Is Mex safe?
- Node.js shell/command execution
- Possible command injection (exec with dynamic command)
- Defense-evasion command idiom
What to do: Read the findings below before installing: each one opens the exact line of code it was found on.
Mex is an npm package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 2 risky constructs are reported for review. It can: install time execution, mcp tools detected, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 40/100 (medium).
mex-agent 0.8.3
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Mex's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (8)
The code builds an OS command out of values that can change at runtime, then runs it through a shell.
execSync(`${probe} ${cmd}`, { stdio: "ignore" });Why it matters: If any of those values come from untrusted input, an attacker can run their own commands on the machine.
Fix: Use execFile/spawn with an argument array instead of exec; never build a shell command string from external input.
An MCP tool exposes a powerful capability (files, shell, network, browser, or credentials).
server.tool(
"mex_read_file",Why it matters: Wired into an agent, these grant it real access to your machine — confirm each is required.
Fix: Confirm each powerful tool is required and constrained; broad MCP tools (shell/filesystem/network) grant an agent significant host access.
A hardcoded credential (API key, token, or private key) is shipped in the code.
export const WEB3FORMS_ACCESS_KEY = "2054…[redacted, 36 chars]";
Why it matters: Anyone who gets the package gets the secret — rotate it and load secrets at runtime instead.
Fix: Remove the secret from the code, rotate it immediately, and load credentials from the environment or a secrets manager at runtime.
A command uses a known defense-evasion idiom: PowerShell execution-policy bypass / encoded command / hidden window, macOS code-signing bypass, or launching a payload from a world-writable temp directory. These are hallmarks of droppers and rarely appear in legitimate code.
const child = spawn("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {Fix: Verify why the component bypasses execution policy / code signing or runs from a temp directory; these patterns are characteristic of malware staging.
The component can run operating-system commands or spawn processes.
import { spawnSync } from "node:child_process";const res = spawnSync("claude", args, { cwd: root, encoding: "utf-8", maxBuffer: 128 * 1024 * 1024 });import { spawnSync } from "node:child_process";const result = spawnSync(config.command[0], [...config.command.slice(1), ...process.argv.slice(3)], {import { spawn, spawnSync } from "node:child_process";const result = spawnSync(command, args, {import { spawnSync } from "node:child_process";const result = spawnSync(hook.command, hook.args, {import { spawn, spawnSync } from "node:child_process";const child = spawn(command, args, {const result = spawnSync(command, args, {import { spawnSync } from "node:child_process";const res = spawnSync(process.execPath, [CLI, ...args], {import { spawnSync } from "node:child_process";const result = spawnSync(command, args, {import { spawn } from "node:child_process";const child = spawn(process.execPath, ["--import", preload, cli, ...args], { cwd, env, stdio: ["ignore", "pipe", "pipe", "pipe"], windowsHide: true });import { execFileSync } from "node:child_process";import { spawn, spawnSync } from "node:child_process";child = spawn(process.execPath, [cli, "--no-open"], {const setup = spawn(process.execPath, [cli, "setup", "--cli"], {const setup = spawn(process.execPath, [cli, "setup", "--cli", "--mode", "code-repo"], {const located = spawnSync(process.platform === "win32" ? "where.exe" : "which", [command], {const git = spawnSync("git", ["rev-parse", "--show-toplevel"], options);const found = spawnSync(locator, [command], options);
Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.
package.json has a 'prepare' script (runs on git/local installs and before publishing).
"prepare": "npm run build",
Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.
Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.
The component makes outbound network requests.
await fetch(`${API_ROOT}/telemetry/page`, {return fetch(`${API_ROOT}${path}`, {import { createServer } from "node:http";import http from 'node:http';
import https from 'node:https';
https.get = (...args) => { const request = https.request(...args); request.end(); return request; };// Yoga loads its embedded WASM through fetch(data:). This performs no I/O.
const html = await fetch(`${url.origin}/`, { redirect: "error" });const bootstrap = await fetch(`${url.origin}/api/v1/session/bootstrap`, {const session = await fetch(`${url.origin}/api/v1/session`, {const logging = await fetch(`${url.origin}/api/v1/settings/logging`, {const capabilities = await fetch(`${url.origin}/api/v1/capabilities`, {const relayDrafts = await fetch(`${url.origin}/api/v1/relays/drafts?limit=25`, {const relays = await fetch(`${url.origin}/api/v1/relays?perspective=all&limit=25`, {const home = await fetch(`${url.origin}/api/v1/home`, {const overview = await fetch(`${url.origin}/api/v1/overview`, {const activity = await fetch(`${url.origin}/api/v1/activity`, {const search = await fetch(`${url.origin}/api/v1/search?q=packedService&limit=10`, {const code = await fetch(
const wikiSearch = await fetch(`${url.origin}/api/v1/search?q=packed&limit=10`, {const excludedSearch = await fetch(`${url.origin}/api/v1/search?q=excluded-only-sentinel&limit=10`, {const completeKnowledgeList = await fetch(`${url.origin}/api/v1/wiki/entities?limit=50`, {const knowledgeList = await fetch(
const knowledge = await fetch(
const relations = await fetch(
Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An MCP tool surface (manifest or tool definitions) was found.
const server = new McpServer({const transport = new StdioServerTransport();
server.tool(
"mex_check",server.tool(
"mex_heartbeat",server.tool(
"mex_log",server.tool(
"mex_read_file",server.tool(
"mex_timeline",Why it matters: Just context — review which tools it offers and their permissions.
Fix: Review the declared MCP tools and their permissions.
How attackers abuse these capabilities
Interactive labs on the attack class behind the rules above. They show the technique, not anything found in Mex.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →