registry / mixdog / 0.9.22

mixdog@0.9.22

Standalone mixdog coding-agent CLI/TUI workspace.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious payload or install-time attack was found. The main unresolved risk is default-on runtime self-update that can invoke npm global install for this package after CLI start.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

user runs the mixdog CLI/runtime with auto update enabled

Impact

could replace the global mixdog installation with the latest registry version; no exfiltration or foreign agent-control mutation observed in this version

Mechanism

package-aligned self-update via npm install -g mixdog@latest

Rationale

Static inspection did not confirm malicious install-time behavior, credential exfiltration, destructive actions, or AI-agent control hijack. The default-on runtime self-update is risky enough to warn, but it is first-party/package-aligned and user-triggered by running the CLI.

Evidence

package.jsonsrc/cli.mjssrc/session-runtime/runtime-core.mjssrc/runtime/shared/update-checker.mjssrc/runtime/memory/lib/runtime-fetcher.mjssrc/runtime/agent/orchestrator/tools/bash-session.mjssrc/runtime/channels/lib/whisper-server.mjssrc/runtime/channels/lib/format.mjsglobal npm installation of mixdog@latest<mixdog dataDir>/update-check-cache.json<mixdog dataDir>/runtime/

Network endpoints3

registry.npmjs.org/mixdog/latestgithub.com/tribgames/mixdog/releases/download/runtime-v0.4.0/raw.githubusercontent.com/tribgames/mixdog/main/src/runtime/memory/data/runtime-manifest.json

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

src/session-runtime/runtime-core.mjs schedules boot-time update check and runs update when config.update.auto is not false.
src/runtime/shared/update-checker.mjs spawns npm install -g mixdog@latest after fetching https://registry.npmjs.org/mixdog/latest.
src/runtime/memory/lib/runtime-fetcher.mjs can download native runtime archives from GitHub, then verifies bundled sha256 before extraction.

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts; bin only points to src/cli.mjs.
src/runtime/agent/orchestrator/tools/bash-session.mjs is a user-invoked agent shell tool with policy checks and secret-scrubbed environment, not install-time execution.
src/runtime/channels/lib/whisper-server.mjs manages a local 127.0.0.1 whisper child and fails closed on foreign port/process ownership.
src/runtime/channels/lib/format.mjs contains zero-width escapes only inside string replacements for code-fence escaping, not control-flow hiding.
Runtime downloads are package-aligned and hash-verified; no credential harvesting or exfiltration path was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 707 file(s), 8.53 MB of source, external domains: 127.0.0.1, aistudio.google.com, api.anthropic.com, api.deepseek.com, api.openai.com, api.telegram.org, api.x.ai, auth.openai.com, auth.x.ai, changed.example, chatgpt.com, claude.com, cli-chat-proxy.grok.com, console.anthropic.com, console.x.ai, example.com, generativelanguage.googleapis.com, github.com, management-api.x.ai, models.dev, opencode.ai, platform.claude.com, platform.deepseek.com, platform.openai.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

13 flagged

scripts/compact-smoke.mjsView file

Lines 368-408javascript

368const tailRecallAsst = tailRecall.messages.find((m) => m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length === 3);

369assert(tailRecallAsst, 'recall-fasttrack preserved tail should keep the assistant toolCalls structure intact');

370

371// Preserved-tail redaction must be REDACTION-ONLY: non-sensitive args (incl. a

372// long string and a deep, key-ordered object/array) must survive byte- and

373// structure-identical (no truncation / summarization / key sorting / caps),

374// the string-vs-object `arguments` shape must be preserved, and

375// `toolCalls[].function.arguments` must be redacted in both paths.

376const LONG_NON_SENSITIVE = `keep ${'x'.repeat(900)} end`; // > any TOOL_ARG cap

377const fnSecretFragments = ['fn.secret.aaa', 'fn-cookie-bbb'];

378const onlyTailMessages = [

379 { role: 'system', content: 'system rules stay mandatory' },

380 { role: 'user', content: 'older request to summarize away' },

381 { role: 'assistant', content: 'older answer' },

382 { role: 'user', content: 'current request with mixed tool calls' },

383 { role: 'assistant', content: 'invoking', toolCalls: [

384 // Non-sensitive long string arg — must be preserved EXACTLY.

