registry / monomind / 2.11.12

monomind@2.11.12

Open-source CLI extension for Claude Code and Antigravity (agy). Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. Apache 2.0 licensed, runs locally, no data leaves your machine.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Source inspection found a narrowly filtered local cleanup hook and a CLI shim that imports a version-pinned, separately named dependency. The scanner’s malicious label and README manipulation hint were not supported by the inspected source.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The cleanup runs during package installation; the shim runs when the monomind command is invoked.

Impact

The inspected behavior removes matching local files and starts the package’s CLI; it shows no unrelated data transfer or agent configuration mutation.

Mechanism

On non-Windows systems, the hook deletes files named ._* under node_modules. The CLI shim locates and imports @monoes/monomindcli.

AI rationale

Evidence

package.jsonbin/cli.js

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall command removes only files named ._* beneath node_modules on non-Windows systems.
The package pins a separately named CLI dependency and its executable shim locates and imports that CLI.
The README describes the package as an MCP server and discloses its network activity and permission model.
The README says the package’s postinstall does not download code; the inspected hook performs local cleanup.

Evidence against

The postinstall hook does delete matching files throughout node_modules, but the inspected name filter and scope indicate cleanup rather than an attack.

Behavioral surface

Source

DynamicRequireFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.04 KB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 3-43json

3 "version": "2.11.12",

4 "description": "Open-source CLI extension for Claude Code and Antigravity (agy). Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. Apache 2.0 licensed, runs locally, no data leaves your machine.",

5 "type": "module",

6 "bin": {

7 "monomind": "./bin/cli.js"

8 },

9 "homepage": "https://github.com/monoes/monomind#readme",

10 "bugs": {

11 "url": "https://github.com/monoes/monomind/issues",

12 "email": "support@monoes.me"

13 },

14 "funding": {

15 "type": "github",

16 "url": "https://github.com/sponsors/nokhodian"

17 },

18 "files": [

19 "bin/**",

20 "README.md",

21 "LICENSE"

22 ],

23 "dependencies": {

24 "@monoes/monomindcli": "2.11.12"

25 },

26 "devDependencies": {

27 "@biomejs/biome": "^2.5.8",

28 "@types/better-sqlite3": "^7.6.13",

29 "@types/node": "^20.0.0",

Low

Suspicious Dependency Evidence

The package pins a separately named CLI dependency and its executable shim locates and imports that CLI.

package.jsonView on unpkg · L23

30 "better-sqlite3": ">=12.0.0",

31 "tsx": "^4.21.0",

32 "typescript": "^7.0.2",

33 "vite": ">=8.0.16",

34 "vitest": "^4.1.11",

35 "@monoes/monograph": "1.6.6"

36 },

37 "engines": {

38 "node": ">=20.0.0"

39 },

40 "repository": {

41 "type": "git",

42 "url": "https://github.com/monoes/monomind.git"

43 },

Lines 62-103json

62 "organizations",

63 "autonomous-agents",

64 "hooks",

65 "antigravity",

66 "agy",

67 "gemini"

68 ],

69 "author": {

README.mdView file

•isSafe('Ignore all previous instructions'); // → false (~0.04ms)

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

94### Trust & Security | Concern | Answer | |---|---| | **License** | [Apache 2.0](LICENSE) — use it however you want | | **Data privacy** | Your code and memory store stay local. Monomind does make outbound network calls, all to third-party services — never to a monoes-controlled server: crash reporting asks once, the first time an interactive crash happens, whether to file a GitHub issue via the GitHub API (showing the local report path before asking, defaulting to No). Until you've answered, a non-interactive crash — CI, agents, most real runs — never as

Low

Ai Review Evidence

The README describes the package as an MCP server and discloses its network activity and permission model.

README.mdView on unpkg · L94

bin/cli.jsView file

14L15: const require = createRequire(import.meta.url); L16:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L14

17const CLI_PKG = '@monoes/monomindcli'; /** * Locate the CLI's bin on disk. * * Deliberately does NOT use require.resolve() on the package: the CLI declares * an `exports` map, which gates every specifier. Published 2.7.12 exports "." * with only an `import` condition, so CJS require.resolve()

Low

Suspicious Dependency Evidence

The package pins a separately named CLI dependency and its executable shim locates and imports that CLI.

bin/cli.jsView on unpkg · L17

52const cliPath = resolveCliBin(); if (!cliPath) { console.error( '[monomind] Could not locate @monoes/monomindcli.\n' + ' This is an install problem, not a crash.\n' + ' Try: npm i -g monomind@latest', ); process.exit(1); } await import

Low

Suspicious Dependency Evidence

The package pins a separately named CLI dependency and its executable shim locates and imports that CLI.

bin/cli.jsView on unpkg · L52

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "if(process.platform!=='win32'){try{require('child_process').execSync('find node_modules -name ._* -delete 2>/dev/null',{stdio:'ignore'})}catch{}}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "if(process.platform!=='win32'){try{require('child_process').execSync('find node_modules -name ._* -delete 2>/dev/null',{stdio:'ignore'})}catch{}}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

82"scripts": { "postinstall": "node -e \"if(process.platform!=='win32'){try{require('child_process').execSync('find node_modules -name ._* -delete 2>/dev/null',{stdio:'ignore'})}catch{}}\"", "dev": "cd packages/@monomind/cli && tsx watch src/index.ts", "buil

Low

Suspicious Lifecycle Evidence

The postinstall command removes only files named ._* beneath node_modules on non-Windows systems.

package.jsonView on unpkg · L82

Findings

1 Critical2 High2 Medium7 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighAi Reviewer ManipulationREADME.md

MediumDynamic Requirebin/cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencebin/cli.js

LowAi Review EvidenceREADME.md

Affected versions and remediation

This report applies to monomind@2.11.12.

See all versions of monomind for other recorded verdicts.

Review the evidence and your use of monomind@2.11.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 07:16:49.802Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.