registry / mixdog / 0.9.10

mixdog@0.9.10

Standalone mixdog coding-agent CLI/TUI workspace.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious install-time attack surface was found. Residual risk is a user-invoked coding-agent CLI with shell/MCP/plugin capability and default-on runtime self-update.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the mixdog CLI or explicitly installs/enables plugins/MCP tools.

Impact

Can execute user-approved agent tools, connect configured providers/MCP servers, and update the global mixdog package during runtime if an update is available.

Mechanism

agent CLI capabilities plus package-aligned self-update and verified binary downloads

Policy narrative

A user-launched mixdog session can check npm for newer mixdog versions and, by default, run a global npm self-update. The same runtime supports MCP/project plugins and shell-capable coding-agent tools, but these are package-aligned, user-invoked features rather than install-time persistence or foreign agent hijacking.

Rationale

Static inspection found dangerous agent-facing functionality and default-on runtime self-update, but no npm lifecycle hook, credential exfiltration, persistence, destructive install behavior, or unconsented mutation of foreign AI-agent control surfaces. Treat as warn-worthy agent/runtime lifecycle risk rather than malicious malware.

Evidence

package.jsonsrc/cli.mjssrc/app.mjssrc/mixdog-session-runtime.mjssrc/runtime/shared/update-checker.mjssrc/session-runtime/plugin-mcp.mjssrc/standalone/plugin-admin.mjssrc/runtime/memory/lib/runtime-fetcher.mjssrc/runtime/agent/orchestrator/tools/patch-binary-fetcher.mjssrc/runtime/agent/orchestrator/tools/graph-binary-fetcher.mjs~/.mixdog/data/update-check-cache.json~/.mixdog/data/plugins/registry.json~/.mixdog/data/plugins/installed/~/.mixdog/data/patch-bin/~/.mixdog/data/graph-bin/~/.mixdog/data/runtime/

Network endpoints4

registry.npmjs.org/mixdog/latestraw.githubusercontent.com/tribgames/mixdog/main/src/runtime/memory/data/runtime-manifest.jsonraw.githubusercontent.com/tribgames/mixdog/main/src/runtime/agent/orchestrator/tools/patch-manifest.jsonraw.githubusercontent.com/tribgames/mixdog/main/src/runtime/agent/orchestrator/tools/graph-manifest.json

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

src/mixdog-session-runtime.mjs performs default-on runtime self-update check and can run npm install -g mixdog@latest after user launches CLI.
src/runtime/shared/update-checker.mjs fetches https://registry.npmjs.org/mixdog/latest and spawns npm install -g mixdog@latest.
src/session-runtime/plugin-mcp.mjs reads project .mcp.json and registers configured MCP servers inside mixdog runtime.
src/standalone/plugin-admin.mjs can clone Git plugin sources into mixdog's plugin registry when user invokes plugin install/update.
src/runtime/agent/orchestrator/tools/*fetcher.mjs download native binaries from GitHub release manifests and verify sha256.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
bin entrypoint src/cli.mjs only imports src/app.mjs after explicit mixdog execution.
No inspected code writes CLAUDE.md, .claude, Codex/Cursor settings, shell startup files, VCS hooks, or foreign agent control surfaces during install.
Native binary/runtime fetchers validate sha256 before caching or extraction.
Scanner secret hits in scripts/compact-smoke.mjs are test fixtures asserting redaction, not credential harvesting.
Network endpoints observed are package-aligned registry/GitHub/provider functionality for an agent CLI.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 648 file(s), 7.86 MB of source, external domains: 127.0.0.1, aistudio.google.com, api.anthropic.com, api.deepseek.com, api.openai.com, api.telegram.org, api.x.ai, auth.openai.com, auth.x.ai, changed.example, chatgpt.com, claude.com, cli-chat-proxy.grok.com, console.anthropic.com, console.x.ai, example.com, generativelanguage.googleapis.com, github.com, management-api.x.ai, models.dev, opencode.ai, platform.claude.com, platform.deepseek.com, platform.openai.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