385 { id: 'call_keep_str', name: 'echo', arguments: LONG_NON_SENSITIVE },

386 // Object-shape args: provider passes a real object. Non-sensitive nested

387 // values + key order must survive; only the sensitive key is redacted.

388 { id: 'call_keep_obj', name: 'cfg', arguments: { zeta: 1, alpha: 'aval', nested: { keepArr: [3, 2, 1], note: 'n' }, password: 'should-vanish-pw' } },

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/compact-smoke.mjsView on unpkg · L388

389 // function.arguments (string JSON) carrying a sensitive key — must redact.

390 { id: 'call_fn_1', name: 'h', function: { name: 'h', arguments: '{"url":"https://z","authorization":"Bearer fn.secret.aaa"}' } },

391 // function.arguments (raw string) carrying a cookie secret — must redact.

392 { id: 'call_fn_2', name: 'g', function: { name: 'g', arguments: 'cookie: sid=fn-cookie-bbb; path=/' } },

393 ] },

394 { role: 'tool', toolCallId: 'call_keep_str', content: 'o1' },

395 { role: 'tool', toolCallId: 'call_keep_obj', content: 'o2' },

396 { role: 'tool', toolCallId: 'call_fn_1', content: 'o3' },

397 { role: 'tool', toolCallId: 'call_fn_2', content: 'o4' },

398];

399

400function checkRedactionOnly(messages, label) {

401 const asst = messages.find((m) => m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length === 4);

402 assert(asst, `${label}: preserved tail should keep the 4-call assistant turn`);

403 const byId = Object.fromEntries(asst.toolCalls.map((tc) => [tc.id, tc]));

404 // 1) Non-sensitive long string arg unchanged (no truncation/middle-cut).

405 const strCall = byId.call_keep_str;

406 assert(typeof strCall.arguments === 'string', `${label}: string arg must stay a string`);

407 assert(strCall.arguments === LONG_NON_SENSITIVE, `${label}: non-sensitive long string arg must be byte-identical (no truncation)`);

408 // 2) Object arg keeps shape, insertion order, nested array order/values;

scripts/smoke-loop.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { appendFileSync, mkdirSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

4import { dirname, isAbsolute, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/smoke-loop.mjsView on unpkg · L2

5import { fileURLToPath } from 'node:url'

scripts/bench-run.mjsView file

Lines 188-228javascript

188 },

189 }, (err, stdout, stderrOut) => {

190 if (err) resolveRun({ raw: String(stdout || '') + String(stderrOut || ''), ok: false });

191 else

scripts/ingest-pure-conversation-smoke.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { createRequire } from 'node:module'

3import {

4 normalizeIngestRole,

5 sessionMessageContent,

6 sessionMessageContentForIngest,

7 shouldExcludeIngestMessage,

8} from '../src/runtime/memory/lib/session-ingest.mjs'

10// cleanMemoryText is the SAME downstream cleaner the real ingest loop applies

src/standalone/plugin-admin.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/standalone/plugin-admin.mjsView on unpkg · L1

3 existsSync,

4 mkdirSync,

5 readFileSync,

6 renameSync,

7 rmSync,

8 writeFileSync,

src/runtime/agent/orchestrator/tools/shell-snapshot.mjsView file

Lines 1-33javascript

1'use strict';

2// Shell environment snapshot.

3//

4// Captures the user's interactive shell state (functions, aliases, shell

5// options) by sourcing their config file in a one-shot login shell and

6// dumping the resulting environment to a temp script. Subsequent bash

7// commands prepend `source <snapshot>` so they run with the same nvm /

8// pyenv / mise / asdf / direnv setup the user gets in their interactive

9// terminal — without paying a fresh login-shell startup on every call.

