registry  /  monomind  /  1.18.1

monomind@1.18.1

⚠ Under review

Monomind - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 34 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 410 file(s), 5.47 MB of source, external domains: 127.0.0.1, a2a-protocol.org, accounts.google.com, api.anthropic.com, api.osv.dev, api.pinata.cloud, api.web3.storage, cdn.jsdelivr.net, cdnjs.cloudflare.com, cli.github.com, cloud.google.com, cloudflare-ipfs.com, dweb.link, gateway.pinata.cloud, gemini.google.com, generativelanguage.googleapis.com, git-scm.com, github.com, hub.docker.com, ipfs.io, login.microsoftonline.com, nodejs.org, pinata.cloud, registry.npmjs.org, services.nvd.nist.gov, storage.googleapis.com, w3s.link, web3.storage, www.instagram.com, www.linkedin.com, www.w3.org, x.com

Source & flagged code

27 flagged · loading source
README.mdView file
•isSafe('Ignore all previous instructions'); // → false (~0.04ms)
High
Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg
packages/@monomind/guidance/dist/manifest-validator.jsView file
702patternName = private_key_rsa severity = critical line = 702 matchedText = params: ...' },
Critical
Critical Secret

Package contains a critical-looking secret pattern.

packages/@monomind/guidance/dist/manifest-validator.jsView on unpkg · L702
702patternName = private_key_rsa severity = critical line = 702 matchedText = params: ...' },
Critical
Secret Pattern

RSA private key in packages/@monomind/guidance/dist/manifest-validator.js

packages/@monomind/guidance/dist/manifest-validator.jsView on unpkg · L702
scripts/ua-enrich.mjsView file
34import { fileURLToPath } from 'url'; L35: import { execSync, spawnSync } from 'child_process'; L36:
High
Child Process

Package source references child process execution.

scripts/ua-enrich.mjsView on unpkg · L34
packages/@monomind/cli/dist/src/init/statusline-generator.jsView file
186L187: const raw = safeExec(\`sh -c '\${script}'\`, 3000); L188: if (!raw) return result;
High
Shell

Package source references shell execution.

packages/@monomind/cli/dist/src/init/statusline-generator.jsView on unpkg · L186
41const path = require('path'); L42: const { execSync } = require('child_process'); L43: const os = require('os'); ... L49: L50: const CWD = process.env.CLAUDE_PROJECT_DIR || process.cwd(); L51: L52: // Read monomind version — check global install first, then CWD package.json L53: function getVersion() { ... L66: if (!pkgStat || pkgStat.size > 1024 * 1024) continue; L67: const pkg = JSON.parse(fs.readFileSync(p, 'utf-8')); L68: if (pkg.version && (pkg.name === 'monomind' || pkg.name === '@monomind/cli' || (pkg.name || '').startsWith('@monomind'))) { ... L1268: if (!options.statusline.enabled) {
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/@monomind/cli/dist/src/init/statusline-generator.jsView on unpkg · L41
packages/@monomind/guidance/dist/analyzer.jsView file
1284patternName = generic_password severity = medium line = 1284 matchedText = { type: ...' },
Medium
Secret Pattern

Hardcoded password in packages/@monomind/guidance/dist/analyzer.js

packages/@monomind/guidance/dist/analyzer.jsView on unpkg · L1284
2067patternName = generic_password severity = medium line = 2067 matchedText = { type: ...' },
Medium
Secret Pattern

Hardcoded password in packages/@monomind/guidance/dist/analyzer.js

packages/@monomind/guidance/dist/analyzer.jsView on unpkg · L2067
2043{ type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' }, L2044: { type: 'must-not-contain', value: 'eval(', severity: 'critical' }, L2045: ],
Low
Eval

Package source references a known benign dynamic code generation pattern.

packages/@monomind/guidance/dist/analyzer.jsView on unpkg · L2043
bin/cli.jsView file
10const cliPath = join(__dirname, '..', 'packages', '@monomind', 'cli', 'bin', 'cli.js'); L11: await import(pathToFileURL(cliPath).href);
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L10
packages/@monomind/cli/dist/src/commands/providers.jsView file
33], L34: data: [ L35: { provider: 'Anthropic', type: 'LLM', models: 'claude-3.5-sonnet, opus', status: output.success('Active') }, ... L67: output.printError('Provider name is required. Use -p <name> or pass as first argument.'); L68: return { success: false, exitCode: 1 }; L69: } L70: const cwd = process.cwd(); L71: const config = configManager.getConfig(cwd); ... L146: test: async () => { L147: const key = process.env.ANTHROPIC_API_KEY || getConfigApiKey('anthropic'); L148: if (key) ... L174: const entry = configuredProviders.find((p) => typeof p.name === 'string' && p.name.toLowerCase() === 'ollama');
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

packages/@monomind/cli/dist/src/commands/providers.jsView on unpkg · L33
packages/@monomind/cli/dist/workflow/builtin-handlers.jsView file
68var node_path_1 = require("node:path"); L69: var node_child_process_1 = require("node:child_process"); L70: // Call npx monomind browse <args> and return stdout. Never throws. L71: function browseCmd(args, timeoutMs) {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/@monomind/cli/dist/workflow/builtin-handlers.jsView on unpkg · L68
scripts/install.shView file
•path = scripts/install.sh kind = build_helper sizeBytes = 12269 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg
packages/@monomind/cli/dist/src/init/executor.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = monomind@1.16.11 matchedIdentity = npm:bW9ub21pbmQ:1.16.11 similarity = 0.742 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/@monomind/cli/dist/src/init/executor.jsView on unpkg
.claude/agents/core/reviewer.mdView file
85patternName = generic_password severity = medium line = 85 matchedText = console....rd);
Medium
Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L85
.claude/agents/testing/testing-api-tester.mdView file
78patternName = generic_password severity = medium line = 78 matchedText = password...ord'
Medium
Secret Pattern