11 flagged

scripts/compact-smoke.mjsView file

Lines 368-408javascript

368const tailRecallAsst = tailRecall.messages.find((m) => m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length === 3);

369assert(tailRecallAsst, 'recall-fasttrack preserved tail should keep the assistant toolCalls structure intact');

370

371// Preserved-tail redaction must be REDACTION-ONLY: non-sensitive args (incl. a

372// long string and a deep, key-ordered object/array) must survive byte- and

373// structure-identical (no truncation / summarization / key sorting / caps),

374// the string-vs-object `arguments` shape must be preserved, and

375// `toolCalls[].function.arguments` must be redacted in both paths.

376const LONG_NON_SENSITIVE = `keep ${'x'.repeat(900)} end`; // > any TOOL_ARG cap

377const fnSecretFragments = ['fn.secret.aaa', 'fn-cookie-bbb'];

378const onlyTailMessages = [

379 { role: 'system', content: 'system rules stay mandatory' },

380 { role: 'user', content: 'older request to summarize away' },

381 { role: 'assistant', content: 'older answer' },

382 { role: 'user', content: 'current request with mixed tool calls' },

383 { role: 'assistant', content: 'invoking', toolCalls: [

384 // Non-sensitive long string arg — must be preserved EXACTLY.

385 { id: 'call_keep_str', name: 'echo', arguments: LONG_NON_SENSITIVE },

386 // Object-shape args: provider passes a real object. Non-sensitive nested

387 // values + key order must survive; only the sensitive key is redacted.

388 { id: 'call_keep_obj', name: 'cfg', arguments: { zeta: 1, alpha: 'aval', nested: { keepArr: [3, 2, 1], note: 'n' }, password: 'should-vanish-pw' } },

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/compact-smoke.mjsView on unpkg · L388

389 // function.arguments (string JSON) carrying a sensitive key — must redact.

390 { id: 'call_fn_1', name: 'h', function: { name: 'h', arguments: '{"url":"https://z","authorization":"Bearer fn.secret.aaa"}' } },

391 // function.arguments (raw string) carrying a cookie secret — must redact.

392 { id: 'call_fn_2', name: 'g', function: { name: 'g', arguments: 'cookie: sid=fn-cookie-bbb; path=/' } },

393 ] },

394 { role: 'tool', toolCallId: 'call_keep_str', content: 'o1' },

395 { role: 'tool', toolCallId: 'call_keep_obj', content: 'o2' },

396 { role: 'tool', toolCallId: 'call_fn_1', content: 'o3' },

397 { role: 'tool', toolCallId: 'call_fn_2', content: 'o4' },

398];

399

400function checkRedactionOnly(messages, label) {

401 const asst = messages.find((m) => m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length === 4);

402 assert(asst, `${label}: preserved tail should keep the 4-call assistant turn`);

403 const byId = Object.fromEntries(asst.toolCalls.map((tc) => [tc.id, tc]));

404 // 1) Non-sensitive long string arg unchanged (no truncation/middle-cut).

405 const strCall = byId.call_keep_str;

406 assert(typeof strCall.arguments === 'string', `${label}: string arg must stay a string`);

407 assert(strCall.arguments === LONG_NON_SENSITIVE, `${label}: non-sensitive long string arg must be byte-identical (no truncation)`);

408 // 2) Object arg keeps shape, insertion order, nested array order/values;

scripts/smoke-loop.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { appendFileSync, mkdirSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

4import { dirname, isAbsolute, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/smoke-loop.mjsView on unpkg · L2

5import { fileURLToPath } from 'node:url'

scripts/bench-run.mjsView file

Lines 188-228javascript

188 },

189 }, (err, stdout, stderrOut) => {

190 if (err) resolveRun({ raw: String(stdout || '') + String(stderrOut || ''), ok: false });