10//

src/runtime/channels/lib/whisper-server.mjsView file

Lines 15-55javascript

15// States: STOPPED → STARTING → READY → STOPPING → STOPPED, plus DEAD on child exit.

16//

17// Why a FIXED port (not `--port 0`):

18// whisper-server 1.8.4 does not support OS-assigned ephemeral bind. Passing

19// `--port 0` makes it print `listening at http://127.0.0.1:0` and never bind a

20// usable port. So we bind a single deterministic port and FAIL CLOSED when it is

21// occupied by a process we do not positively own. We NEVER scan a port range.

22//

23// Readiness detection:

24// The server prints `... listening at http://<host>:<port>` AFTER the model is

src/runtime/memory/lib/runtime-fetcher.mjsView file

Lines 1-21javascript

1const __mixdogMemoryStderrWrite = process.stderr.write.bind(process.stderr);

2function __mixdogMemoryLog(...args) {

3 if (process.env.MIXDOG_QUIET_MEMORY_LOG) return true;

4 return __mixdogMemoryStderrWrite(...args);

src/runtime/channels/lib/format.mjsView file

129contains invisible/control Unicode U+200B (zero width space) return line.replace(/```/g, "`<U+200B>``");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/runtime/channels/lib/format.mjsView on unpkg · L129

scripts/boot-smoke.mjsView file

1Cross-file remote execution chain: scripts/boot-smoke.mjs spawns src/tui/dist/index.mjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawnSync } from 'node:child_process'; L3: import { dirname, resolve } from 'node:path'; ... L6: const root = resolve(dirname(fileURLToPath(import.meta.url)), '..'); L7: const THRESHOLD_MS = Number(process.env.MIXDOG_BOOT_SMOKE_LIMIT_MS || 5_000); L8: const FAST_BACKGROUND_ENV = { ... L23: L24: function runCase(name, args, { env = {}, input = null, expectStdout = null, expectStderr = null, maxMs = THRESHOLD_MS } = {}) { L25: const startedAt = performance.now(); ... L134: for (const row of rows) { L135: process.stdout.write(`${row.name}: ${row.ms}ms\n`); L136: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/boot-smoke.mjsView on unpkg · L1

scripts/build-runtime-linux.shView file

•path = scripts/build-runtime-linux.sh kind = build_helper sizeBytes = 14047 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-runtime-linux.shView on unpkg

src/runtime/agent/orchestrator/tools/bash-session.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = mixdog@0.9.21 matchedIdentity = npm:bWl4ZG9n:0.9.21 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/runtime/agent/orchestrator/tools/bash-session.mjsView on unpkg

scripts/session-ingest-smoke.mjsView file

59patternName = generic_password severity = medium line = 59 matchedText = const js... });

Medium

Secret Pattern

Hardcoded password in scripts/session-ingest-smoke.mjs

scripts/session-ingest-smoke.mjsView on unpkg · L59

Source & flagged code

13 flagged · loading source

scripts/compact-smoke.mjsView file

388patternName = generic_password severity = medium line = 388 matchedText = { id: 'c...} },

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/compact-smoke.mjsView on unpkg · L388

scripts/smoke-loop.mjsView file

2import { appendFileSync, mkdirSync } from 'node:fs'; L3: import { spawnSync } from 'node:child_process'; L4: import { dirname, isAbsolute, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/smoke-loop.mjsView on unpkg · L2

scripts/bench-run.mjsView file

208const { raw, ok } = await new Promise((resolveRun) => { L209: const child = spawn('codex', args, { shell: true, env: { ...process.env, ...(opts.env || {}) } }); L210: let out = '';

High

Shell

Package source references shell execution.