Hardcoded password in .claude/agents/testing/testing-api-tester.md

.claude/agents/testing/testing-api-tester.mdView on unpkg · L78
.claude/agents/testing/testing-performance-benchmarker.mdView file
94patternName = generic_password severity = medium line = 94 matchedText = password...123'
Medium
Secret Pattern

Hardcoded password in .claude/agents/testing/testing-performance-benchmarker.md

.claude/agents/testing/testing-performance-benchmarker.mdView on unpkg · L94
.claude/agents/sparc/refinement.mdView file
41patternName = generic_password severity = medium line = 41 matchedText = password...23!'
Medium
Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L41
69patternName = generic_password severity = medium line = 69 matchedText = password...ord'
Medium
Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L69
245patternName = generic_password severity = medium line = 245 matchedText = passwo...
Medium
Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L245
packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/detect-secrets.jsView file
282patternName = generic_password severity = medium line = 282 matchedText = password...er',
Medium
Secret Pattern

Hardcoded password in packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/detect-secrets.js

packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/detect-secrets.jsView on unpkg · L282
packages/@monomind/cli/.claude/agents/core/reviewer.mdView file
85patternName = generic_password severity = medium line = 85 matchedText = console....rd);
Medium
Secret Pattern

Hardcoded password in packages/@monomind/cli/.claude/agents/core/reviewer.md

packages/@monomind/cli/.claude/agents/core/reviewer.mdView on unpkg · L85
packages/@monomind/cli/.claude/agents/testing/testing-api-tester.mdView file
78patternName = generic_password severity = medium line = 78 matchedText = password...ord'
Medium
Secret Pattern

Hardcoded password in packages/@monomind/cli/.claude/agents/testing/testing-api-tester.md

packages/@monomind/cli/.claude/agents/testing/testing-api-tester.mdView on unpkg · L78
packages/@monomind/cli/.claude/agents/testing/testing-performance-benchmarker.mdView file
94patternName = generic_password severity = medium line = 94 matchedText = password...123'
Medium
Secret Pattern

Hardcoded password in packages/@monomind/cli/.claude/agents/testing/testing-performance-benchmarker.md

packages/@monomind/cli/.claude/agents/testing/testing-performance-benchmarker.mdView on unpkg · L94
packages/@monomind/cli/.claude/agents/sparc/refinement.mdView file
41patternName = generic_password severity = medium line = 41 matchedText = password...23!'
Medium
Secret Pattern

Hardcoded password in packages/@monomind/cli/.claude/agents/sparc/refinement.md

packages/@monomind/cli/.claude/agents/sparc/refinement.mdView on unpkg · L41
69patternName = generic_password severity = medium line = 69 matchedText = password...ord'
Medium
Secret Pattern

Hardcoded password in packages/@monomind/cli/.claude/agents/sparc/refinement.md

packages/@monomind/cli/.claude/agents/sparc/refinement.mdView on unpkg · L69
245patternName = generic_password severity = medium line = 245 matchedText = passwo...
Medium
Secret Pattern

Hardcoded password in packages/@monomind/cli/.claude/agents/sparc/refinement.md

packages/@monomind/cli/.claude/agents/sparc/refinement.mdView on unpkg · L245

Findings

3 Critical5 High21 Medium5 Low
CriticalCritical Secretpackages/@monomind/guidance/dist/manifest-validator.js
CriticalPrevious Version Dangerous Deltapackages/@monomind/cli/dist/src/init/executor.js
CriticalSecret Patternpackages/@monomind/guidance/dist/manifest-validator.js
HighAi Reviewer ManipulationREADME.md
HighChild Processscripts/ua-enrich.mjs
HighShellpackages/@monomind/cli/dist/src/init/statusline-generator.js
HighCloud Metadata Accesspackages/@monomind/cli/dist/src/commands/providers.js
HighRuntime Package Installpackages/@monomind/cli/dist/workflow/builtin-handlers.js
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencepackages/@monomind/cli/dist/src/init/statusline-generator.js
MediumShips Build Helperscripts/install.sh
MediumStructural Risk Force Deep Review
MediumSecret Pattern.claude/agents/core/reviewer.md
MediumSecret Pattern.claude/agents/testing/testing-api-tester.md
MediumSecret Pattern.claude/agents/testing/testing-performance-benchmarker.md
MediumSecret Pattern.claude/agents/sparc/refinement.md
MediumSecret Pattern.claude/agents/sparc/refinement.md
MediumSecret Pattern.claude/agents/sparc/refinement.md
MediumSecret Patternpackages/@monomind/guidance/dist/analyzer.js
MediumSecret Patternpackages/@monomind/guidance/dist/analyzer.js
MediumSecret Patternpackages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/detect-secrets.js
MediumSecret Patternpackages/@monomind/cli/.claude/agents/core/reviewer.md
MediumSecret Patternpackages/@monomind/cli/.claude/agents/testing/testing-api-tester.md
MediumSecret Patternpackages/@monomind/cli/.claude/agents/testing/testing-performance-benchmarker.md
MediumSecret Patternpackages/@monomind/cli/.claude/agents/sparc/refinement.md
MediumSecret Patternpackages/@monomind/cli/.claude/agents/sparc/refinement.md
MediumSecret Patternpackages/@monomind/cli/.claude/agents/sparc/refinement.md
LowScripts Present
LowEvalpackages/@monomind/guidance/dist/analyzer.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings