monomindcli@2.29.0

BLOCKED

Publisher claims: "CLI engine for Monomind — an open-source MCP server for Claude Code, OpenCode, Antigravity, Kimi Code, and Codex, with a codebase knowledge graph (tree-sitter + SQLite), persistent memory, multi-agent task coordination, and session hooks. Apache 2.0 licen" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher monoes · joined 0 days agoInstalls 14,657Last detonated 50 min ago

Dispute verdict

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.9sprocessdependency install exit 1

1.0sprocessexec /usr/bin/timeout

1.0sprocessexited 1: This is an install problem, not a crash — nothing was reported.

1.0sclaimedno tools/list reply (exit 1)

1.0sprocessscript backend runs setup only

Static findings

MEDIUM

File type combined with upload actiondist/src/commands/pick.js:37 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

Instructs the agent to modify its persistent memory or instruction filesdist/src/commands/init.js:86 · Instructs the agent to modify its persistent memory or instruction files

AST01

HIGH

npx invocation of non-well-known packagedist/src/init/upgrade.js:100 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

document.cookie accessdist/src/ui/markdown.js:37 · document.cookie access — can steal session cookies

AST07

HIGH

npx invocation of non-well-known packagebin/cli.js:8 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commanddist/src/mcp-server.d.ts:170 · Process kill command — agent can terminate processes

AST05

HIGH

Process kill commanddist/src/mcp-server.js:931 · Process kill command — agent can terminate processes

AST05

HIGH

Access to sensitive file pathsdist/src/mcp-server.js:812 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagedist/src/init/upgrade.js:244 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

URL using raw IP addressdist/src/orgrt/server.js:105 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressdist/src/orgrt/server.js:105 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Auto-update or dynamic fetch configurationdist/src/update/index.js:92 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

npx invocation of non-well-known packageREADME.md:298 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commanddist/src/mcp-server.js:176 · Process kill command — agent can terminate processes

AST05

HIGH

Process kill commanddist/src/mcp-server.js:908 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packageREADME.md:45 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Access to sensitive file pathsdist/src/mcp-server.js:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Process kill commandbin/cli.js:130 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packageREADME.md:110 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Prompt injection attemptREADME.md:398 · Prompt injection attempt — 'ignore previous instructions'

AST01

CRITICAL

HTML comment carrying imperative instructions to the agentREADME.md:457 · HTML comment carrying imperative instructions to the agent

AST01

HIGH

Access to sensitive file pathsdist/src/orgrt/policy.js:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Auto-update or dynamic fetch configurationdist/src/cli-startup.js:16 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Hidden zero-width characters detecteddist/src/ui/markdown.js:60 · Hidden zero-width characters detected — may conceal content

AST07

HIGH

npx invocation of non-well-known packagedist/src/orgrt/remote.js:45 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Auto-update or dynamic fetch configurationdist/src/update/index.js:2 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Process kill commandbin/cli.js:134 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packageREADME.md:263 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Auto-update or dynamic fetch configurationdist/src/orgrt/daemon.js:98 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Process kill commandbin/cli.js:430 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagescripts/publish.sh:49 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/src/commands/init.js:165 · npx invocation of non-well-known package — may execute untrusted code

AST06

LOW

Unpinned dependencybin/cli.js:389 · Unpinned dependency

AST06