scripts/bench-run.mjsView on unpkg · L208

scripts/ingest-pure-conversation-smoke.mjsView file

12// require it directly to mirror the pipeline without booting the MCP server. L13: const require = createRequire(import.meta.url) L14: const { cleanMemoryText } = require('../src/lib/text-utils.cjs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/ingest-pure-conversation-smoke.mjsView on unpkg · L12

src/standalone/plugin-admin.mjsView file

1import { spawnSync } from 'node:child_process'; L2: import { ... L37: function readJsonSafe(path) { L38: try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } L39: } ... L93: type: 'git', L94: url: `https://github.com/${source}.git`, L95: displaySource: source, ... L104: } L105: const localPath = source.replace(/^~(?=$|[\\/])/, homedir()); L106: const resolved = resolve(localPath); ... L120: if (result.status !== 0) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/standalone/plugin-admin.mjsView on unpkg · L1

src/runtime/agent/orchestrator/tools/shell-snapshot.mjsView file

13L14: import { spawn } from 'node:child_process'; L15: import { existsSync, mkdirSync, statSync, readFileSync, unlinkSync } from 'node:fs'; ... L86: const lower = shellPath.toLowerCase(); L87: if (lower.includes('zsh')) return join(homedir(), '.zshrc'); L88: if (lower.includes('bash')) return join(homedir(), '.bashrc'); ... L154: const script = getSnapshotScript(shellPath, snapshotPath, configFileExists); L155: let stderrBuf = ''; L156: // Mirror reference implementation (bash/ShellSnapshot.ts:458): ... L169: // even when the snapshot itself is fine). L170: // R11: scrub loader/execution vars from process.env before L171: // handing it to the snapshot shell. This site previously passed

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/runtime/agent/orchestrator/tools/shell-snapshot.mjsView on unpkg · L13

src/runtime/channels/lib/whisper-server.mjsView file

35L36: import net from 'node:net'; L37: import path from 'node:path'; L38: import fs from 'node:fs'; L39: import { spawn, spawnSync } from 'node:child_process'; L40: import { setTimeout as delay } from 'node:timers/promises'; ... L46: const FIXED_PORT = (() => { L47: const raw = process.env.MIXDOG_WHISPER_SERVER_PORT; L48: const n = raw ? Number.parseInt(raw, 10) : NaN;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/runtime/channels/lib/whisper-server.mjsView on unpkg · L35

src/runtime/memory/lib/runtime-fetcher.mjsView file

1const __mixdogMemoryStderrWrite = process.stderr.write.bind(process.stderr); L2: function __mixdogMemoryLog(...args) { L3: if (process.env.MIXDOG_QUIET_MEMORY_LOG) return true; L4: return __mixdogMemoryStderrWrite(...args); ... L30: import { pipeline } from 'stream/promises' L31: import { spawnSync } from 'child_process' L32: import { renameWithRetrySync, writeFileAtomicSync, writeJsonAtomicSync } from '../../shared/atomic-file.mjs' ... L38: // GitHub raw URL fallback — used only when no cached or bundled manifest exists. L39: const MANIFEST_URL = 'https://raw.githubusercontent.[redacted]-manifest.json' L40: const LEGACY_RUNTIME_RELEASE_REPOSITORY = 'trib-plugin/mixdog' ... L46: function platformKey() { L47: const os = process.platform === 'win32' ? 'win32' : process.platform

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/runtime/memory/lib/runtime-fetcher.mjsView on unpkg · L1

src/runtime/channels/lib/format.mjsView file

129contains invisible/control Unicode U+200B (zero width space) return line.replace(/```/g, "`<U+200B>``");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/runtime/channels/lib/format.mjsView on unpkg · L129

scripts/boot-smoke.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/boot-smoke.mjsView on unpkg · L1

scripts/build-runtime-linux.shView file

•path = scripts/build-runtime-linux.sh kind = build_helper sizeBytes = 14047 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-runtime-linux.shView on unpkg

src/runtime/agent/orchestrator/tools/bash-session.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/runtime/agent/orchestrator/tools/bash-session.mjsView on unpkg

scripts/session-ingest-smoke.mjsView file

59patternName = generic_password severity = medium line = 59 matchedText = const js... });

Medium

Secret Pattern

Hardcoded password in scripts/session-ingest-smoke.mjs

scripts/session-ingest-smoke.mjsView on unpkg · L59

Findings

2 Critical5 High8 Medium6 Low

CriticalTrojan Source Unicodesrc/runtime/channels/lib/format.mjs

CriticalPrevious Version Dangerous Deltasrc/runtime/agent/orchestrator/tools/bash-session.mjs