191 else

scripts/ingest-pure-conversation-smoke.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { createRequire } from 'node:module'

3import {

4 normalizeIngestRole,

5 sessionMessageContent,

6 sessionMessageContentForIngest,

7 shouldExcludeIngestMessage,

8} from '../src/runtime/memory/lib/session-ingest.mjs'

10// cleanMemoryText is the SAME downstream cleaner the real ingest loop applies

src/standalone/plugin-admin.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/standalone/plugin-admin.mjsView on unpkg · L1

3 existsSync,

4 mkdirSync,

5 readFileSync,

6 renameSync,

7 rmSync,

8 writeFileSync,

src/runtime/agent/orchestrator/tools/shell-snapshot.mjsView file

Lines 1-33javascript

1'use strict';

2// Shell environment snapshot.

3//

4// Captures the user's interactive shell state (functions, aliases, shell

5// options) by sourcing their config file in a one-shot login shell and

6// dumping the resulting environment to a temp script. Subsequent bash

7// commands prepend `source <snapshot>` so they run with the same nvm /

8// pyenv / mise / asdf / direnv setup the user gets in their interactive

9// terminal — without paying a fresh login-shell startup on every call.

10//

src/runtime/channels/lib/whisper-server.mjsView file

Lines 15-55javascript

15// States: STOPPED → STARTING → READY → STOPPING → STOPPED, plus DEAD on child exit.

16//

17// Why a FIXED port (not `--port 0`):

18// whisper-server 1.8.4 does not support OS-assigned ephemeral bind. Passing

19// `--port 0` makes it print `listening at http://127.0.0.1:0` and never bind a

20// usable port. So we bind a single deterministic port and FAIL CLOSED when it is

21// occupied by a process we do not positively own. We NEVER scan a port range.

22//

23// Readiness detection:

24// The server prints `... listening at http://<host>:<port>` AFTER the model is

src/runtime/memory/lib/runtime-fetcher.mjsView file

Lines 1-21javascript

1const __mixdogMemoryStderrWrite = process.stderr.write.bind(process.stderr);

2function __mixdogMemoryLog(...args) {

3 if (process.env.MIXDOG_QUIET_MEMORY_LOG) return true;

4 return __mixdogMemoryStderrWrite(...args);

src/runtime/channels/lib/format.mjsView file

129contains invisible/control Unicode U+200B (zero width space) return line.replace(/```/g, "`<U+200B>``");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/runtime/channels/lib/format.mjsView on unpkg · L129

scripts/build-runtime-linux.shView file

•path = scripts/build-runtime-linux.sh kind = build_helper sizeBytes = 14047 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-runtime-linux.shView on unpkg

scripts/session-ingest-smoke.mjsView file

59patternName = generic_password severity = medium line = 59 matchedText = const js... });

Medium

Secret Pattern

Hardcoded password in scripts/session-ingest-smoke.mjs

scripts/session-ingest-smoke.mjsView on unpkg · L59

Source & flagged code

11 flagged · loading source

scripts/compact-smoke.mjsView file

388patternName = generic_password severity = medium line = 388 matchedText = { id: 'c...} },

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/compact-smoke.mjsView on unpkg · L388

scripts/smoke-loop.mjsView file

2import { appendFileSync, mkdirSync } from 'node:fs'; L3: import { spawnSync } from 'node:child_process'; L4: import { dirname, isAbsolute, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/smoke-loop.mjsView on unpkg · L2

scripts/bench-run.mjsView file

208const { raw, ok } = await new Promise((resolveRun) => { L209: const child = spawn('codex', args, { shell: true, env: { ...process.env, ...(opts.env || {}) } }); L210: let out = '';

High

Shell

Package source references shell execution.

