registry / AI-agent capability abuse / monomind / 2.7.7

monomind@2.7.7

Open-source CLI extension for Claude Code. Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. MIT licensed, runs locally, no data leaves your machine.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection found no concrete malware or unconsented lifecycle mutation. The explicit init path nevertheless persists a global Claude hook that executes a mutable latest version, warranting a warning.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `monomind init`

Impact

Persists a package-controlled SessionStart command in the user Claude configuration.

Mechanism

Explicit Claude configuration and hook installation

AI rationale

Evidence

package.jsonpackages/@monomind/cli/dist/src/commands/init.jspackages/@monomind/cli/dist/src/init/executor.jspackages/@monomind/cli/dist/src/services/crash-reporter.jspackages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/detect-secrets.js.claude/settings.json~/.claude/CLAUDE.md~/.claude/settings.json.monomind/monograph.watch.pid.monomind/monograph.watch.log

Network endpoints1

api.github.com/repos/${repo}/issues

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`init` writes global `~/.claude/CLAUDE.md` and `~/.claude/settings.json`.
It adds a SessionStart hook running `npx --yes monomind@latest tokens today`.
Default `init` starts a detached project watcher and invokes `npx monomind@latest swarm init`.
Crash reporting is enabled by default and can send redacted crash data to GitHub.

Evidence against

The only postinstall action deletes `._*` files under `node_modules`; it does not install agent configuration.
Global agent changes occur only through explicit `monomind init`, not installation or import.
CLI/MCP execution requires explicit command or opt-in MCP autodetect.
Secret detection scans a caller-provided target path and no exfiltration was found in that tool.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = find node_modules -name '._*' -delete 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = find node_modules -name '._*' -delete 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

README.mdView file

•isSafe('Ignore all previous instructions'); // → false (~0.04ms)

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/detect-secrets.jsView file

282patternName = generic_password severity = medium line = 282 matchedText = password...er',

Medium

Secret Pattern

Package contains a possible secret pattern.

packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/detect-secrets.jsView on unpkg · L282

scripts/ua-enrich.mjsView file

34import { fileURLToPath } from 'url'; L35: import { execSync, spawnSync } from 'child_process'; L36:

High

Child Process

Package source references child process execution.

scripts/ua-enrich.mjsView on unpkg · L34

packages/@monomind/cli/dist/src/init/statusline-generator.jsView file

186L187: const raw = safeExec(\`sh -c '\${script}'\`, 3000); L188: if (!raw) return result;

High

Shell

Package source references shell execution.

packages/@monomind/cli/dist/src/init/statusline-generator.jsView on unpkg · L186

41const path = require('path'); L42: const { execSync } = require('child_process'); L43: const os = require('os'); ... L49: L50: const CWD = process.env.CLAUDE_PROJECT_DIR || process.cwd(); L51: L52: // Read monomind version — check global install first, then CWD package.json L53: function getVersion() { ... L66: if (!pkgStat || pkgStat.size > 1024 * 1024) continue; L67: const pkg = JSON.parse(fs.readFileSync(p, 'utf-8')); L68: if (pkg.version && (pkg.name === 'monomind' || pkg.name === '@monomind/cli' || (pkg.name || '').startsWith('@monomind'))) { ... L1329: if (!options.statusline.enabled) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/@monomind/cli/dist/src/init/statusline-generator.jsView on unpkg · L41

packages/@monomind/cli/dist/src/commands/neural-registry.jsView file

241// Validate patterns (security check) L242: const suspicious = ['eval(', 'Function(', 'exec(', 'spawn(', 'child_process', 'rm -rf', 'sudo', '<script>', 'javascript:', 'data:']; L243: const validPatterns = patterns.filter(p => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

packages/@monomind/cli/dist/src/commands/neural-registry.jsView on unpkg · L241

bin/cli.jsView file

10const cliPath = join(__dirname, '..', 'packages', '@monomind', 'cli', 'bin', 'cli.js'); L11: await import(pathToFileURL(cliPath).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L10

packages/@monomind/cli/dist/src/services/crash-reporter.jsView file

15import { createHash } from 'crypto'; L16: import { execFile } from 'child_process'; L17: import { promisify } from 'util'; L18: const execFileAsync = promisify(execFile); L19: const STATE_DIR = join(homedir(), '.monomind'); L20: const CONFIG_PATH = join(STATE_DIR, 'crash-reporting.json'); ... L40: return fallback; L41: return JSON.parse(readFileSync(path, 'utf8')); L42: } ... L85: /(?:token|bearer)\s*[:=]\s*['"]?[^\s'"]{10,}['"]?/gi, L86: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g, L87: /sk-ant-[a-zA-Z0-9_-]{20,}/g,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/@monomind/cli/dist/src/services/crash-reporter.jsView on unpkg · L15

packages/@monomind/cli/dist/src/commands/providers.jsView file

30output.printError('Provider name is required. Use -p <name> or pass as first argument.'); L31: return { success: false, exitCode: 1 }; L32: } L33: const cwd = process.cwd(); L34: const config = configManager.getConfig(cwd); ... L109: test: async () => { L110: const key = process.env.ANTHROPIC_API_KEY || getConfigApiKey('anthropic'); L111: if (key) ... L137: const entry = configuredProviders.find((p) => typeof p.name === 'string' && p.name.toLowerCase() === 'ollama'); L138: const baseUrl = entry?.baseUrl || 'http://localhost:11434'; L139: let parsedBaseUrl; ... L148: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

packages/@monomind/cli/dist/src/commands/providers.jsView on unpkg · L30

packages/@monomind/cli/dist/src/init/executor.jsView file

341// Resolve @monoes/monograph from the CLI package's own node_modules first L342: // (correct for npm/npx installs), then fall back to user project node_modules. L343: let entryPoint = null; ... L355: try { L356: const { execSync } = await import('child_process'); L357: execSync('npm install @monoes/monograph', { cwd: targetDir, stdio: 'ignore', timeout: 60000 });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/@monomind/cli/dist/src/init/executor.jsView on unpkg · L341

scripts/generate-channel-profile-assets.shView file

•path = scripts/generate-channel-profile-assets.sh kind = build_helper sizeBytes = 3460 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-channel-profile-assets.shView on unpkg

packages/@monomind/cli/dist/src/commands/doctor-project-checks.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = monomind@2.7.3 matchedIdentity = npm:bW9ub21pbmQ:2.7.3 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/@monomind/cli/dist/src/commands/doctor-project-checks.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = find node_modules -name '._*' -delete 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = find node_modules -name '._*' -delete 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

README.mdView file

•isSafe('Ignore all previous instructions'); // → false (~0.04ms)

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

Findings

1 Critical6 High9 Medium6 Low

CriticalPrevious Version Dangerous Deltapackages/@monomind/cli/dist/src/commands/doctor-project-checks.js

HighInstall Time Lifecycle Scriptspackage.json

HighAi Reviewer ManipulationREADME.md

HighChild Processscripts/ua-enrich.mjs

HighShellpackages/@monomind/cli/dist/src/init/statusline-generator.js

HighCloud Metadata Accesspackages/@monomind/cli/dist/src/commands/providers.js

HighRuntime Package Installpackages/@monomind/cli/dist/src/init/executor.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patternpackages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/detect-secrets.js

MediumDynamic Requirebin/cli.js

Affected versions and remediation

This report applies to monomind@2.7.7.

See all versions of monomind for other recorded verdicts.

Review the evidence and your use of monomind@2.7.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-25 21:42:17.855Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code