Minimax Monitor

• Analyzed: May 10, 2026, 6:43 AM
• Findings: 1
• Version: 1.1.0
• Hash: e0ce043c822978e18bb6e20ffc28b1e3e6373623784e087c3def3c12c060f135
• Source: palm
• External report: View on VirusTotal

Findings (1)

The bundle contains a Node.js server (mmx-monitor-server.js) that is vulnerable to shell injection due to the use of execSync and exec with unsanitized string interpolation in the runMmx functions. Additionally, the server implements a broad CORS policy (Access-Control-Allow-Origin: *) on a local port (9876), which could allow malicious websites visited by the user to interact with the local API and potentially access the MiniMax API key. While these represent significant security flaws (vulnerabilities), there is no clear evidence of intentional malice or data exfiltration to unauthorized third-party domains.