scripts/bench-run.mjsView on unpkg · L208

scripts/ingest-pure-conversation-smoke.mjsView file

12// require it directly to mirror the pipeline without booting the MCP server. L13: const require = createRequire(import.meta.url) L14: const { cleanMemoryText } = require('../src/lib/text-utils.cjs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/ingest-pure-conversation-smoke.mjsView on unpkg · L12

src/standalone/plugin-admin.mjsView file

1import { spawnSync } from 'node:child_process'; L2: import { ... L37: function readJsonSafe(path) { L38: try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } L39: } ... L93: type: 'git', L94: url: `https://github.com/${source}.git`, L95: displaySource: source, ... L104: } L105: const localPath = source.replace(/^~(?=$|[\\/])/, homedir()); L106: const resolved = resolve(localPath); ... L120: if (result.status !== 0) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/standalone/plugin-admin.mjsView on unpkg · L1

src/runtime/agent/orchestrator/tools/shell-snapshot.mjsView file

13L14: import { spawn } from 'node:child_process'; L15: import { existsSync, mkdirSync, statSync, readFileSync, unlinkSync } from 'node:fs'; ... L86: const lower = shellPath.toLowerCase(); L87: if (lower.includes('zsh')) return join(homedir(), '.zshrc'); L88: if (lower.includes('bash')) return join(homedir(), '.bashrc'); ... L154: const script = getSnapshotScript(shellPath, snapshotPath, configFileExists); L155: let stderrBuf = ''; L156: // Mirror reference implementation (bash/ShellSnapshot.ts:458): ... L169: // even when the snapshot itself is fine). L170: // R11: scrub loader/execution vars from process.env before L171: // handing it to the snapshot shell. This site previously passed

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/runtime/agent/orchestrator/tools/shell-snapshot.mjsView on unpkg · L13

src/runtime/channels/lib/whisper-server.mjsView file

35L36: import net from 'node:net'; L37: import path from 'node:path'; L38: import fs from 'node:fs'; L39: import { spawn, spawnSync } from 'node:child_process'; L40: import { setTimeout as delay } from 'node:timers/promises'; ... L46: const FIXED_PORT = (() => { L47: const raw = process.env.MIXDOG_WHISPER_SERVER_PORT; L48: const n = raw ? Number.parseInt(raw, 10) : NaN;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/runtime/channels/lib/whisper-server.mjsView on unpkg · L35

src/runtime/memory/lib/runtime-fetcher.mjsView file

1const __mixdogMemoryStderrWrite = process.stderr.write.bind(process.stderr); L2: function __mixdogMemoryLog(...args) { L3: if (process.env.MIXDOG_QUIET_MEMORY_LOG) return true; L4: return __mixdogMemoryStderrWrite(...args); ... L30: import { pipeline } from 'stream/promises' L31: import { spawnSync } from 'child_process' L32: import { renameWithRetrySync, writeFileAtomicSync, writeJsonAtomicSync } from '../../shared/atomic-file.mjs' ... L38: // GitHub raw URL fallback — used only when no cached or bundled manifest exists. L39: const MANIFEST_URL = 'https://raw.githubusercontent.[redacted]-manifest.json' L40: const LEGACY_RUNTIME_RELEASE_REPOSITORY = 'trib-plugin/mixdog' ... L46: function platformKey() { L47: const os = process.platform === 'win32' ? 'win32' : process.platform

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/runtime/memory/lib/runtime-fetcher.mjsView on unpkg · L1

src/runtime/channels/lib/format.mjsView file

129contains invisible/control Unicode U+200B (zero width space) return line.replace(/```/g, "`<U+200B>``");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/runtime/channels/lib/format.mjsView on unpkg · L129

scripts/build-runtime-linux.shView file

•path = scripts/build-runtime-linux.sh kind = build_helper sizeBytes = 14047 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-runtime-linux.shView on unpkg

scripts/session-ingest-smoke.mjsView file

59patternName = generic_password severity = medium line = 59 matchedText = const js... });

