monomind@2.24.7
Open-source CLI extension for Claude Code, OpenCode, Antigravity, Kimi Code, and Codex. Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. Apache 2.0 licensed. See https://github.c
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe install-time deletion creates a real but limited filesystem risk, so a warning is appropriate. The inspected source does not establish exfiltration, permission abuse, or other behavior warranting a block.
Decision evidence
public snapshot- package.json defines a postinstall hook that runs on non-Windows systems and deletes files matching `._*` beneath `node_modules`.
- The deletion is limited by filename pattern, which is consistent with cleaning AppleDouble metadata files.
- The inspected hook contains no network request or credential transfer.
Source & flagged code
5 flagged · loading sourceInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json defines a postinstall hook that runs on non-Windows systems and deletes files matching `._*` beneath `node_modules`.
package.jsonView on unpkg · L84Findings
Affected versions and remediation
This report applies to monomind@2.24.7.
See all versions of monomind for other recorded verdicts.
- Review the evidence and your use of monomind@2.24.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.