monomind@2.18.2
Open-source CLI extension for Claude Code, OpenCode, Antigravity, Kimi Code, and Codex. Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. Apache 2.0 licensed. See https://github.c
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe postinstall hook makes an unscoped recursive change to the consumer’s dependency tree, creating unresolved destructive risk. The inspected evidence does not establish a concrete malicious payload or exfiltration, so warn rather than block.
Decision evidence
public snapshot- The postinstall hook runs a recursive deletion search in the consumer’s node_modules on non-Windows systems, removing entries whose names match ._*.
- The CLI shim locates and imports the @monoes/monomindcli executable.
- The cleanup targets the narrow ._* filename pattern; the inspected source does not establish what matching files contain or show an additional payload, network transfer, or persistence behavior.
Source & flagged code
6 flagged · loading sourceInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook runs a recursive deletion search in the consumer’s node_modules on non-Windows systems, removing entries whose names match ._*.
package.jsonView on unpkg · L84Findings
Affected versions and remediation
This report applies to monomind@2.18.2.
See all versions of monomind for other recorded verdicts.
- Review the evidence and your use of monomind@2.18.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.