Medium

Secret Pattern

Hardcoded password in scripts/session-ingest-smoke.mjs

scripts/session-ingest-smoke.mjsView on unpkg · L59

Findings

1 Critical4 High8 Medium6 Low

CriticalTrojan Source Unicodesrc/runtime/channels/lib/format.mjs

HighChild Processscripts/smoke-loop.mjs

HighShellscripts/bench-run.mjs

HighSame File Env Network Executionsrc/runtime/channels/lib/whisper-server.mjs

HighSandbox Evasion Gated Capabilitysrc/runtime/memory/lib/runtime-fetcher.mjs

MediumSecret Patternscripts/compact-smoke.mjs

MediumDynamic Requirescripts/ingest-pure-conversation-smoke.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/runtime/agent/orchestrator/tools/shell-snapshot.mjs

MediumShips Build Helperscripts/build-runtime-linux.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternscripts/session-ingest-smoke.mjs

LowScripts Present

LowEval

LowWeak Cryptosrc/standalone/plugin-admin.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

scripts/compact-smoke.mjsView file

Lines 368-408javascript

368const tailRecallAsst = tailRecall.messages.find((m) => m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length === 3);

369assert(tailRecallAsst, 'recall-fasttrack preserved tail should keep the assistant toolCalls structure intact');

370

371// Preserved-tail redaction must be REDACTION-ONLY: non-sensitive args (incl. a

372// long string and a deep, key-ordered object/array) must survive byte- and

373// structure-identical (no truncation / summarization / key sorting / caps),

374// the string-vs-object `arguments` shape must be preserved, and

375// `toolCalls[].function.arguments` must be redacted in both paths.

376const LONG_NON_SENSITIVE = `keep ${'x'.repeat(900)} end`; // > any TOOL_ARG cap

377const fnSecretFragments = ['fn.secret.aaa', 'fn-cookie-bbb'];

378const onlyTailMessages = [

379 { role: 'system', content: 'system rules stay mandatory' },

380 { role: 'user', content: 'older request to summarize away' },

381 { role: 'assistant', content: 'older answer' },

382 { role: 'user', content: 'current request with mixed tool calls' },

383 { role: 'assistant', content: 'invoking', toolCalls: [

384 // Non-sensitive long string arg — must be preserved EXACTLY.

385 { id: 'call_keep_str', name: 'echo', arguments: LONG_NON_SENSITIVE },

386 // Object-shape args: provider passes a real object. Non-sensitive nested

387 // values + key order must survive; only the sensitive key is redacted.

388 { id: 'call_keep_obj', name: 'cfg', arguments: { zeta: 1, alpha: 'aval', nested: { keepArr: [3, 2, 1], note: 'n' }, password: 'should-vanish-pw' } },

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/compact-smoke.mjsView on unpkg · L388

389 // function.arguments (string JSON) carrying a sensitive key — must redact.

390 { id: 'call_fn_1', name: 'h', function: { name: 'h', arguments: '{"url":"https://z","authorization":"Bearer fn.secret.aaa"}' } },

391 // function.arguments (raw string) carrying a cookie secret — must redact.

392 { id: 'call_fn_2', name: 'g', function: { name: 'g', arguments: 'cookie: sid=fn-cookie-bbb; path=/' } },

393 ] },

394 { role: 'tool', toolCallId: 'call_keep_str', content: 'o1' },

395 { role: 'tool', toolCallId: 'call_keep_obj', content: 'o2' },

396 { role: 'tool', toolCallId: 'call_fn_1', content: 'o3' },

397 { role: 'tool', toolCallId: 'call_fn_2', content: 'o4' },

398];

399

400function checkRedactionOnly(messages, label) {

401 const asst = messages.find((m) => m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length === 4);

402 assert(asst, `${label}: preserved tail should keep the 4-call assistant turn`);

403 const byId = Object.fromEntries(asst.toolCalls.map((tc) => [tc.id, tc]));

404 // 1) Non-sensitive long string arg unchanged (no truncation/middle-cut).