HighChild Processscripts/smoke-loop.mjs

HighShellscripts/bench-run.mjs

HighSame File Env Network Executionsrc/runtime/channels/lib/whisper-server.mjs

HighSandbox Evasion Gated Capabilitysrc/runtime/memory/lib/runtime-fetcher.mjs

HighCross File Remote Execution Contextscripts/boot-smoke.mjs

MediumSecret Patternscripts/compact-smoke.mjs

MediumDynamic Requirescripts/ingest-pure-conversation-smoke.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/runtime/agent/orchestrator/tools/shell-snapshot.mjs

MediumShips Build Helperscripts/build-runtime-linux.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternscripts/session-ingest-smoke.mjs

LowScripts Present

LowEval

LowWeak Cryptosrc/standalone/plugin-admin.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

scripts/compact-smoke.mjsView file

Lines 368-408javascript

368const tailRecallAsst = tailRecall.messages.find((m) => m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length === 3);

369assert(tailRecallAsst, 'recall-fasttrack preserved tail should keep the assistant toolCalls structure intact');

370

371// Preserved-tail redaction must be REDACTION-ONLY: non-sensitive args (incl. a

372// long string and a deep, key-ordered object/array) must survive byte- and

373// structure-identical (no truncation / summarization / key sorting / caps),

374// the string-vs-object `arguments` shape must be preserved, and

375// `toolCalls[].function.arguments` must be redacted in both paths.

376const LONG_NON_SENSITIVE = `keep ${'x'.repeat(900)} end`; // > any TOOL_ARG cap

377const fnSecretFragments = ['fn.secret.aaa', 'fn-cookie-bbb'];

378const onlyTailMessages = [

379 { role: 'system', content: 'system rules stay mandatory' },

380 { role: 'user', content: 'older request to summarize away' },

381 { role: 'assistant', content: 'older answer' },

382 { role: 'user', content: 'current request with mixed tool calls' },

383 { role: 'assistant', content: 'invoking', toolCalls: [

384 // Non-sensitive long string arg — must be preserved EXACTLY.

385 { id: 'call_keep_str', name: 'echo', arguments: LONG_NON_SENSITIVE },

386 // Object-shape args: provider passes a real object. Non-sensitive nested

387 // values + key order must survive; only the sensitive key is redacted.

388 { id: 'call_keep_obj', name: 'cfg', arguments: { zeta: 1, alpha: 'aval', nested: { keepArr: [3, 2, 1], note: 'n' }, password: 'should-vanish-pw' } },

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/compact-smoke.mjsView on unpkg · L388

389 // function.arguments (string JSON) carrying a sensitive key — must redact.

390 { id: 'call_fn_1', name: 'h', function: { name: 'h', arguments: '{"url":"https://z","authorization":"Bearer fn.secret.aaa"}' } },

391 // function.arguments (raw string) carrying a cookie secret — must redact.

392 { id: 'call_fn_2', name: 'g', function: { name: 'g', arguments: 'cookie: sid=fn-cookie-bbb; path=/' } },

393 ] },

394 { role: 'tool', toolCallId: 'call_keep_str', content: 'o1' },

395 { role: 'tool', toolCallId: 'call_keep_obj', content: 'o2' },

396 { role: 'tool', toolCallId: 'call_fn_1', content: 'o3' },

397 { role: 'tool', toolCallId: 'call_fn_2', content: 'o4' },

398];

399

400function checkRedactionOnly(messages, label) {

401 const asst = messages.find((m) => m.role === 'assistant' && Array.isArray(m.toolCalls) && m.toolCalls.length === 4);

402 assert(asst, `${label}: preserved tail should keep the 4-call assistant turn`);

403 const byId = Object.fromEntries(asst.toolCalls.map((tc) => [tc.id, tc]));

404 // 1) Non-sensitive long string arg unchanged (no truncation/middle-cut).

