monomind@2.24.5
Open-source CLI extension for Claude Code, OpenCode, Antigravity, Kimi Code, and Codex. Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. Apache 2.0 licensed. See https://github.c
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe postinstall hook performs a broad filesystem cleanup whose safety depends on the contents of node_modules. The targeted filename pattern suggests metadata cleanup, but the source does not explain the operation or bound its scope further, so a warning is appropriate.
Decision evidence
public snapshot- The postinstall hook runs a recursive deletion search under node_modules on non-Windows systems, removing files whose names match ._*; its full effect depends on the installed tree.
- The package declares @monoes/monomindcli at the matching 2.24.5 release, and its CLI shim locates and imports that package.
- The README describes a local CLI and discusses security features; the inspected text does not attempt to dictate this review’s verdict.
- The deletion targets ._* files, commonly AppleDouble metadata, and the inspected source shows no network transfer or credential handling in this hook.
- The CLI shim delegates to the declared CLI dependency; the inspected shim contains no separate payload or unrelated command execution.
Source & flagged code
9 flagged · loading sourceInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe postinstall hook runs a recursive deletion search under node_modules on non-Windows systems, removing files whose names match ._*; its full effect depends on the installed tree.
package.jsonView on unpkg · L84Findings
Affected versions and remediation
This report applies to monomind@2.24.5.
See all versions of monomind for other recorded verdicts.
- Review the evidence and your use of monomind@2.24.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.