405 const strCall = byId.call_keep_str;

406 assert(typeof strCall.arguments === 'string', `${label}: string arg must stay a string`);

407 assert(strCall.arguments === LONG_NON_SENSITIVE, `${label}: non-sensitive long string arg must be byte-identical (no truncation)`);

408 // 2) Object arg keeps shape, insertion order, nested array order/values;

scripts/smoke-loop.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { appendFileSync, mkdirSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

4import { dirname, isAbsolute, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/smoke-loop.mjsView on unpkg · L2

5import { fileURLToPath } from 'node:url'

scripts/bench-run.mjsView file

Lines 188-228javascript

188 },

189 }, (err, stdout, stderrOut) => {

190 if (err) resolveRun({ raw: String(stdout || '') + String(stderrOut || ''), ok: false });

191 else

scripts/ingest-pure-conversation-smoke.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { createRequire } from 'node:module'

3import {

4 normalizeIngestRole,

5 sessionMessageContent,

6 sessionMessageContentForIngest,

7 shouldExcludeIngestMessage,

8} from '../src/runtime/memory/lib/session-ingest.mjs'

10// cleanMemoryText is the SAME downstream cleaner the real ingest loop applies

src/standalone/plugin-admin.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/standalone/plugin-admin.mjsView on unpkg · L1

3 existsSync,

4 mkdirSync,

5 readFileSync,

6 renameSync,

7 rmSync,

8 writeFileSync,

src/runtime/agent/orchestrator/tools/shell-snapshot.mjsView file

Lines 1-33javascript

1'use strict';

2// Shell environment snapshot.

3//

4// Captures the user's interactive shell state (functions, aliases, shell

5// options) by sourcing their config file in a one-shot login shell and

6// dumping the resulting environment to a temp script. Subsequent bash

7// commands prepend `source <snapshot>` so they run with the same nvm /

8// pyenv / mise / asdf / direnv setup the user gets in their interactive

9// terminal — without paying a fresh login-shell startup on every call.

10//

src/runtime/channels/lib/whisper-server.mjsView file

Lines 15-55javascript

15// States: STOPPED → STARTING → READY → STOPPING → STOPPED, plus DEAD on child exit.

16//

17// Why a FIXED port (not `--port 0`):

18// whisper-server 1.8.4 does not support OS-assigned ephemeral bind. Passing

19// `--port 0` makes it print `listening at http://127.0.0.1:0` and never bind a

20// usable port. So we bind a single deterministic port and FAIL CLOSED when it is

21// occupied by a process we do not positively own. We NEVER scan a port range.

22//

23// Readiness detection:

24// The server prints `... listening at http://<host>:<port>` AFTER the model is

src/runtime/memory/lib/runtime-fetcher.mjsView file

Lines 1-21javascript

1const __mixdogMemoryStderrWrite = process.stderr.write.bind(process.stderr);

2function __mixdogMemoryLog(...args) {

3 if (process.env.MIXDOG_QUIET_MEMORY_LOG) return true;

4 return __mixdogMemoryStderrWrite(...args);

src/runtime/channels/lib/format.mjsView file

129contains invisible/control Unicode U+200B (zero width space) return line.replace(/```/g, "`<U+200B>``");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/runtime/channels/lib/format.mjsView on unpkg · L129

scripts/build-runtime-linux.shView file

•path = scripts/build-runtime-linux.sh kind = build_helper sizeBytes = 14047 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-runtime-linux.shView on unpkg

scripts/session-ingest-smoke.mjsView file

59patternName = generic_password severity = medium line = 59 matchedText = const js... });

Medium

Secret Pattern

Hardcoded password in scripts/session-ingest-smoke.mjs

scripts/session-ingest-smoke.mjsView on unpkg · L59