405 const strCall = byId.call_keep_str;

406 assert(typeof strCall.arguments === 'string', `${label}: string arg must stay a string`);

407 assert(strCall.arguments === LONG_NON_SENSITIVE, `${label}: non-sensitive long string arg must be byte-identical (no truncation)`);

408 // 2) Object arg keeps shape, insertion order, nested array order/values;

scripts/smoke-loop.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { appendFileSync, mkdirSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

4import { dirname, isAbsolute, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/smoke-loop.mjsView on unpkg · L2

5import { fileURLToPath } from 'node:url'

scripts/bench-run.mjsView file

Lines 188-228javascript

188 },

189 }, (err, stdout, stderrOut) => {

190 if (err) resolveRun({ raw: String(stdout || '') + String(stderrOut || ''), ok: false });

191 else

scripts/ingest-pure-conversation-smoke.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { createRequire } from 'node:module'

3import {

4 normalizeIngestRole,

5 sessionMessageContent,

6 sessionMessageContentForIngest,

7 shouldExcludeIngestMessage,

8} from '../src/runtime/memory/lib/session-ingest.mjs'

10// cleanMemoryText is the SAME downstream cleaner the real ingest loop applies

src/standalone/plugin-admin.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/standalone/plugin-admin.mjsView on unpkg · L1

3 existsSync,

4 mkdirSync,

5 readFileSync,

6 renameSync,

7 rmSync,

8 writeFileSync,

src/runtime/agent/orchestrator/tools/shell-snapshot.mjsView file

Lines 1-33javascript

1'use strict';

2// Shell environment snapshot.

3//

4// Captures the user's interactive shell state (functions, aliases, shell

5// options) by sourcing their config file in a one-shot login shell and

6// dumping the resulting environment to a temp script. Subsequent bash

7// commands prepend `source <snapshot>` so they run with the same nvm /

8// pyenv / mise / asdf / direnv setup the user gets in their interactive

9// terminal — without paying a fresh login-shell startup on every call.

10//

src/runtime/channels/lib/whisper-server.mjsView file

Lines 15-55javascript

15// States: STOPPED → STARTING → READY → STOPPING → STOPPED, plus DEAD on child exit.

16//

17// Why a FIXED port (not `--port 0`):

18// whisper-server 1.8.4 does not support OS-assigned ephemeral bind. Passing

19// `--port 0` makes it print `listening at http://127.0.0.1:0` and never bind a

20// usable port. So we bind a single deterministic port and FAIL CLOSED when it is

21// occupied by a process we do not positively own. We NEVER scan a port range.

22//

23// Readiness detection:

24// The server prints `... listening at http://<host>:<port>` AFTER the model is

src/runtime/memory/lib/runtime-fetcher.mjsView file

Lines 1-21javascript

1const __mixdogMemoryStderrWrite = process.stderr.write.bind(process.stderr);

2function __mixdogMemoryLog(...args) {

3 if (process.env.MIXDOG_QUIET_MEMORY_LOG) return true;

4 return __mixdogMemoryStderrWrite(...args);

src/runtime/channels/lib/format.mjsView file

129contains invisible/control Unicode U+200B (zero width space) return line.replace(/```/g, "`<U+200B>``");

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/runtime/channels/lib/format.mjsView on unpkg · L129

scripts/boot-smoke.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/boot-smoke.mjsView on unpkg · L1

scripts/build-runtime-linux.shView file

•path = scripts/build-runtime-linux.sh kind = build_helper sizeBytes = 14047 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-runtime-linux.shView on unpkg

src/runtime/agent/orchestrator/tools/bash-session.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/runtime/agent/orchestrator/tools/bash-session.mjsView on unpkg

scripts/session-ingest-smoke.mjsView file

59patternName = generic_password severity = medium line = 59 matchedText = const js... });

Medium

Secret Pattern

Hardcoded password in scripts/session-ingest-smoke.mjs

scripts/session-ingest-smoke.mjsView on unpkg · L59