism
The package launches its declared CLI dependency and may send command and account telemetry to the Mintlify telemetry host.
AI rationale
The package is a wrapper for the declared Mintlify CLI dependency and has no install lifecycle hook. The inspected runtime telemetry is tied to CLI use, can be disabled, and targets Mintlify's telemetry host; no concrete attack behavior was found.
Evidence
package.json.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/package.json.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/bin/index.js.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/bin/telemetry/track.js
Network endpoints1
ph.mintlify.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI and declares @mintlify/cli 4.0.1760 as its dependency; its only script is clean:all.
- The dependency maps its CLI executable to bin/index.js, and the wrapper forwards command arguments to its start script.
- The CLI invokes command telemetry through middleware; events may include command, environment, login status, subdomain, and saved account email.
- Telemetry is enabled unless disabled in configuration or through supported environment settings.
- The telemetry client sends to Mintlify's ph.mintlify.com endpoint.
Evidence against
Behavioral surface
Trivial
Source & flagged code
8 flaggedpackage.jsonView file
28"bin": "index.js",
"scripts": {
"clean:all": "rimraf node_modules"
},
"dependencies": {
"@mintlify/cli": "4.0.1760"
},
"devDependencies": {
"rimraf": "5.0.1"
Low
Suspicious Dependency Evidence
The package exposes a CLI and declares @mintlify/cli 4.0.1760 as its dependency; its only script is clean:all.
package.jsonView on unpkg · L28.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/package.jsonView file
28"exports": "./bin/index.js",
"bin": {
"mint": "bin/index.js",
"mintlify": "bin/index.js"
},
"scripts": {
"dev": "pnpm build && NODE_NO_WARNINGS=1 node bin/index.j
Low
Suspicious Dependency Evidence
The dependency maps its CLI executable to bin/index.js, and the wrapper forwards command arguments to its start script.
.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/package.jsonView on unpkg · L28Findings
9 Low
LowScripts Present
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/bin/index.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/bin/start.js
LowAi Review Evidence.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/bin/middlewares/telemetryMiddleware.js
LowAi Review Evidence.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/bin/telemetry/track.js
LowAi Review Evidence.lpm-dependency-evidence-37e57f3c-ec75-4e83-96ba-469b89730a4e/0/npm-linux/bin/telemetry/track.js
LowAi Review Evidence
Affected versions and remediation
This report applies to mint@4.2.1157.
See all versions of mint for other recorded verdicts.
- Review the evidence and your use of mint@4.2.1157 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.